Slashdot Mirror
Digital Credentials Offer Enhanced Privacy
John Q Random writes "Stefan Brands's company credentica.com announced their U-Prove library and SDK implementing ID tokens — also known as digital credentials or private credentials. (Private Credentials are a cool PKI replacement and anonymous e-cash tech that allows you to prove certified attributes like age, credit rating, group membership, etc. without revealing who you are; to allow you to have a digital life without the digital dossier effect inherent in a central databases.) Following this announcement, Adam Back announced credlib, an open source implementation of Brands credentials (and the older more basic Chaum certificates). These developments relate to recent news from IBM's Zurich labs on their identity-mixer project (previously discussed on Slashdot) that is based on the less efficient Jan Camenisch and Anna Lysyanskaya credentials."
This is under the presumption that the holder/applicant is who he claims he is.
I guess it'll just get added to the to-do list of phishers and ID thieves.
And the fact that (real) sensitive data has to be included to prevent 'leading/sharing' just begs for hacking.
Virtual Betting on Facebook for non-geeks.
At first I thought is said "Digital Credentials Offer Enhanced Piracy"
"Me SmartCard an' Biometrics allow en' more booty to be plundered, yarhhh!"
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
When I read "digital credentials" I immediately thought "(SSL/SMIME) certs and (SSH/PGP) keys". Those are two standard and widely implemented forms of "strong" digital authentication. SSL certs are also already available in hardware tokens, etc, if you like the FOB route. (Just ask the DoD about CAC cards...)
I don't know why people keep trying to reinvent the wheel here.
Following this announcement, Adam Back announced credlib, an open source implementation of Brands credentials (and the older more basic Chaum certificates).
That certainly sounds like a credlib-able solution to the problem.
The theory of relativity doesn't work right in Arkansas.
Where is the threat to individual privacy? As I see it, the threat is companies misusing legitimately-obtained personal information. Now let's tie in privacy with today's earlier discussion about credit card fraud. To buy anything over the Net from a reputable vendor, you usually must provide your legal name, home address, and phone number in order for the credit card transaction to be approved. (Buying from less reputable vendors may actually provide more privacy because AFAIK Paypal doesn't expose all these personal details when you make a payment.) What is the chance that VISA/MC/AMEX will re-engineer their systems to be privacy-preserving?
When I read "digital credentials" I immediately thought "(SSL/SMIME) certs and (SSH/PGP) keys". Those are two standard and widely implemented forms of "strong" digital authentication.
The problem with regular certs is that they are all-or-nothing, so if you disclose your cert to a party, they now have all the information in the cert. For example, consider using a "digital drivers license" to prove your age or using a "digital student ID" to get a student discount; it's totall overkill.
The summary explains why Brands credentials are an improvement:
Private Credentials are a cool PKI replacement and anonymous e-cash tech that allows you to prove certified attributes like age, credit rating, group membership, etc. without revealing who you are (emphasis added)
You don't put things like "age" or "student ID" on a cert, and you certainly wouldn't put them on a key. Instead, you could use the verified IDs from certs/keys to look up information from a master DB, much like Brands and dozens of other interchangable knuckleheads are proposing.
Remember, whether you show up to a "verification service" with a magic cookie/ID/BrandsThing or a cert, you're still trusting a third party to only give out a piece of your total profile at a time. All the while, they're probably really selling the whole DB to random spammers, just like your average credit bureau.
Brands credentials are also an anonymous ecash technology. Zero-knowledge systems were using this when they were doing privacy tech and the freedom network and all that stuff. (the freedom network was an anonymous IP network like onion routing, Tor but more secure).
Nice to see some cypherpunks writing code in this post 911 era of security trumps rights of privacy and personal liberty.
Oh, thats right, I'm reading /. ;)
That's right; I'm a true tech through and through. If manuals are for wimps then TFA is for wussies too. C'mon - Slashdot editors: you need to shorten up those summaries for those of us with post-MTV-era attention spans!
I don't need this certificate myself. Can someone explain why I can't obtain one proving my age (42) and sell it to a youngster? All other attributes are masked.
)9TSS
We both know that isn't the true meaning of piracy!
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
True of all such "private" information storage facilities...
Either the information is kept by someone and can be obtained from the issuer (whether through legitimate legal means or theft. This is valuable information. Unscrupulous people will steal, trade and sell it). You're basically trusting the issuer to keep you safe. SSL certs are kinda like this but there's no pretense of private data being stored encrypted in the cert.
OR
Once the certificate is issued there is no way to identify who it is issued to, which means the only way a security hole in the method comes to light is when massive fraud occurs or if someone brags about breaking it. PGP is kinda like this.
All this does is allow you to buy products or services annoymously from legit vendors, and only so long as the system isn't compromised. The other thing is most non-shady vendors won't want to accept this form of ID/verification. I mean it's great for porn vendors because porn is socially vilified and people don't want to admit to buying it or having it on record. For most other things, the vendor will prefer a method of verification under their control since it'll give them marketing data and also prove to be a better protection against litigation than some anonymous cert.
These posts express my own personal views, not those of my employer
They have an anti-lending option. Here's how it works: the credential can have multiple private keys, one of which has to be random and the others of which can be secrets you would not be happy to sell to a youngster. (Say like your credit card number, or any other info that could be risky to lend to someone). Without all of the private keys you cant use the credential, so the would be lender, or reseller cant transfer the credential without revealing secrets chosen to be risky to share.
The CA or credential issuer, he sees secrets when the credential is issued, however you trust him not to abuse those secrets (and maybe you paid him with the same credit card number eg). However due to the crypto magic the CA cant observe nor trace your uses of the credential back to you even with full collusion with relying parties.
In fact the privacy is unconditionally secure and the user has full control and doesnt have to trust anyone (not CA, not relying parties, etc) only that the software of his credential wallet software is correctly implemented. This software would typically be open source and peer reviewed.
It remains to be seen at this point whether the Camenisch/Lysyanskaya Idemix credentials are really "less efficient" than Brands. Certainly the CL credential work is newer. Brands' stuff is good but the field does not stand still. Until we see benchmarks putting them side by side, it is too early to say which is more efficient.
Parent poster hints at inherent security problems with lack of audit trail with epayments based on private credentials. (Audit trail to reconcile transactions and detect fraud.)
In fact parent poster is uninformed and speculating... audit and balancing of transactions is fully supported by ecash or etoken system using private credentials. (Just not in a way that reveals users buying habits). The merchant receives a signed receipt which he will deposit at the bank. Either verification is online and immediate, or offline; in the online case attempted fraud is rejected immediately, in the offline case attempts to double-spend reveal the identity of the fraudster (this is called "fraud tracing" in ecash parlance.)
Likewise rest of speculation is also bogus; briefly to each argument:
- no one but porn cares about privacy -- oh yeah? care to post your library lending record?, your book purchase record? your magazine purchase record? log of everything you ever bought for cash?
- infers some issue with proofs under litigation? -- wrong, the merchant has a signed receipt -- much better proof than a merchant has with credit card, why do you think credit card fees are high? -- to cover the fraud losses from aggressive repudiations (false claims of fraud by customer), and stolen credit card fraud...
Um, Mr. Knucklehead, sir?
I suggest you read Brands' thesis, or any of his patents, before you spout any more idiotic falsehoods. Your talking about central databases is positive proof that you don't have the beginning of a glimmer of a clue about how this works, and I'm afraid it's not amenable to explanation to a cretin in the space of a Slashdot post.
Just for clarity: There is no central database. The information is in fact encoded in the "certificate". This is done using cryptographic mechanisms that allow the "certificate" to be used to prove various things, without disclosing other things. These proofs can in fact be conducted without communicating with the issuer at all.
Brands is a crappy businessman, but he's a very competent cryptographer, and has made significant original contributions to this field. You, on the other hand, well...
Thanks, and have a nice day.
Is PKI that broken that we already need a replacement? Seems to do the job for me...
Well even without benchmarks, and I guess now with credlib you could go compare idemix source code perf to credlib, its patently obvious that Brands creds are at least an order of magnitude faster.
Brands issuing protocol requires the user to perform the equivalent of one at most RSA full exponentiation and 5 small exponentiations, and all of the small exponentiations can be precomputed.
CL requires several full RSA exponentiations, and also they cant be precomputed.
Showing is similarly an order of magnitude slower with CL.
Also Brands protocols work over EC which give another factor of 10 speed up.
So overall estimate 10 - 100x faster. Doesnt sound a very "open" question, at a fundamental algorithmic level CL is clearly way slower, 10-100x is not a small factor open to going one way or the other in an implementation efficiency bake off.
They're exactly correct. But this post puts somebody's credentials behind their position. :-)
Private Credentials are a cool PKI replacement and anonymous e-cash tech that allows you to prove certified attributes like age, credit rating, group membership, etc. without revealing who you are; to allow you to have a digital life without the digital dossier effect inherent in a central databases.
Bingo, sir.
The whole point of these credentials is that you can obtain it and then show it, and the bits you reveal when showing it do not say anything about who you are and when you got the credential, not even to the entity that issued the credential in the first place. (Magic, huh?)
In Brands' system, each credential can only be used once: the second time I use it, I reveal the very same bits as the first time I used it, so if I keep using it, I become identifiable by these bits. So every time that I plan to show a Brands credential, I must go back to the issuer and get a fresh copy.
Whereas in the CL system, you get a multi-show credential that you can show as many times as you want and it will look different every time.
Of course we're comparing apples and oranges because when you don't need the multi-show feature why not use Brands.
That aside, Brands has a wicked mechanism for issuing multiple identical credentials in parallel, so it's not the case that you have to go back to the issuer to get a fresh copy after each use. Grab 10 or 100 at a go and use them willy-nilly.
The technology to do this one way or another has been around for years, at least since David Chaum's blinded signatures and e-cash. The problem is getting it to be marketable.
There are 2 hurdles to this product:
1. Digital certificates of any kind are hard to get Joe average user to understand and adopt. How many people use PGP style email encryption, let alone user SSL certificates?
2. More seriously, how many online business are willing, not only not to collect customer data, but to go to sigificant expense to avoid collecting customer data?
Since customer data is generally viewed as having value to businesses, you are in effect asking business to spend money to make less money. That just won't happen, unless customers demand it. And I don't see that happening anytime soon (see #1 above).
Fizz