pki versus private credentials1 stefan brands zero-knowledge systems inc. montreal

PKI versus Private Credentials 1

PKI versus Private Credentials

Stefan Brands

Zero-Knowledge Systems Inc.

Montreal

PKI versus Private Credentials2

Digital Certificates:

sequences of zeros and ones (of a mathematical structure)

verifiable with 100 % accuracy by computers

transferable electronically (no human intervention, fast)

unforgeable (crypto protection) can specify any kind of data


Identity Certificates:

CA digital signature binds public key to real name

secret key signs message (prevents replay, non-repudiation)

verify by applying CA's public key use as authenticated pointer into

databases (like SSNs)


Federal PKIs:

USA (Access Certificates for Electronic Services, FPKI)

United Kingdom (CLOUD COVER) Australia (Public Key Auth.

Framework, Gatekeeper) Canada (Canada Public Key

Infrastructure) Hong Kong (identity certificates to

most residents)


In the future:

mobile phones watches televisions cars computerized household

appliances …


Drawbacks to organizations: transaction delays loose business (faulty/ irrelevant

data, online connection fails) central database verification hard to protect databases against

hackers and insiders privacy standards bring

compliance costs Manage CRLs / online validation


Privacy concerns:

traceability (CA, verifiers, wiretappers, intel. agencies)

linkability (in and across PKIs) non-repudiable evidence discrimination (consults any

database) errors (database, identities) no control over secondary use revocation (CRL, online whitelists)


Legislation ineffective:

does not deter criminals stopping violations takes long legislation implemented ? technologies faster than law theft / modification by hackers ? misuse by employees ? laws may be amended, changed,

exempted, overturned, or ignored database audits -> accessibility


Privacy design goals:

control (selective disclosure) anonymity unlinkability no self-authenticating records smartcard implementations


Private Credentials:

similar to coins and public transport tickets (not identifiable)

meet all privacy design goals practical security benefits


Issuing a Private Credential: Certificate binds public key to

attributes CA cannot learn user's public key

and CA's signature (blinding) CA encodes attributes into user's

secret key


Showing a Private Credential: Send public key and CA signature selectively disclose property of

attributes sign message (= authenticate

property) replay prevention


Note:

different attributes in different or same Private Credentials

anyone can be CA one attribute may be identity selective disclosure unlinkability


Selective disclosure:

show part of attribute data without revealing more (think: marker)

more powerful than paper-based certificates (Boolean properties, n out of m, intervals)

works across different Private Credentials

PKI versus Private Credentials 16


Reissuance:

refresh previously issued Credential without knowing attributes

update Credential's attributes before refreshing


Dossier-Resistance:

verifier gets zero evidence of transaction; or

verifier gets self-authenticating evidence of a message or a part of the disclosed property

self-authenticating evidence can be limited to designated parties


Fraud protections:

reduce identity fraud eliminate central database risks limited-show property (identity

computable if shown too often) discourage lending (encode secret

of user) discourage discarding (tie

unfavorable attributes in)


Smartcard implementation: strong protection against loss,

theft, extortion, lending,copying, discarding, etc

can use standard 8-bit chips use desktop computer, notebook,

handheld, mobile phone, … user's computer protects privacy,

smartcard cannot leak data


Benefits to organizations: prevent unfair competition no law enforcement intrusions reduce identity fraud foster fair competition cheapest way to comply with

privacy principles improve transaction finality cultivate goodwill


Private Credentials can subsume X.509:

two attributes: certificate holder's X.500 name, all other fields

restrict entropy of X.509 validity period

restrict entropy of extension fields set serial number to hash of the

public key or to zero


Sample applications:

electronic cash digital pseudonyms for public

forums and virtual communities access control (VPNs, subscription

services, Web sites, databases) digital copyright protection

(certificates permit use of works) electronic voting


(continued)

electronic patient files electronic postage automated data bartering online auctions financial securities trading pay-per-view tickets public transport ticketing electronic food stamps road-toll pricing


(continued)

national ID cards (with privacy) permission-based marketing Web site personalization multi-agent systems collaborative filtering loyalty schemes electronic gambling medical prescriptions


For more information:

“Rethinking Public Key Infrastructures and Digital Certificates; Building in Privacy,” ISBN 0-262-02491-8, MIT Press August 2000, 356 pp.

“Private Cedentials,” whitepaper, Zero-Knowledge Systems, September 2000

[email protected] www.xs4all.nl/~brands

pki versus private credentials1 stefan brands zero-knowledge systems inc. montreal

Documents

key slide

montreal slide

prevention slide

users public key

kind of data slide

cas public key use

attributes ca

crls online validation