{"id":796,"date":"2007-06-04T19:04:32","date_gmt":"2007-06-05T03:04:32","guid":{"rendered":"\/?p=796"},"modified":"2007-07-17T22:07:14","modified_gmt":"2007-07-18T06:07:14","slug":"keys-signatures-and-linkability","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=796","title":{"rendered":"Keys, signatures and linkability"},"content":{"rendered":"

Stefan Brands is contributing <\/a>to the discussion of traceability, inkability and selective disclosure with a series of posts over at identity corner<\/a>.  He is one of the world's key innovators in the cryptography of unlinkability, so his participation is especially interesting.   <\/p>\n

Consider a user who self-generates<\/em> several identity claims at different occassions, say \u00e2\u20ac\u0153I am 25 years of age<\/em>\u00e2\u20ac\u009d, \u00e2\u20ac\u0153I am male<\/em>\u00e2\u20ac\u009d, and \u00e2\u20ac\u0153I am a citizen of Canada<\/em>\u00e2\u20ac\u009d. The user\u00e2\u20ac\u2122s software packages these assertions into identity claims by means of attribute type\/value pairs; for instance, claim 1 is encoded as \u00e2\u20ac\u0153age = 25<\/em>\u00e2\u20ac\u009d, claim 2 is \u00e2\u20ac\u0153gender = 0<\/em>\u00e2\u20ac\u009d, and claim 3 is \u00e2\u20ac\u0153citizenship = 1<\/em>\u00e2\u20ac\u009d. Clearly, relying parties that receive these identity claims cannot trace<\/em> them to their user\u00e2\u20ac\u2122s identity (whether that be represented in the form of a birth name, an SSN, or another identifier<\/em>) by analyzing the presented claims; self-generated claims are untraceable<\/em>. Similarly, they cannot decide whether or not different claims are presented by the same<\/em> or by different<\/em> users; self-generated claims are unlinkable<\/em>.<\/p>\n

Note that these two privacy properties (which are different but, as we will see in the next paragraph, complementary) hold \u00e2\u20ac\u0153unconditionally;\u00e2\u20ac\u009d no amount of computing power will enable relying parties to trace or link by analyzing incoming identity-data flows, not even if relying parties collude (indeed, they may be the same entity).<\/p>\n

Now, consider the same self-generated identity claims, but this time their user \u00e2\u20ac\u0153self-protects\u00e2\u20ac\u009d them by means of a self-generated cryptographic key pair (e.g., a random RSA private key and its corresponding public key). The user digitally signs the identity claims with his private key; for example, claim 1 as presented to a relying party looks like \u00e2\u20ac\u0153age = 25; PublicKey = 37AC986B\u00e2\u20ac\u00a6; Signature = 21A4A5B6\u00e2\u20ac\u00a6<\/em>\u00e2\u20ac\u009d. Clearly, these self-protected claims are as untraceable<\/em> as their unprotected cousins in the previous paragraph. Are they unlinkable<\/em>? Well, that depends:<\/p>\n