A warning on how to implement anonymous credential protocols into the information card framework

Abstract

Unlinkability is a privacy feature supported by those multi-party security protocols allowing anonymous users' credential exchanges among different organizations. Proper signature schemes, based on discrete logarithms, must be used in order to guarantee the above requirements as well as selective disclosure of information. In this paper, we highlight that whenever a concrete architecture based on the above protocols is implemented, some aspects concerning how to manage the association between bases of discrete logarithms and attributes used in attribute certificates should be carefully considered, in order to guarantee that unlinkability really holds. We show that the problem is concrete by testing that the state-of-the-art implementation suffers from the above problem. A general solution is also proposed.

Privacy-preserving resource evaluation in social networks

“…It is a matter of fact that covert channel can be used to break unlinkability of protocols guaranteeing anonymity (see for example [4]). In the cover channel we can figure out in this case, TTP acts as attacker by using a different pair of asymmetric keys for every voter it wants to trace.…”

A new information security risk analysis method based on membership degree

“…Information security risk assessment (Bai et al, 2012;Feng and Li, 2011;Ren et al, 2006;Shamala et al, 2013;Zhao et al, 2009), quantifying the view of risk management, analysis the threats various networks and the risk information systems are realized with the use of a suite of various approaches and tools (Armando and Compagna, 2008;Ates et al, 2012;Bolle et al, 2011;Dent, 2008). With the development of computer technology and the internet, new attacks exploiting existing security vulnerabilities are realized.…”