Pseudonymous Signature on eIDAS Token – Implementation Based Privacy Threats

Enhancing University Services by Extending the eIDAS European Specification with Academic Attributes

“…Finally, regarding security, our proposal permits the privacy preservation of the citizens' academic attributes thanks to the encrypted connections and the control they could exercise over them. However, other generic security aspects about the integration of the attribute providers into the eIDAS infrastructure should be analyzed in the future [49,50].…”

Zero-Knowledge Proof-of-Identity: Sybil-Resistant, Anonymous Authentication on Permissionless Blockchains and Incentive Compatible, Strictly Dominant Cryptocurrencies

“…Pseudo-anonymous signatures[BHK + 18] for identity documents provide an interesting technical solution to the problem of anonymous authentication using identity documents. However, the proposed schemes present a number of shortcomings that discourage their use in the present setting: some schemes are closely tied to particular countries (i.e., the German Identity Card [BDFK12,fIS16,KHK18]), thus non-general purpose enough to include any country in the world, or flexible to adapt to future changes; they require interaction with an issuer during card initialization; they feature protocols for deanonymisation and revocation, not desired in the setting considered in this paper; the initial German scheme [fIS16] could easily be subverted [KHK16] because the formalization of pseudo-anonymous signatures is still incipient [KHK], and improvements are being worked out [BCLP14,Klu16,KHK18].…”

Pseudonymous Signature Schemes

“…where one of the keys is chosen at random and x is fixed for a group of users. The trick is to introduce another linear equality based on a pseudorandom coefficient personalized for each user [20] as given below:…”

“…Indeed, while s i can be used in any domain, the second parameter U dom,i is domain specific. While the Domain Authority can derive a candidate for U dom,i based on equality (2), it is infeasible to check that it has the form dPK u i even if these values are available for i in different domains, say dPK u i 1 , dPK u i 2 , … Another attack presented in [20] entails creation of a shadow eID-an extra eID document that can be used to recover pseudonym of a given user i in any domain without the user's private key and without the possibility to prove that such an attack is taking place. For this purpose, an eID with shadow keys x i,1 , x i,2 is prepared.…”

“…One can defend against the above attacks (and possibly against other attacks of this kind) by letting users randomize their secret keys [20]. The way to achieve this is to provide two pairs of keys on the eID.…”