Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, you may assume the user has a smart phone and you have access to all its sensors. Probabilistic guarantees are quite acceptable (e.g., 1-$\epsilon$ certainty of uniqueness for small $\epsilon$).

share|improve this question

The easiest way would be to make use of a trusted third party. In this way, users can authenticate to the trusted party (maybe with the cellphone/IMEI number) which then issues them with a "ticket" or "group/blind signature" along with a pseudo-identity, similar to those used in e-voting schemes. The pseudo-identities can then be checked for duplicates.

Without a third party, I think it will be hard for you to proof that each user is unique even if you have access to all his sensors. e.g. user can always change his current location to change the gps, temperature, illumination, and humidity sensor readings.

share|improve this answer
I was thinking of obtaining biometric not ambient signals from the phone; audio, video, and fingerprints. What trusted third parties can you recommend? – Emre Feb 8 '14 at 19:56
Usually schemes for anonymity (e.g. will make use of PKI for signatures, so the trusted party would be a CA in this case. Other schemes (e.g.…) do not require a third party but are more complex in implementation. – jingyang Feb 9 '14 at 5:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.