Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, you may assume the user has a smart phone and you have access to all its sensors. Probabilistic guarantees are quite acceptable (e.g., 1-$\epsilon$ certainty of uniqueness for small $\epsilon$).

share|improve this question

1 Answer 1

The easiest way would be to make use of a trusted third party. In this way, users can authenticate to the trusted party (maybe with the cellphone/IMEI number) which then issues them with a "ticket" or "group/blind signature" along with a pseudo-identity, similar to those used in e-voting schemes. The pseudo-identities can then be checked for duplicates.

Without a third party, I think it will be hard for you to proof that each user is unique even if you have access to all his sensors. e.g. user can always change his current location to change the gps, temperature, illumination, and humidity sensor readings.

share|improve this answer
    
I was thinking of obtaining biometric not ambient signals from the phone; audio, video, and fingerprints. What trusted third parties can you recommend? –  Emre Feb 8 at 19:56
    
Usually schemes for anonymity (e.g. www0.cs.ucl.ac.uk/staff/l.capra/publications/querciaTATA06.pdf) will make use of PKI for signatures, so the trusted party would be a CA in this case. Other schemes (e.g. blackhat.com/presentations/bh-usa-07/Lindell/Presentation/…) do not require a third party but are more complex in implementation. –  jingyang Feb 9 at 5:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.