I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows per-transaction privacy.
I would use the standard PKI system, but there is a hard coded certificate serial number in each cert, removing privacy. Issuing multiple certs per user adds management complexity I'm trying to avoid. I'd like to leverage mathematical properties of ECC (and related) to solve this problem. This question is inspired by the ability to add/multiply keys and makes me wonder what can be done if each key is used to independently sign a value.
Mentally assume that the private keys for this trust are securely stored on hardware (SIM, SmartCard etc) and the possession of the private key is sufficient validation.
For example, suppose Alice has a store that sells unicorn sweaters. Bob wants to purchase this sweater, but wants to do so anonymously. Alice demands that Bob be 18 years or older and have a verified address.
Bob doesn't want anyone to know he likes unicorn sweaters unless under the most dire situations (or where Charlie demands information from Alice that the transaction occurred)
Bob has a pre-existing identity verification setup established with Charlie. Alice trusts Charlie and will accept Charlie's voucher of Bobs age and residence.
Bob has the following goals:
- He doesn't want Charlie to know he is shopping at Alice's shop
- He doesn't want Alice to know more than she needs to, or be able to derive his shopping habits through a common identifier
If Bob were to give Alice his digital driver's license equivalent, she would have more information than she needs (Driver ID, full birthday, address, etc). All Alice needs is the boolean isOlder than 18, his address and have that assertion verified by Charlie.
Layman implementation approaches
One idea I thought of is for Charlie to issue many signed tokens, each certifying a different set of information about Bob, and place them on a smart card. Each token has an ID that means something to Charlie but is random to Alice. Assuming that the pieces could be recomposed and validated, Bob could cherry-pick what he wants to tell Alice, recombine it and send it to her.
This approach seems cumbersome and may grow exponentially large based on the number of permutations based on how it's implemented. There are also privacy issues since if the token (with a tokenID) is reused with another vendor, Bob's shopping habits could be derived. Finally it may allow for MITM attacks for anyone who wishes to re-use or forward Charlie's signed assertions to bad actors.
The next approach would be to have Charlie issue N copies of the previous set of tokens. Each copy would contain an anonymous identifier per N copy. If Bob wishes to do N+1 transactions, one of the tokens would have to be reused, lowering his anonymity. The complexity and size requirements also increase exponentially.
I started exploring possibilities using derive from adding or multiplying ECC keys together, and if those set of private keys used independently or in combination could be used to sign a claim, verify a claim, or to verify a different keypair signed the claim.
I then started thinking about homomorphic encryption and my head exploded.
Once Bob & Charlie have an established trust, is there any way Bob can safely perform the ALL of the following actions offline, (in combination with SmartCard hardware)
Charlie makes an assertion (or claim) about Bob, and Charlie's claim can be verified that it was indeed signed by Charlie
Bob to conditionally forward an assertion Charlie made about Bob (Age > 21 | Address | Name | etc.) to Alice
Bob to alter the assertion so that the contents of the assertion is still readable by Alice
Alice can read the altered assertion, verify that it was certified by Charlie, but can't deduce any information about Bob, even with the cooperation of Eve (a random 3rd party)
If Charlie needs to, Charlie can extrapolate the identity of Bob, by simply viewing the assertion made to Alice, and the knowledge Charlie has about Bob
So in a sense I'm looking for an offline SAML/Claims based transaction, where Authentication of Bob's identity occurs with the cryptographic material in the Smartcard. (It's a bearer object, that isn't easily copied)
Are there any cryptographic solutions that would help solve this problem?