Anonymity and authentication look to be seemingly contradictory but are both possible together ? I tried reading couple of papers but could not get the big picture. So what are the major approaches tried in solving anonymity preserving authentication ? (Am not really looking for references or recommendations but the solution approaches tried so far, there is not any wikipedia page too to get a summary)

  • $\begingroup$ There is a huge amount of literature on "anonymous credentials". These are exactly aimed at what you are looking for. $\endgroup$ Sep 26, 2015 at 19:33
  • $\begingroup$ The term "digital pseudonym" was introduced by David Chaum, and it refers to a public key where the owner of the secret key is not known (i.e., there is a larger set of possible owners). Probably you will need something like that if you want authentication and anonymity. In fact, you will have 'pseudonymity' and not 'anonymity'. $\endgroup$
    – Chris
    Sep 26, 2015 at 20:04

1 Answer 1


First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national.

A person may well have multiple identities. For example, people with dual citizenship have two passports and what they do with one is somewhat decoupled with what they do with the other.

Multiple identities are the basis of anonymity. Indeed, as soon as you interact with anyone else in any way, this creates an identity: you're the person who did this thing at that time. Anonymity is not a lack of identity, but a lack of a link between a certain identity and any other identity that you may have.

Coming back to authentication, it is a link between two identities: the person who did that thing at this time is the same person who owns these credentials. Phrased this way, authentication is exactly contradictory with anonymity. However, there are many situations where it is useful to have partial authentication or partial anonymity.

An obvious solution to partial anonymity is to have a trusted third party as an intermediary. I'm using one right now: you know me by my Stack Exchange account, and you can use this identity to authenticate my Stack Exchange activity. Stack Exchange knows me by an identity with an OpenID provider, but isn't telling you. My OpenID provider in turn knows some things about me, but they only know the name on my passport if I've been telling them. There is a chain of links between identities (which could be traced all the way to, say, my home address via ISP logs), but you need the collaboration of multiple parties to resolve the chain.

How satisfactory such situations are depends on how the identification linkage chain is set up and what parties you're prepared to trust. Having identification linkage chains that are practically impossible to trace is the basis of anonymity systems such as TOR.

Going in another direction, authentication is very often used for authorization. I may use this account because I am the account owner. I may enter this building because I am an employee. An authorization system can be set up to decouple the action that is being authorized from the identity that led to the authorization. A well-known example is voting systems: they have both strong authorization requirements (only registered voters may vote, and only once per election) and strong anonymity requirements (even I cannot prove who I voted for, at least not if I want my vote to be counted). In traditional voting systems, anonymity is ensured by stepping into a booth to put a standardized piece of paper in an opaque envelope. Anonymity is ensured by observers who control that everyone steps into the booth and by rules that make non-anonymous ballots void.

Reference: https://security.stackexchange.com/questions/47913/is-the-concept-of-authenticated-anonymity-possible


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.