search

dbosk / crocus

Securely and privately verifiable protests
Other
0 stars 0 forks source link

What authority should issue credentials? #24

Closed dbosk closed 6 years ago

dbosk commented 6 years ago

A fair assumption is to use the government-issued credentials available in national identity-cards. Or identities issued by some cothority of governments, e.g. EU or UN.

There seem to be some alternative approaches to this. Proof-of-personhood relies on "pseudonym parties" (Bryan Ford, SocialNets'08, "An offline foundation for online accountable pseudonyms"). A few organizers form a cothority with an anytrust assumption (one of the organizers must be honest). Then people meet in a physical location to get a token. The guarantee is one token per person if you trust one of the organizers.

It seems more like it that our solution can improve the proof-of-personhood than the other way around.

dbosk commented 6 years ago

Also, #17 would imply that any government that signs up to the human rights must include they keys we need in their national ID-cards. However, repressive regimes, where this is really needed, usually don't subscribe to human rights.

Either we can use Cinderella (Cinderella: Turning Shabby X.509 Certificates into Elegant Anonymous Credentials with the Magic of Verifiable Computation) to turn normal ID-cards into anonymous credentials or we find another authority, e.g. the UN or a cothority of various governments.

dbosk commented 6 years ago

The assumption on the keys available in the national identity card is a very big one. Can we weaken that?

Well, we need a logically centralized authority to issue the credentials, i.e. the keys, otherwise we get Sybil attacks.

I have some discussion in #24 about alternatives, e.g. if we can use something like Cinderella (see ref in issue) to turn existing X.509 certificates (in the national ID cards?) into anonymous credentials.

Or that we can use any existing electronic IDs (BankID in Sweden) available on the smartphone. However, that opens up for the Sybil problem again, since one can just get a new key.

Sure there might be some rate limit, but still.

dbosk commented 6 years ago

Currently we suggest the national government. Any logically centralized authority will work.