Authorized But Anonymous: Taking Charge of Your Personal Data Anna Lysyanskaya Brown University

Your Identity Online When you are online, what makes you you? René Descartes I think, therefore I am

Your Identity Online When you are online, what makes you you? Anna Lysyanskaya I log in, therefore I am Disclaimer: provided no one else can log in as me

How do I log in? Let me count the ways. With a username and password. –Pros: intuitive, human-memorizable (up to a point) –Cons: not privacy-preserving, insecure in so many ways…

How do I log in? Let me count the ways. With public-key certificates. –Cons: not as intuitive, not human-memorizable (need a hardware device to remember the credentials), not privacy-preserving –Pros: secure – your device would need to be hacked or stolen before your identity can be stolen

How do I log in? Let me count the ways. Crash course in cryptography: What are public keys?

How do I log in? Let me count the ways. Crash course in cryptography: What are public keys? What are certificates?

How do I log in? Let me count the ways. Crash course in cryptography: What are public keys? What are certificates? How do you use them for authentication and authorization?

How do I log in? Let me count the ways. Crash course in cryptography: What are public keys? What are certificates? How do you use them for authentication and authorization? –Underlying building block: digital signature schemes

Digital Signature Schemes

This is what a signed message looks like, with PGP

How do you verify my signature if you don’t know my public key? Anna Lysyanskaya Anna Lysyanskaya’s public key is LKYFHDJY96GA4JHGJHG JHASGKFG53NPOIOISUD FOAISU Anna Lysyanskaya’s public key is 73qsgsdfiusagf87twrjhsi fu98wqurhlasjhfoaistr

How do you verify my signature if you don’t know my public key? Anna Lysyanskaya’s public key is LKYFHDJY96GA4JHGJHG JHASGKFG53NPOIOISUD FOAISU Anna Lysyanskaya’s public key is 73qsgsdfiusagf87twrjhsi fu98wqurhlasjhfoaistr

How do you verify my signature if you don’t know my public key? Anna Lysyanskaya Anna Lysyanskaya’s public key is LKYFHDJY96GA4JHGJHG JHASGKFG53NPOIOISUD FOAISU Anna Lysyanskaya’s public key is 73qsgsdfiusagf87twrjhsi fu98wqurhlasjhfoaistr Signed by BROWN UNIVERSITY Signed by BOWRN UNIVRSITY

A certificate is when someone whose public key is well-known (e.g. Brown University) certifies that a public key belongs to a particular site/web server/person.

How do I log in? Let me count the ways. Crash course in cryptography: What are public keys? What are certificates? How do you use them for authentication and authorization? My certificate (e.g. from Brown University) tells you my credentials (e.g. that I am a faculty member, a gym member, authorized to enter the CIT building, to access the digital library, etc.) I convince you that I have in my possession a SK corresponding to my PK. For example, because I am able to sign messages. This is not just cool theory – this is what you’re using right now! SSL, HTTPS, …

How do I log in? Let me count the ways. With public-key certificates. –Cons: not as intuitive, not human-memorizable (need a device to remember the credentials) –Pros: secure – your device would need to be hacked before your identity can be stolen

How do I log in? Let me count the ways. With public-key certificates. –Cons: not as intuitive, not human-memorizable (need a device to remember the credentials), not privacy-preserving –Pros: secure – your device would need to be hacked before your identity can be stolen

Newspaper Subscription projo.com Today ’ s news? Who are you? Do you have a subscription? It ’ s Bond. James Bond. I can tell you, but then I ’ ll have to kill you...

Newspaper Subscription projo.com Today ’ s news? Show me your subscription. Subscription #007 87% of US population is uniquely identifiable by zip code, DOB and gender [Sweeney]

Newspaper Subscription projo.com Today ’ s news? Prove that you are authorized. Here is a zero-knowledge proof

Newspaper Subscription projo.com Today ’ s news? Prove that you are authorized. Here is a zero-knowledge proof Anonymous credentials: a protocol where I can convince you that I am authorized without revealing any identifying information. [Chaum85]

How do I log in? Let me count the ways. With anonymous credentials. –Cons: not super intuitive, not human-doable (need a device to remember the credentials) –Pros: secure – your device would need to be hacked before your identity can be stolen, -- privacy-preserving

How do I log in? Let me count the ways. Crash course in cryptography, part 2: –How do anonymous credentials work?

How do I log in? Let me count the ways. Crash course in cryptography, part 2: –How do anonymous credentials work? –Underlying building block: zero-knowledge proofs

How do I log in? Let me count the ways. Crash course in cryptography, part 2: –How do anonymous credentials work? –Underlying building block: –Can anonymous credentials work in practice? zero-knowledge proofs

How do I log in? Let me count the ways. Crash course in cryptography, part 2: –How do anonymous credentials work? –Underlying building block: –Can anonymous credentials work in practice? –Can I use anonymous credentials? zero-knowledge proofs

Can you 3-color a graph? 1. Each vertex colored red, green or blue 2. No monochromatic edges

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

1. Each vertex colored red, green or blue 2. No monochromatic edges Can you 3-color a graph?

Is every graph 3-colorable?

No...

Zero-knowledge proof of 3-colorability

Let me convince you that it’s 3-colorable! Zero-knowledge proof of 3-colorability

Please step out.

Zero-knowledge proof of 3-colorability

Please come back in, and check one edge.

Zero-knowledge proof of 3-colorability

Do you want to check another edge? Zero-knowledge proof of 3-colorability

Please step out.

Zero-knowledge proof of 3-colorability

If we repeat 100 times and you never catch me lying, you’ll be convinced! [GMW86] Zero-knowledge proof of 3-colorability

Verifier “Encrypted” colors for each vertex I challenge edge (u,v) “Decryption” of the colors for u,v Prover Prover convinces Verifier that the graph is 3-colorable Verifier learned nothing about the solution

ZK Proofs for Other Things Verifier Prover Prover convinces Verifier that the statement is true Verifier learned nothing about the solution Theorem: Everything provable is provable in zero-knowledge. [GMR85,GMW86,BGGHKMR88]

How do I log in? Let me count the ways. Crash course in cryptography: –How do anonymous credentials work? –Underlying building block: –Can anonymous credentials work in practice? –Can I use anonymous credentials? zero-knowledge proofs ✔

How do anonymous credentials work? [L99,CL01,L02,CL02,CL04,BCKL08,…,CL50] Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user And there is more! You can also obtain credentials anonymously.

Can this work in practice? Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user Efficiency: comparable to certificate-based non-anonymous authentication.

Can this work in practice? Efficiency: comparable to certificate-based non-anonymous authentication. The #1 concern: but with anonymous credentials, how will we know if something goes wrong? Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can this work in practice? Efficiency: comparable to certificate-based non-anonymous authentication. The #1 concern: but with anonymous credentials, how will we know if something goes wrong? –What if users share their credentials in an unauthorized way? Can address this with more cool crypto! –What if we need to revoke anonymous credentials? More cool crypto! Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can this work in practice? Efficiency: comparable to certificate-based non-anonymous authentication. The #1 concern: but with anonymous credentials, how will we know if something goes wrong? –Main takeaway: everything you can do non- anonymously, you can do anonymously. Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can I use anonymous credentials? Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can I use anonymous credentials? –No… but maybe… Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can I use anonymous credentials? You can download and play with existing implementations. – – Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can I use anonymous credentials? You can download and play with existing implementations. – – You can tell everyone about it. –Why would they care? Last year’s European Court of Justice ruling may have something to do with it. Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

Can I use anonymous credentials? You can download and play with existing implementations. – – You can tell everyone about it. –Why would they care? Last year’s European Court of Justice ruling may have something to do with it. You can take CS 151 and do research in cryptography with me! Verifier Prove that you are an employee of Brown University. Here is a zero-knowledge proof that I know a SK, a PK, and a certificate such that (1) SK corresponds to PK (2) Certificate is from Brown University, certifying that the PK corresponds to an employee. Anonymous user

But I have a device in my pocket right now! How do I log in? Let me count the ways. With anonymous credentials. –Cons: not super intuitive, not human-doable (need a device to remember the credentials) –Pros: secure – your device would need to be hacked before your identity can be stolen, -- privacy-preserving But it makes perfect sense to me now!

Taking charge of your personal data Anonymous authorization is just a small piece of the puzzle. Other pieces: –Protecting databases containing sensitive information –Private web browsing –Secure communication –… A lot of work to do!