1. Brian A. LaMacchia Director, XCG Security & Cryptography, Microsoft Research

2. Agenda Basics of anonymous credentials Using anonymous credentials in security policy languages Anonymous credential delegation Anonymous principals for the SecPAL language Making anonymous credentials revocable Problem definition Accumulators Using accumulators as privacy-preserving CRLs Revocable delegable anonymous credentials April 6, 2011IDTrust 20112

3. Anonymous Credentials An anonymous credential allows a principal to prove possession of one or more attributes without revealing the principal’s identity or other additional information. Examples of attributes: “is a US citizen”, “age > 18“, “is an employee of Fabrikam” Unlinkability is a key requirement Should not be able to link multiple uses of a credential One technique: Non-Interactive Zero-Knowledge (NIZK) proofs Prove you have a dig sig from an issuer of the desired attribute Re-randomize the proof to hide identity & provide unlinkability Uses Groth-Sahai proofs (Belenkiy et al., Crypto ‘09) April 6, 2011IDTrust 20113

4. Anonymous Credential Delegation Keys for anonymous credentials have two forms Private: held by bearer Public: a commitment to the key (can re-randomize) Credential chains: NIZK proof of signature April 6, 2011IDTrust 20114

5. SecPAL: Security Policy Assertion Language A security policy language for decentralized authorization Supports constrained delegation Logical framework for reasoning about authorization Principals are defined by keys E.g., public key of RSA key pair Principals sign statements (signed credentials) Issuer says Subject can Verb Object Some simple examples: Azure STS says Hospital possess accountName: “hospital” Hospital says Pharmaco can read, write file://localhost/hospital/drugtrialdocuments/ Storage Tenant says Hospital can read, write file://localhost/hospital/ if Hospital possess accountName: “hospital” April 6, 2011IDTrust 20115

6. Anonymous Principals for SecPAL A principal that proves its ID with an anonymous credential Simple version like a group of principals E.g., Any US citizen can enter the country But can also merge with delegation E.g., OS says can say %x can write to /var says can write to /var Notation “ ”: principal of credential at delegation level i Delegation levels of credentials map to policy Public attributes in credentials are SecPAL statements April 6, 2011IDTrust 20116

7. Efficiency and Ephemeral Keys Anonymous signatures slower than public key Solution: bootstrap into public key using ephemeral keys E.g., OS says can write /var says RSAKey can act as Now RSAKey can write to /var STS converts to limited, normal token for RSAKey Principal can create new RSA key Individual keys are unlinkable April 6, 2011IDTrust 20117

8. Revocation for Anonymous Credentials The ability to revoke is an integral part of all systems built on digital signatures (e.g. PKI certificates) We want this capability for anonymous credentials also But how do we revoke an anonymous credential without identifying it explicitly? If we identify it (e.g. list an ID number) then users would also have to reveal that same information to allow relying parties to perform revocation checks  linkability We need a mechanism that allows an RP to see if a credential is revoked without requiring the reveal of a unique ID Answer: Use an accumulator April 6, 2011IDTrust 20118

9. Accumulators April 6, 2011IDTrust 20119

10. Accumulators for Blacklisting with Privacy April 6, 2011IDTrust 201110

11. Accumulators with Delegable Non-Membership Proofs (ADNMP) April 6, 2011IDTrust 201111

12. Delegatable Anonymous Credentials Nym O Nym1 Nym1. 1 Nym1. 2 Nym2 Nym2. 1 In a DAC system, pseudonyms form a tree – each link between nodes is a delegation. Nym 1.1, Nym 1.2 and Nym 2.1 can each anonymously prove that she has a credential, which is delegated 2 levels away from Nym O. April 6, 2011IDTrust 201112

13. Revocable Delegatable Anonymous Credentials (RDAC) April 6, 2011IDTrust 201113 Nym O Nym1 Nym1. 1 Nym1. 2 Nym2 Nym2. 1 Nym 1 is revoked. Nym 1.2 can no longer prove that she has the credential Her only path to the root is gone. Nym 2.1 can still prove anonymously that She has a credential, which is delegated 2 levels away from Nym O. All of her ancestors (Nym O, Nym 2 ) are not blacklisted. Nym 1 Blacklist Authority

14. Summary Anonymous credential delegation can be used to enable anonymous principals in an authorization language We can still have constrained delegation even when anonymous Accumulators can be used to build a privacy-preserving revocation mechanism for anonymous credentials For more information: Tolga Acar and Lan Nguyen, “Revocation for Delegatable Anonymous Credentials,” no. MSR-TR-2010-170, 22 December 2010 SecPAL: http://research.microsoft.com/projects/SecPAL/ April 6, 2011IDTrust 201114

15. Questions? April 6, 2011IDTrust 201115