3 ms·

I have a serious question… in elections, we need to know a person has exactly one account etc. Entering a bar, they need to know you’re 21 or over etc. The PRO

by EGreg 4y ago

I have a serious question… in elections, we need to know a person has exactly one account etc. Entering a bar, they need to know you’re 21 or over etc. The PROPER mechanism for this would be a certificate issues by a trusted authority (or a few) that would somehow prove with a zero knowledge proof that you have one of the certificates, but every time it would be different and unlinkable to you. It wouldn’t leak an identifier that can be used to track you. Google GROUP SIGNATURES, that is what we want to achieve. How? Is there a well-known software library in crypto, besides a mixer like Tornado.Cash or rings like in Monero? Something like openssl so we don’t have to “roll our own”? The technical name for what I want is Group Signatures, starting with this seminal paper by Chaum in 1991: https://chaum.com/wp-content/uploads/2021/12/Group_Signatures.pdf https://chaum.com/wp-content/uploads/2021/12/Group_Signature... But what is the latest State of the Art in Group Signatures? What is used today, that can work at scale for groups of MILLIONS of people, and still be anonymous? Chaum’s conception is linear in the number of group members and the group has to be fixed in the beginning, and can’t be dynamically changed. That means issuing new certs once a year year to people who have come of age at 18, or registered to vote etc. That proves your age so they’d have to actually create larger groups by aggregating these together with previous groups (they could also remove people from the rolls if they haven’t retegistered for a while, eg for a driver’s license again). This is the latest work I could find and it’s from 2003… why is no one making progress in this field, or implementations? https://cseweb.ucsd.edu//~daniele/papers/BMW.pdf https://cseweb.ucsd.edu//~daniele/papers/BMW.pdf

dsr_ 4y ago
The problem is that "exactly one account for election voting" and "untraceably anonymous" don't go together. What we've got now is a physical mixing where you "prove" your identity to a clerk at the assigned polling location, you are issued a physical token which you fill out in privacy, and then the token with the voting information on it is mixed with all the others from that polling location. By having opposed auditors watching vigilantly, we get some confidence that ballots are not altered or replaced. Let's say that you have a system which has a single account for every citizen (fine in theory), which can issue an anonymous bearer token that can be used for voting later. That bearer token is now vulnerable to being sold, confiscated, copied (but only usable once, so there's a race), forgotten, and can go unused.
- EGreg 4y ago
  Yes they do. This is basically Group Signatures. I am just asking whether BBS04 is the state of the art still. In there, the group manager is the only one who can deanonymize people. Is there any way to provably opt out of this latter feature, so we can be sure NO ONE can link signatures to users? That’s Chaum’s original 1991 conception. The alternative is to use ZK mixers on distributed ledgers that have solved the double spend problem, but the jury is out on just how anonymous and unlinkable they really are in practice: https://arxiv.org/pdf/2201.09035.pdf https://arxiv.org/pdf/2201.09035.pdf
jeroenhd 4y ago
There are mechanisms out there that try to minimise data exfiltration to validate certain facts about a person. IRMA [1] has a system that's developed quite well though development and expansion has slowed down over the years. It's a lot more chatty than using offline certificates, but the privacy challenges are very similar. The basic premise is that your ID holds your date of birth and that date of birth can be used to generate a signed token that says "over x years old". For Europe this can be 18, for America this can be 16 or 21, depending on what you're trying to gatekeep. Having users manage cryptographic secrets seems like an absolutely terrible idea. Developers and system administrators are incapable of renewing certificates in time, it'll only slow everything down. None of these technical measures solve the core issue, though, which is that kids will lie about their age online. They'll find a friend/family member/random guy over the required age and copy the super privacy friendly secret token to their devices and boom, everyone is 18. Cryptographic age requirements raise the bar but ultimately they'll never be enough. [1] https://irma.app/?lang=en https://irma.app/?lang=en
- EGreg 4y ago
  What I am talking about is essential for voting or UBI. One person one account. It isn’t just for kids. The hardest part is to make sure that the certificate issuing authorities aren’t corrupted (eg by having a self regulating organization like FINRA) when they give out certificates — since those represent free cashflows or outsize voting shares.

by EGreg 4y ago

dsr_ 4y ago

The problem is that "exactly one account for election voting" and "untraceably anonymous" don't go together. What we've got now is a physical mixing where you "prove" your identity to a clerk at the assigned polling location, you are issued a physical token which you fill out in privacy, and then the token with the voting information on it is mixed with all the others from that polling location. By having opposed auditors watching vigilantly, we get some confidence that ballots are not altered or replaced. Let's say that you have a system which has a single account for every citizen (fine in theory), which can issue an anonymous bearer token that can be used for voting later. That bearer token is now vulnerable to being sold, confiscated, copied (but only usable once, so there's a race), forgotten, and can go unused.

EGreg 4y ago
Yes they do. This is basically Group Signatures. I am just asking whether BBS04 is the state of the art still. In there, the group manager is the only one who can deanonymize people. Is there any way to provably opt out of this latter feature, so we can be sure NO ONE can link signatures to users? That’s Chaum’s original 1991 conception. The alternative is to use ZK mixers on distributed ledgers that have solved the double spend problem, but the jury is out on just how anonymous and unlinkable they really are in practice: https://arxiv.org/pdf/2201.09035.pdf https://arxiv.org/pdf/2201.09035.pdf

jeroenhd 4y ago

There are mechanisms out there that try to minimise data exfiltration to validate certain facts about a person. IRMA [1] has a system that's developed quite well though development and expansion has slowed down over the years. It's a lot more chatty than using offline certificates, but the privacy challenges are very similar. The basic premise is that your ID holds your date of birth and that date of birth can be used to generate a signed token that says "over x years old". For Europe this can be 18, for America this can be 16 or 21, depending on what you're trying to gatekeep. Having users manage cryptographic secrets seems like an absolutely terrible idea. Developers and system administrators are incapable of renewing certificates in time, it'll only slow everything down. None of these technical measures solve the core issue, though, which is that kids will lie about their age online. They'll find a friend/family member/random guy over the required age and copy the super privacy friendly secret token to their devices and boom, everyone is 18. Cryptographic age requirements raise the bar but ultimately they'll never be enough. [1] https://irma.app/?lang=en https://irma.app/?lang=en

EGreg 4y ago
What I am talking about is essential for voting or UBI. One person one account. It isn’t just for kids. The hardest part is to make sure that the certificate issuing authorities aren’t corrupted (eg by having a self regulating organization like FINRA) when they give out certificates — since those represent free cashflows or outsize voting shares.