4 ms·

Im interested to know why opt for basic asymmetric cryptography (is this like a ECDSA scheme?) when there are so many advances in zero knowledge proofs to allow

Im interested to know why opt for basic asymmetric cryptography (is this like a ECDSA scheme?) when there are so many advances in zero knowledge proofs to allow for queryable data?

hirsin 4y ago
It's tricky when the whole chunk of data is only signed over once by your issuer - you can't go back to the government for a new token every time you want to give out your first name instead of first and last name. This is where SD-jwt comes in - https://datatracker.ietf.org/doc/draft-fett-oauth-selective-disclosure-jwt/ https://datatracker.ietf.org/doc/draft-fett-oauth-selective-..., which selectively offers pieces from that once-signed chunk of data.
dwaite 4y ago
There are experiments using ZKPs and pairing based schemes, going all the way back to Anonymous Credentials work. However, the availability and acceptability of even more widely acknowledged curves like Ed25519 and secp256k isn't there - neither is yet NIST certified for government usage, most HSMs (including phone secure enclaves) don't understand and thus can't protect or accelerate private key usage. There are performance, complexity, security and general distrust issues with newer techniques, so you have to be a bit more selective on when you rely on them. My expectation is that it will depend on use cases - credentials backed by an active relationship between the subject of the credential and the issuer can use a protocol to get batches of credentials, and salted hash trees can be used to allow for selective disclosure where needed, including providing precomputed predicate values. With simpler crypto, you could generate batches of short-lived credentials so that use is not linkable by the signature randomness. For credentials which are meant to be long lived or which need to be maintained without backing hosted infrastructure, you'll see need for more advanced cryptographic techniques to prevent multiple disclosure of the same information to be correlated by the signature, or to allow predicates to be recomputed at presentation time.

Im interested to know why opt for basic asymmetric cryptography (is this like a ECDSA scheme?) when there are so many advances in zero knowledge proofs to allow for queryable data?

hirsin 4y ago

It's tricky when the whole chunk of data is only signed over once by your issuer - you can't go back to the government for a new token every time you want to give out your first name instead of first and last name. This is where SD-jwt comes in - https://datatracker.ietf.org/doc/draft-fett-oauth-selective-disclosure-jwt/ https://datatracker.ietf.org/doc/draft-fett-oauth-selective-..., which selectively offers pieces from that once-signed chunk of data.

dwaite 4y ago

There are experiments using ZKPs and pairing based schemes, going all the way back to Anonymous Credentials work. However, the availability and acceptability of even more widely acknowledged curves like Ed25519 and secp256k isn't there - neither is yet NIST certified for government usage, most HSMs (including phone secure enclaves) don't understand and thus can't protect or accelerate private key usage. There are performance, complexity, security and general distrust issues with newer techniques, so you have to be a bit more selective on when you rely on them. My expectation is that it will depend on use cases - credentials backed by an active relationship between the subject of the credential and the issuer can use a protocol to get batches of credentials, and salted hash trees can be used to allow for selective disclosure where needed, including providing precomputed predicate values. With simpler crypto, you could generate batches of short-lived credentials so that use is not linkable by the signature randomness. For credentials which are meant to be long lived or which need to be maintained without backing hosted infrastructure, you'll see need for more advanced cryptographic techniques to prevent multiple disclosure of the same information to be correlated by the signature, or to allow predicates to be recomputed at presentation time.