[Music]
hello everyone good to see you you're
all here
so today we'll talk about airmass edimix
core
so edemix is a set of cryptographic
protocols and the irma is an
implementation of edemix
of our itemix i should say
and today we'll explain to you how item
x works what what its goals are and so
and how it achieves those goals in
particular we'll focus on the selective
and unlinkable attribute disclosure
so who are we to talk about that
well this is maya reisner she's a
software developer at sidn
and i'm sids ringers
am the architect of irma also at sidn
and together we work on
on irma
yeah so the airma is now developed at
sidn previously it was developed at the
privacy by design foundation
uh but since
the beginning of the previous year the
development moved over to sidn
so we do hope you have some familiarity
with
with irma itself
perhaps you've already seen it and some
familiarity with basic cryptography may
would also help
but but we'll see how you know we'll
will guide you through everything
all right
so irma is an implementation of a
self-suffering identity system right
so in in
in a self-sovereign identity system such
as irma in the center there is the user
you know this is not visible right the
pointer
sort of
okay right so in the center of things
there is the user right and the user
wants to authenticate herself as some
verifier perhaps it's a web shop it but
it could be a
physical as well like here it could be
basically anything
um so the the user wants to authenticate
herself at uh at the verifier perhaps to
to convince the verifier that uh that
she has a diploma of sorts it could be
anything
so there's the user there's the verifier
and then on the other hand there is the
issuer
um an issuer can can be basically a any
trusted institute such as for a local
government you know who knows my my name
and age and my social security number
or it could be a university say that
knows that i obtained a diploma at some
sort
and then they are trusted issuers
because they are generally trusted by
other uh by other parties within society
and what we want a system like this to
do
is that
as an issuer it issues to you a
credential so a piece of data that that
you then have in your app that you
control
um so you store it in in your app your
irma app
and then at some later stage you can
disclose that you can use that
credential to authenticate yourself
towards such a verifier probably a web
shop or something as i said
and within that verification transaction
the issuer is not explicitly involved so
it gives you the credential but after
that it's it's roles done so to say
right
so
you use that credential towards the
verifier
and since there is a trust relationship
between the verifier and the issuer you
know the the verifier is going to trust
the the dutch government to say truthful
things about me or you
um it works right so then the verifier
decides you're authenticated and that
thing can go ahead
so there's this there's the holder in
the middle um there's and there's the
disclosure part there's also issuance
but in this talk we're mainly going to
focus on the verification part because
it's well it's the most important part
of itemics and irma and it's also the
most interesting part
okay
so let's see a little how just to get a
feeling of things let's first see in
this introduction how authentication
might work offline you know in the in
the more traditional sense uh
so here here's a sort of representation
of a diploma that i uh obtained in some
back in 2016 at the university of
groningen
right and now let's so this is uh for
now this represents an actual paper
diploma i have it at home it's a huge
thing and it has this this this red
signature stamp on it that's that's
supposed to signify its authenticity
and suppose now that i would want to use
this diploma to apply for a job
someplace perhaps it's a job that
requires that i have a phd
so
this use case by the way we will use in
in various
formats and ways throughout the talk so
we'll see this coming back as we go
along through the talk
right
so okay if i have such a diploma well
the i guess the easiest thing that i
could do would would be i can just take
it with me when i apply for that job
right and i show it to my uh prospective
employer and then he is convinced that i
have a phd and it's fine so that's that
works
we can go slightly further we can do
more things which such a paper uh
diploma that might that might be cool
right what we could do is we might we
could make a paper a copy of it just
using a copy machine you know the
old-fashioned things and then scratch
out some of these things right because
perhaps for the job that i applied to
it's not particularly important
what my exact name is it's just
important that i have a phd right so
using a copy a paper copy of an actual
diploma allows you to do what we call
selective disclosure of the attributes
on your diploma so the bold stuff here
is here
as it is and and here we call attributes
basic small pieces of data about
yourself
so on your copy you can scratch some of
them out and then
the the one that i show it to
knows just the important parts for the
for the particular thing i want to do
so that's a cool
cool feature to have right in our
credentials system
so
i guess it works but it also doesn't
really because
if i if i make a paper copy
of my own diploma and i scratch out some
fields and i would give that to you as
my prospective employer
then you have that
that copy and then you could use it to
try to convince others that you in fact
have a phd
so we have a problem of replay attacks
here
right so we don't want that in our
system so that's the issue we'll have to
try and solve
right
so we have a feature now that we want in
a problem that we want and there is an
additional feature that's kind of cool
in this offline setting
um there is sort of unlinkability
that means if i in this case if i make a
second copy of
i make a second paper copy of my diploma
and then again i scratch out some of
those fields but just in a different way
with different scratches and a different
pen or whatever so the new copy doesn't
look anymore like the old copy
it looks different because i scratched
it differently so that means it's no
longer it it's no longer visible that
it's it's a copy of the same underlying
actual diploma or credential so the ones
that i give these copies to they cannot
in fact see that those two copies both
belonged to me
so this is a feature that's called that
we call unlinkability and this too would
be a very nice feature to have
right
so these are some some features that we
that we might want to have in our
credentials scheme
okay
so now we want to do all of this but in
the digital domain it's easy
right so the
the goal of this talk is basically to be
able to understand this piece of code
this code comes from a software
repository called gabi which you can
find on github and gabi is our actual
idmix implementation this particular
piece of code verifies a signature on an
irma credential
so actually what it verifies is that
this particular equation holds
this is a ver the verification equation
of uh often irma or itemx credential so
that means that we're going to explain
all of the the different ingredients of
this formula later on
we'll see this formula throughout the
talk but but what it means is that
if your credential and its signature on
it satisfy that formula then it is valid
that is what this piece of code
establishes checks
so a small table of contents for the
remainder of this talk
first we'll talk about a selective
disclosure that i mentioned just now
um and
we'll we'll
to to see how you can achieve that we'll
first look at how you can distinguish
the various attributes within that
formula and within the code from each
other
then we'll show you once you have done
that how you can hide the the
attributes that are not relevant to a
particular transaction to actually
achieve the selective disclosure
next we'll talk about ownership of the
credential so how you can really bind it
to the person about which it states
things
then we will talk about unlinkability so
how you can how we can transfer that pay
that property that we saw earlier in the
paper case to our digital setting
and finally we'll
we'll talk about how you can combine all
of that to achieve disclosure of
multiple credentials
out of your irma wallet
and with that i give the word to maya
thank
thank you for being here can you hear me
now nice thank you
um i'm very happy that you're here
because this is so much a nice stuff and
i'm just also amazed that so many people
want to know how it works
you have a little handout
it is meant to help you eventually don't
worry about it yet if you don't
understand it yet that's why we have the
session
so we will um
start very basic we will start with just
digital signatures and have a look at
how they work
on the right hand side you will see our
example that we will talk about all of
the time in this time it's the diploma
again with a little bit less information
than we saw before it's the names it's
and a bit of a text and a phd with a
stamp
so how would this digitally look like
well the complete data of the diploma
would be represented by just a number m
in this case and if m
if the scientist at the university who
will issue this diploma can then take
this number m to the power of a secret
value d
modulus n and it will result in the
signature a
this is textbook rsa and i will not
cover this any further you can just look
it up
and if you don't know it in details it's
okay you should still be able to follow
the talk to some degree
the verifier and later on can take the
signature take it to the power of the
public value e and it should result
again in this signature number m modulus
m
so
zita already talked about selective
disclosure and if we want to get there
we want to hide data this is currently
not possible with this system because if
we change anything in the diploma data
we will change the number m and
the signature will not hold anymore the
equation so uh we need to find a means
to differentiate uh first between the
different uh things that we might may or
may not want to
show
and we can do this as follows
please focus on the right hand side
first
we can first split the diploma into
different attributes so it's not a blob
of text anymore but it's different
attributes with attributes types in this
case name and title and the values
singers and a phd
please don't panic about the formula we
will go into detail with all of the
stuff here
please now focus only on the little a's
the values on the right hand side seed
syringes and the phd are represented as
two numbers a1 which you see telling us
and a2 which is the phd
the
attribute types that is the name and the
title will be represented in this
equation by r1 and r2
um
z will be used for forgibility reasons s
will be used by the power of this v
later on for unlinkability but don't
worry about it yet just see that we now
have a formula
where we can differentiate between these
values
all the capital letters are constants
and public values and now we just accept
that it's there
don't worry about it yet and replace
our m in the formula above
this will
look like as follows we get a to the
power of e this will stay the same
replace m
and we have an equation
this equation
is part of the so-called comanis
lizianskaia signature scheme
and this signature scheme is uh used in
edemics and also in emr so we will focus
on this for quite like almost the whole
talk
um
we will only do the verification and the
verification is this equation
i told you already that those
capital letters are constants there's an
e and v that actually become part of the
signature you can already see that on
the right hand side here and we will go
into details
actually now
we do have we will now have a little
detour to our diploma example and i'll
just say a couple more words on the
signature scheme so you have a bit more
context on it
um
the communist lesions guys signature
scheme is quite a
mouthful that's why most people just
abbreviated um abbreviated with cl
signature scheme so you may have heard
that before
if we now just have a bit of a look at
issuance setup and issuance
then you have a bit more context and we
will see that it's somewhat rsa-like
similar to rsa we will begin by choosing
the private key with two prime numbers p
and q which if you multiply them with
each other will result in n a public
value
then you will also choose a couple of
constants that the issuer just use
as set up so the university does this
once and they will all become part of
the public key
for each attribute type you will choose
a different
constant r so it's r one two three four
as many attribute types as you have
then later on when you actually issue
the diploma
so it's really each time a credential is
issued
the two numbers e and v are chosen
and then the issue calculates the number
a by actually doing the same as it would
do with
rsa but then replace um the
m again
it will result in a signature that is a
triple because each time the credential
is issued a different e and v are chosen
so that's different
from
rs a2 for this whole signature scheme
the strong rsa assumption holds
okay but we want to focus on that we
will focus on the right hand side just
on the verification equation
and what were we doing so far we had a
look at the diploma we want to hide data
we can't hide data yet we only can
differentiate between data in the
diploma and we will now have a look at
the hiding part
going back to our example we now want to
hide the name
and if we have a look at this formula
because of the discrete logarithm
problem which states that
the exponent is infeasible to find if
you only know the result and the basis
of an exponentiation we can actually
hide already this attribute value
avon just by not sharing a one with the
verifier but the result of the
calculation so just sharing h
all other things will stay the same so
hiding itself is quite easy but we're
not there yet
the signature scheme does more than that
if this would be the only thing we would
actually be
vulnerable to forgeability attacks and
we will have now an example first to see
how this would look like
again lots of changes
we will focus on the left-hand side
first
and the example of the diploma changed a
bit because i think it's easier to
follow the example having a number and
not
a string in mind so in my new example i
still have a name that i will hide but
the second attribute will be age 17
and in my uh
forgery example
i could forge my eight my age to 18 as
follows
i could just claim that my age is 18
and then i would not share my name but i
would share a number again because i am
hiding my name in the number if i would
now not calculate this number as shown
above but
just accept that i would calculate it by
taking this number times r two to the
power of minus one
we would um still
cl the claim would hold in the equation
of verification
that uh my age is 18 although the issuer
never issued it so the verifier would
then check if the equation holds using
the wrong number but you can't
differentiate it from the usual h
which
makes the equation still hold because h
prime is the same as h time r2 to the
power of minus 1 and if you rewrite it
you get
eventually r2 to the power of a2 minus 1
and our a2 was chosen as 18 minus 1 is
17
which holds an equation because this was
actually issued
this is not what happens because the
signature scheme takes care of that
how do we do that we actually have to
prove that we know the number a that we
know this attribute value without
disclosing it
and there's now some real crew math
coming where i really can't imagine how
people think of that but it works and
it's beautiful
the communication sky signature scheme
uses a schnorr zero knowledge protocol
it's a protocol from the 90s and
it's a three steps protocol that we will
now have a look at
for simplicity i removed all the indices
the indices are used for
indicating which attribute was talking
about but it becomes messy so i skipped
them
we start by the given thing that we have
this aged which we publicly can share
because it doesn't say anything about
the the the value of a already and it's
defined by r to the power of a
now on the left hand side we have um
we the proven and on the right hand side
we have to verify
it starts by choosing
a random value t which is really big
then we calculate u as
r to the power of t modulus n and send u
just over to the verifier this is called
the commitment phase
then in the next phase the challenge
phase
the um verifier chooses a random value l
c the challenge and sends it over
to
to us again
now we calculate the response which is
this huge value t plus the challenge
times the attribute value um t thereby
masks the attribute value because it's
so big you can't really see a anymore
and sends across r
this is the response
phase and
eventually the verifier just checks if
this
equation holds and if this equation
holds
it's actually a proof
that
we know the number
without having shared the number
so this is a bit of magic
but it's actually the proof is not that
difficult um once you see it it's
difficult just to make it up but i
didn't so that's fine
um
i will go through this very quickly
it's just meant to show you that you can
understand this and you can look it up
and it's not rocket science
so here on the left hand side we start
um just what we have on the left hand
side and we want to end up on
u on the right hand side
first we can write this
this small letter r as what it is t plus
c a then we can split those because it's
a product of both this it's really just
school math on the right hand side we
can replace our h with r to the power of
a because we defined that earlier
exponentiation by exponentiation is the
same as multiplying the exponents
then we can see that they actually
cancel out the to the power of c a and
to the power of minus c a they just
cancel each other out which leaves us
with r to the power of t which is by
definition here above the same as u
again this was a bit of a
side thing in your mind but what we now
have is actually that we have our
diploma
where we have different attributes and
we can hide an attribute by using this
age
discrete logarithm thing plus
we
prove that we know the value
there's actually a second feature that
is interesting in the snore protocol and
we'll have a look at that now
you may have already noticed that
there's a challenge and a response in
there in the name
and city already mentioned earlier with
the paper diploma that um well we may
have replay attacks
um challenge response
mechanisms are used to prevent replay
attacks so let's have a look at if this
already works
again back to the example
cetera would now share
his data with me he would do the
challenge response with me i would not
see the name but he would just prove
knowledge of it and i would have the
diploma so i have all the data now can i
do a replay attack
well actually yes i can because if i now
prove to anyone of you that i have this
diploma without the name in it i could
well do a commitment you sent me a
challenge
he didn't send it to me but i know he
sees his name so at that moment i
know
i can still calculate r
uh the prove that the freshness proof is
still valid and i could send the
response
so in order to
prevent that we cannot use any attribute
type that
you will ever share it must be a secret
one so
we can now add an extra attribute which
we give the index zero and this is a
secret value that ct will never share so
i can never
do a replay on tech on that
okay did i miss something
oh yeah
little little remark um it's a signature
scheme and by using this secret value we
can actually use it as a credential
scheme
and that's what we're doing
okay let's go on
um
we now know how to hide data we know
ownership of a credential do we have
unlinkability yet
well if we look at the right-hand side
it it seems so because well we have
hidden data which just looks different
every time and we have this phd which is
not really relatable to the person
however there's still a signature the
signature consists of those three
numbers and as we see them here they're
currently still the same
this is not what happens in the
signature scheme
let's have a look how we can hide this
data
well for e and v it's actually not that
difficult to hide the data because
they're also used in the exponents in
the equation so we can use the same
mechanism as we already used for hiding
other data in our diploma we can just
use that for e and v2 and that would be
fine
however however there is still a left
we can't just hide uh a with this
discrete logarithm because it's not in
the exponent and
well
if we now want to change that we can't
we must change something on the left
hand side and on the right hand side of
the verification equation otherwise it
won't verify anymore
and this is possible and it's possible
as follows
we're making a unlinkable by choosing a
random number r
and then we define
something
with what we will replace a we will
replace a by a tilde which we define as
a times s to the power of r modulus n
and on the right hand side we replace v
with v tilde
which is defined as v minus e r
so why does this work well that's why
if we now replace it
a tilde is the same as what we just
defined it as then we have it to the
power of e so we can put that e into
both of the the bases we can replace the
complete a to the power of e
with the right hand side of the equation
then we have twice this number s to the
power of something which we can put
together so we get s to the power of v
minus e r in here and v minus c r is our
definition of v tilde
again don't worry if you don't really
follow this now because you can look it
up but it's it's correct it works it's
mathematically um
it works
what does this mean well this actually
is
it means it technically works
and just when you imagine how this
really works in practice
it would be as if you had this paper
diploma you have a signature you hide
lots of data you hide even parts of the
signature and then before showing it
each time before showing it you just
change it a bit and then you show it and
it's still valid so i think this this is
a really awesome mechanism
and it's really fun to to work with it
we now have actually all those single
features that we wanted to have and um
sits will now continue in putting this
to a complete picture so more math
go ahead
thank you
all right so let's first have a little
short summary of what we've seen so far
because it was a lot right so we started
with just rsa where where the letter m
there contains the entire diploma just
as a big blob
then into m we distinguished each of the
attributes
resulting in the formula there at the
bottom
right
next we obtained a way to hide
irrelevant attributes using zero
knowledge proofs where we proved that we
know the attributes without actually
showing them
we bonded it through the user um
using the secret
the secret over there
which is a zero in the formula here
and finally we even gained unlinkability
uh by uh by high either hiding all of
the expo
exponents in the zero knowledge proof or
modifying
the the big letter a each time before
you
before you use it
right so let's having having seen all
that let's now look at how all of that
works uh together in an actual
disclosure in this in this following
slide so this slide shows you the the
the disclosure protocol
of itemix um
for for a single credential all right
so let's suppose that we want to
disclose the attribute number two the
the phd attribute the one on the bottom
there right so that way we want to show
and then
the other ones we will hide
okay so the first thing we do is what
maya just explained uh we we modify our
a into our into a a tilde using the
random number r
and similarly we we
randomize our v into a v tilde
using again the value
r um and then for
for these uh for for these ingredients
the verification equation that we've
seen so far it still holds as my hope
just convinced you
so
for our a-tilde and v-tilde and all of
the other ingredients this holds
and next
let me take the same equation but
slightly rearranged so it's it looks a
bit different but it's actually the same
statement
what i'm going to do is i'm going to
modify it into this
so now we have
all of the exponents that we want to
hide using the xero knowledge proof we
have that on the right hand side
and all of the known stuff that's on the
left hand side
so you can get from the upper equation
to the bottom equation by multiplying
both sides by
uh
as
sv tilde and and these parts and then
you get exactly this
so it's the same statement it just looks
a little different
and now let's call this thing h again
just to have a name to refer to in what
in what follows
okay
so for this thing in particular for the
exponents on the right-hand side we now
want to prove knowledge right so what
we're going to do now is we are going to
execute a single proof of knowledge
protocol that simultaneously
simultaneously proves knowledge of all
four of those exponents
so what does that look like it looks
basically the same as as maya showed you
earlier just some of the steps times
four
so the first thing we do is we choose
four random numbers
for each of the numbers that we want to
hide so there's a t e a t v tilde a t
zero and a t one big random numbers
and then we perform the following
protocol with the verifier
this protocol here so just as before we
first compute our commitment the u
which is this expression basically the
same equation as this but with the
random numbers in it
and then we send our a tilde and you
over to the verifier
the verifier then responds with a random
number c called a challenge it sends it
back to us
and then using that challenge we compute
our responses the the letters are which
are always of the form the the big
random number plus the challenge times
the secret that we want to hide so it's
that for each of the numbers that we
want to hide and it looks like this
so these four responses we send over to
the verifier the verifier plugs them
into that verification equation that
we've also seen earlier it's now just
slightly bigger
and if that holds then the verifier is
convinced that we know the attributes
and that all of the attributes are very
validly signed
by the issuer
so this is an
itemix disclosure in a single slide out
of a single credential this is what
happens when you disclose an attribute
out of irma
under the water
but we don't want just one credential we
want to have we we want to have a wallet
of credentials right because you can
have
lots of different credentials containing
lots of different attributes from
distinct issuers and you want to have
all of them within your one wallet and
then you want the ability to combine
attributes out of all of your
credentials as suits the purpose
so we're going to have to do one final
step to go from the right hand side to
the left hand side here
so this is a screenshot of the irma app
showing a number of credentials
and i might want to add by the way that
this this particular look is subject to
change but you'll see that in the in the
coming time
right
so we have to do uh one final step to
get to where we are
uh okay
so
because there is a thing that we have to
solve still
um if we just naively combine um the the
the the you the
multiple credentials on top of each
other using the disclosure protocol that
i showed you earlier we we introduce a
problem that we have to solve
because there the issue is
suppose okay fine suppose i have my air
my app and it contains a credential that
states that i have a phd right but
suppose i'm careless and i leave my
phone just lying over there and maya
picks it up you know
if she has then control over her wallet
as well as mine so she has control over
my credentials as well as hers can she
then combine the two
for example to prove uh to
simultaneously disclose her own email
address and my phd attribute right so
that would sort of imply that if if she
would be able to disclose those two
attributes simultaneously that would
imply that she would have the phd
while in fact she does not as far as i
know anyway
so we don't want our system to allow you
to prove statements that are not
factually true
so we'll have to solve this issue
and the way we do that is as follows
we've already seen the secret um that
this the secret attributes that each
credential has
and the thing that we do is we we make
the issuance protocol of these
credentials such that if i get issued a
new credential to my wallet
then the issuance protocol ensures that
the secret of the new protocol
gets the the same value as the seek
as the secret of my other credentials
so the issuance protocol is such that
all of the credentials in my wallet they
share the same secret value
so there's one secret which is in all of
my credentials
that means that maya's wallet will uh
who which also credence could contains
credentials which also contain secrets
though that secret will have a different
value so my my secret may be one two
three and then her secret is going to be
four five six actually it's a lot bigger
but you get the idea
okay
and then once we have that we modify the
the disclosure protocol that we've seen
earlier in in such a way that not only
do i when i disclose my attributes
coming out of multiple credentials
not only do i prove that
i know the attributes that i don't
disclose
and all of the attributes are validly
signed but i also prove that the secret
out of which all of those attributes are
coming that that secret has the same
value across all of the credentials out
of which i disclose
attributes
so i can do that because all of the
credentials of my wallet actually do
have the same secrets and that will
prevent the the attack that i just
mentioned because um the credentials in
maya's wallet will not have the same
secret value as those from my
credentials
so she cannot prove that that is so
because it's not
that's the idea
so the final step is to go into a little
more detail about how we actually do
that
so here again is the
is the the proof of knowledge protocol
that we've seen earlier for a single
credential right
so let's simplify that a bit to to show
just the details that matter to us right
now
so we first compute some u and then we
we send over eight uh a tilde and u
next we get a challenge
and then we compute a bunch of responses
of this form right and then we send that
back over
so that's what that looks like for a
single credential
so
the naive combination to expand that to
multiple credentials would be basically
just like this
we do the same thing but for more
credentials
where where now i use red and blue to
distinguish the ingredients of the
different credentials right so suppose
in this particular example that i want
to disclose
my
my own phd title and actually my own
email address right because it's my
email address so i should be able to do
that so how do we do it
in particular these responses here are
are what we're going to to use and for
for the secret that we've already seen
which was labeled by xero
that's this right
so these would be the responses for the
two secrets of the credentials out of
which i disclose attributes
well
uh what we do is actually simple we make
we ensure that during the issuance
protocol that the the two a zeros that
they have the same value right i got
just called it one two three for example
so there's just one a zero
so let's make it black again because
there's just one
so there's um
one a zero
for both of my credentials there is one
challenge because there is just one
within the protocol that we've shown you
and the final step that we need is that
during the disclosure protocol um the
the
the holder the approver or the user um
it uses the say one t zero one random
value for all of these secrets
so it just chooses the one secret and
then the one random value is a t zero
and then it uses that one
t zero for all of the
uh for all of the credentials
for all of the secrets
so that means that since all of the
ingredients in this particular formula
are now the same for all of the my
credentials this response too is going
to be have the same value for every
single credential out of which i
disclose my attributes so there may be
more multiple credentials
but there was the r0 the response for
the each of the secrets is going to have
the same value for all of those
credentials
and once we have that we can just make
the verifier
enforce that this value r0 always has
that one value
so the verifier henceforth this allows
the user to send
distinct values of r0 it enforces that
the user always
has one r0 of for all of his credentials
and if the user does not then
the disclosure is rejected as invalid
well that solves the issue because as i
explained to you
my secret is going to have the same
value for all of my credentials
but my ass will not
that means that this rs
if she were to combine it to try the
attack that we just mentioned combining
multiple
credentials out of multiple wallets then
those are zero values in her case are
going to differ
because the the a0 values do
then the verifier will notice and abort
so in fact this this this secret a0 by
enforcing it to have the same value
across all of my credentials it sort of
acts as a key ring that really binds all
of my credentials together in one big
key ring or wallet
so that is our story that is
what the disclosure protocol of uh of
idmx looks like this is what happens
when you do an air matte disclosure
so going back to our initial picture we
have now seen how the verification part
of this diagram works
right
um and by using all of this mechanism
itemix allows you to have a wallet
containing lots of credit
credentials
which may contain lots of attributes
that you can disclose
and you can even do so selectively and
unlinkably which is really awesome i
think
there's lots of more stuff going on here
because as i said we've just
discussed that verification error over
here we have not discussed irma schemes
which which facilitates the upper arrow
the trust relationship we have not
discussed the the issuance part then
there are still more we have not
discussed the armakeisha surfer or
or the revocation of attributes ones
that their value to it ceases to be true
um all of that irma implements as well
but you know we can't fit everything
into a single talk
uh so if you want to know details about
that come look us up this evening or in
the coming days
and with that
i think there's still a little more a
little more time for questions thank you
very much
thank you very much
uh since maya
we still have five minutes for questions
i see a lineup already
um
otherwise you could have explained the
rest also what we have first first
question over there yeah
is there any
thought in the system given to how
um to prevent attributes being sort of
used misused so for example
um okay going to if i'm actually getting
a job it's not much it's not too
difficult it's kind of annoying that i
have like emailed my phd to lots of
people but that you know everybody's
done this but um so okay it would be
kind of cool to be able to send
something you know
somewhat more redacted or whatever but
but anyway um is there is there a is
there any thought to like um so one of
the things that's in the the verified
like the verif the old verifiable claims
use cases document from the w3c is they
wanted that um
it to be used for
um like to prove you had a job to a bank
but of course you don't open a bank
account every day it wouldn't be that
much trouble to get a new letter from
your thing but what happens if um if if
i just have this wallet what happens if
now some other parties start asking
for this prove you have a job so for
example if uh hr departments want me to
prove that i have a job when i apply for
a job and then they can start binning
resumes and and for most of the
verifiable claims use cases there's
actually this malicious use it's very
easy to find these malicious uses yeah
that's a very good question thank you um
well the the first answer i think is
that um if you're asked to to to
disclose from attributes to whoever is
asking for them the irma app also always
gives you the ability to just refuse
there's a big no button right
um so there is that but i don't think
that answers your question not not not
entirely um i think
there is a definitely a risk that a
system like this makes it much too easy
for potential verifiers to enforce that
you authenticate with them right using
perhaps too much attributes
um
so that's something that we'll have to
be very careful about and we're aware of
it we have a couple of ideas that might
help there um for example
i think that we might still do is is
implement a button in the irma app that
when it's asking you
some attributes and and you think that
it's too much attributes or not
appropriate to the situation or that you
can then uh report it to the dutch
authority personal havens the authority
personal data or to the police i don't
know or to us so that then something
might be done about it
um yeah so there's not i mean why
involve the user i would like to add
something first here uh very shortly we
were now only talking about the
technical stuff so it was really just
why it works so you get some insights
why we claim it is how it is so how so
you can see that there are lots of
advantages and lots of disadvantages for
the complete system to use
this was not what we were talking about
but it might be a nice future talk yeah
but my main question
the implication is was why involve the
user at all why not just have why not
just have this certificate for the
person they're identifying it for say
what they're allowed to ask can we take
this question offline uh discuss it
later with them give other people a
different question thank you thanks
okay cool talk
how
um or do you provide your secret key to
the issuer
and do you have different secrets for
different issuers
otherwise can you combine your
attributes if they're from different
issuers no there's one secret
which is reused across all of your
credentials even if they are from
different issuers and that that means
that you do have the ability to combine
different attributes from different
issuers but that's a feature
so then the issuer knows your secret
no no the issue does not get to the
issuance ah that's that's a good
question the issuance protocol which we
have not discussed is such that um the
issuer it does ensure that you get the
same secret as your earlier credentials
there too you have to prove knowledge of
it but it doesn't get to see the actual
value
of that secret
um and that too is achieved by zero
knowledge proofs okay awesome
so it's actually a double blind
signature scheme and we just really did
not talk about this at all um
the issuer themselves they have private
keys that they don't not share they only
share the public keys and the secret
value from
the app user will never be shared
anywhere just proven that you know it
um i was just wondering how the
attribute values are encoded because i
can imagine it results in a bunch of
large numbers that you have to do maths
with so
can you repeat the question a little
louder there's
oh sorry um i was just wondering how the
attribute values are encoded because i
can imagine it
results in a
bunch of big numbers that you have to do
a lot of maths with so are
is the size limited or is it arbitrary
and are there any performance issues
it's basically arbitrary
currently the the you just use string
encoding so an attribute is some string
and you just take the utf-8 encoding of
that and then europe you could you
interpret that as a big number and
that's it and there is a boundary um the
attributes are by idemix they are not
allowed to exceed
bits but that we solve by just hashing
it using sha 256 if it does and then
you're below it again
so that means that attributes can have
basically any size or content you know
it's not necessarily practical if you
have this giant
protocol attributes because it would
um it would look weird in your app right
but that's another issue
okay we have time for one small question
with
okay keep it small it's going to be a
big question i'll try okay
okay okay
so
how are key reflocations handled can you
get a bit closer how are the revocations
of
the keys of the issues handled
relocation
so actually there are two papers on that
and you can all read it on the
documentation on emma.app
docs sidsa wrote that down in great
detail so i could understand it so
you will
understand
but the two papers published also by
kamenish i guess and uh we have an
implementation of that
i will not go into detail sorry thanks
thank you very much i see the same uh
kuk dude
offline thank you very much uh on the
sides are qr codes to the github
repository of airbag uh i would like to
actually the slides so if i'm sorry the
slides uh it's a it's a github
repository filled with slides uh no code
because it's open source
there's also code okay thank you very
much
okay thank you very much uh thank you
very much for your
enlightenment uh this evening uh
maya
one final big round of applause thank
you
[Applause]
you