Information Disclosure in Identity Management
Doğan Kesdoğan, Vinh Pham, Lexi Pimenidis · University of Regensburg Publication Server (University of Regensburg) · 2007
User Controlled Identity Management Systems have the goal to hinder the linkability between the different digital identities of a user.We perform a theoretical and an experimental study of the following information leakage problem: given a consistent view on the actions of a strong identity management system (e.g.Idemix ) where k users pseudonymously issue and show some credentials, do these observations disclose sufficient information about the linkability of the digital identities?We show that in theory, linking the different pseudonyms of a user is a NP-complete problem, by using first order logic.In addition, we evaluate practical instances of the problem, and show that there are non-negligible probabilities that despite full anonymization and use of an identity management system, pseudonyms are unambiguous linkable.