Anonymous credentials with biometrically-enforced non-transferability
Russell Impagliazzo, Sara Miner More · 2003
We present a model and protocol for anonymous credentials. Rather than using deterrents to ensure non-transferability, our model uses secure hardware with biometric authentication capabilities.Using the model combining biometric authentication with anonymous credentials in the wallet-with-observer architecture proposed by Bleumer [4], we formalize the requirements of an anonymous credential protocol. In doing so, we define what it means for a protocol to be strongly subliminal-free, and show that any protocol meeting this new definition can be used in a non-transferable anonymous credential system. Our new definition improves upon subliminal-freeness as used by Burmester et al [10], in that we restrict information flow among parties even when one party detects that others in the protocol are dishonest.We describe a new protocol which is strongly subliminal-free. We then extend this basic model in a modular way to include the additional feature that the issuing authority may revoke credentials via a single (broadcast) message. Finally, we present a second protocol in the extended model.