Anonymous Credentials

KILT presents its anonymous credentials library.

https://github.com/KILTprotocol/portablegabi

Transcript

1. Berlin, March 19, 2020 Anonymous Credentials Show yourself, but stay hidden
2. What are Credentials? page 3 Claimer Bob Attester Alice trust Verifier Carol request credential present credential
3. What are Anonymous Credentials? Identityless The credential doesn’t contain an identity Multi-show unlinkability It is not possible to link two interactions together. Selective disclosure Only reveal what is necessary for the specific interaction. Decoupled attester & verifier The attester is not involved in the verification process. page 4 “My name is XXX and I have a cat.”
4. What are Anonymous Credentials? Identityless The credential doesn’t contain an identity Multi-show unlinkability It is not possible to link two interactions together. Selective disclosure Only reveal what is necessary for the specific interaction. Decoupled attester & verifier The attester is not involved in the verification process. page 5 “I have a cat!” “I have a cat!” Carol “Was that the same person?”
5. What are Anonymous Credentials? Identityless The credential doesn’t contain an identity Multi-show unlinkability It is not possible to link two interactions together. Selective disclosure Only reveal what is necessary for the specific interaction. Decoupled attester & verifier The attester is not involved in the verification process. page 6 “I have a cat!” “I have a cat, a dog and a fish.” Carol
6. What are Anonymous Credentials? Identityless The credential doesn’t contain an identity Multi-show unlinkability It is not possible to link two interactions together. Selective disclosure Only reveal what is necessary for the specific interaction. Decoupled attester & verifier The attester is not involved in the verification process. page 7 “I have a cat!” Carol “I don’t need your help Alice!” Alice “Can I join the fun?”
7. Portablegabi Is this a new video game console?!
8. Why Portablegabi? page 9 ZK-SNARKs with Merkle Tree inclusion proofs • Upsides ◦ prevalent Rust libraries • Downsides ◦ complex custom circuits ◦ trusted setup ◦ complex revocation ◦ high time effort Gabi upsides • perfect credential use-case fit • based on open source library • revocation • faster to implement Attester Merkle Tree Claim Merkle Tree • private attributes • public attributes • claim tree hash • random nonce
9. Why Portablegabi? page 10 ZK-SNARKs with Merkle Tree inclusion proofs • Upsides ◦ prevalent Rust libraries • Downsides ◦ complex custom circuits ◦ trusted setup ◦ complex revocation ◦ high time effort Gabi upsides • perfect credential use-case fit • based on open source library • revocation • faster to implement Attester Merkle Tree Claim Merkle Tree • private attributes • public attributes • claim tree hash • random nonce
10. Attestation page 11 Alice (Attester) Bob (Claimer) initiate attestation session • Alice sends a nonce to Bob and initiates an attestation session ◦ nonce = protection against replay attacks of attestation session • Bob requests an attestation from Alice ◦ for specific attributes ◦ including commitments on the nonce and Bob’s private identity • Alice verifies the proof and signs Bob’s attributes ◦ Bob builds a credential using the signature and his private secrets request attestation submit attestation
11. Attestation page 12 Alice (Attester) Bob (Claimer) initiate attestation session • Alice sends a nonce to Bob and initiates an attestation session ◦ nonce = protection against replay attacks of attestation session • Bob requests an attestation from Alice ◦ for specific attributes ◦ including commitments on the nonce and Bob’s private identity • Alice verifies the proof and signs Bob’s attributes ◦ Bob builds a credential using the signature and his private secrets request attestation submit attestation
12. Attestation page 13 Alice (Attester) Bob (Claimer) initiate attestation session • Alice sends a nonce to Bob and initiates an attestation session ◦ nonce = protection against replay attacks of attestation session • Bob requests an attestation from Alice ◦ for specific attributes ◦ including commitments on the nonce and Bob’s private identity • Alice verifies the proof and signs Bob’s attributes ◦ Bob builds a credential using the signature and his private secrets request attestation submit attestation
13. Verification page 14 • Carol requests specific attributes from Bob ◦ sends a list of attribute identifiers ◦ + nonce to prevent replay attacks • Bob sends a zk-proof to Carol ◦ Bob creates a zero-knowledge proof of a signature on his attributes ◦ proof is randomized and cannot be linked to another proof ◦ Bob only includes attributes he wants to share ◦ nonce is included inside the proof Bob (Claimer) request attributes submit presentation Carol (Verifier) verify presentation
14. Verification page 15 • Carol requests specific attributes from Bob ◦ sends a list of attribute identifiers ◦ + nonce to prevent replay attacks • Bob sends a zk-proof to Carol ◦ Bob creates a zero-knowledge proof of a signature on his attributes ◦ proof is randomized and cannot be linked to another proof ◦ Bob only includes attributes he wants to share ◦ nonce is included inside the proof Bob (Claimer) request attributes submit presentation Carol (Verifier) verify presentation
15. Revocation page 16 • Initial set up for each attester: ◦ write an accumulator on chain • During attestation: ◦ Bob receives non-revocation witness from Alice ◦ Bob can now prove his witness is included inside the accumulator • During verification: ◦ Bob includes in zk-proof that his witness is contained inside a specific accumulator Alice (Attester) write accumulator Carol (Verifier) query accumulator Blockchain
16. Revocation page 17 • Revocation of credentials ◦ Alice stores all witnesses for her attestations ◦ removes the corresponding witness from the accumulator ◦ updates the accumulator on chain • All claimers need to update their witnesses ◦ verifiers can specify a max. age for accumulators ◦ a claimer only needs to update if his witness is older than a specific threshold Alice (Attester) Bob (Claimer) update witness update accumulator query accumulator Blockchain
17. Examples That sounds all cool, but how to use it?!
18. // Create a claimer const claimer = await Claimer.create() // create an attester const attester = await AttesterChain.create() // the attester needs an accumulator const accumulator = await attester.createAccumulator () // the attester needs an accumulator await attester.updateAccumulator (accumulator) await blockchain.waitForNextBlock () page 19 Create Actors • Claimer has a secret ◦ should never be shared ◦ to prove multiple credentials belong to the same entity • Attester has to ◦ create a key pair ◦ create an accumulator ◦ upload the accumulator • Verifier has no identity ◦ has to be handled by the messaging protocol
19. Attestation Part 1 // ATTESTER: initiate attestation session const { message: startAttestationMsg , session: attestationSession , } = await attester.startAttestation () // CLAIMER: create proof and request attestation const { message: attestationRequest , session: claimerSession , } = await claimer.requestAttestation ({ startAttestationMsg , claim, attesterPubKey: attester.publicKey }) Attestation Part 2 // ATTESTER: receive request and inspect requested attributes const checkClaim = attestationRequest .getClaim() // ATTESTER: sign attributes and send to claimer const { attestation , witness } = await attester.issueAttestation ({ attestationSession , attestationRequest , accumulator, }) // CLAIMER: create a credential using the attestation const credential = await claimer.buildCredential ({ claimerSession , attestation, }) page 20 Attestation • Attester initiates attestation ◦ sends nonce to claimer ◦ stores nonce in session • Claimer ◦ creates zk-proof over secret and nonce ◦ stores session ◦ requests signature • Attester creates signatures ◦ sends to claimer ◦ stores witness • Claimer creates a credential ◦ credential must stay private
20. // VERIFIER: requests disclosed attributes const { session: verifierSession , message: presentationReq , } = await Verifier.requestPresentation ({ ['over18', 'nationality' ], new Date(), }) // CLAIMER: create disclosure proof using his credential const presentation = await claimer.buildPresentation ({ credential, presentationReq , attesterPubKey: attester.publicKey, }) // VERIFIER: verify provided proof const { verified, claim: verifiedClaim } = await Verifier.verifyPresentation ({ proof: presentation, verifierSession , attesterPubKey: attester.publicKey, latestAccumulator , }) page 21 Verification • Verifier requests attributes ◦ specify threshold for age of the accumulator • Claimer discloses attributes ◦ accumulator too old? → update witness • Verifier verifies proof and accumulator
21. // ATTESTER: revoke attestation const accRevoked = await attester.revokeAttestation ({ accumulator, witnesses: [witness], }) // the attester needs an accumulator await attester.updateAccumulator (accRevoked) await blockchain.waitForNextBlock () // ALL CLAIMERS: update their credentials which are attested by the specific attester const updatedCred = await claimer.updateCredential ({ credential, attesterPubKey: attester.publicKey, accumulator: accRevoked, }) page 22 Revocation • Attester removes witness from accumulator • Claimer updates his credential ◦ will fail for any revoked credential
22. § Legal Note 1. The purpose of this technical presentation is to present the KILT Protocol and views about the current and future technical infrastructure around it to an interested public. The information set forth should not be considered exhaustive and does not imply any elements of a contractual relationship. Its sole purposes are to provide relevant and reasonable information to an interested public as well as to any developers who think about integrating the KILT Protocol, to any blockchain developers who wish to contribute to the KILT Community and to potential implementation partners who want to get an insight into the current state of the KILT project. 2. Nothing in this presentation shall be deemed to constitute a prospectus of any sort or a solicitation for investment, nor does it, in any way, pertain to an offering or a solicitation of an offer to buy any securities in any jurisdiction. The document is not composed in accordance with, and is not subject to, laws or regulations of any jurisdiction which are designed to protect investors. 3. This presentation shows today’s views and today’s vision of the project which are both subject to constant change. Certain statements, estimates, and financial information contained within this presentation constitute forward-looking, or pro-forma statements, and information. Such statements or information involve estimates and opinions on potential future developments as well as known and unknown risks and uncertainties which may cause actual events or results to differ materially from the estimates or the results implied or expressed in such forward-looking statements, even if such statements are not specially marked as unknown or uncertain by an explicit remark or by the grammar or tense used. 4. Nothing published by the BOTLabs GmbH should be interpreted as investment advice. BOTLabs GmbH is in no way providing trading or investment advice. Please consult with your appropriate licensed professional before making any financial transactions, including any investments related to ideas or opinions expressed, past, present, or future by the aforementioned entities and any future entities that may operate under the parent entities. BOTLabs GmbH does not intend to express financial, legal, tax, or any other advice and any conclusions drawn from statements made by, or on, BOTLabs GmbH shall not be deemed to constitute advice in any jurisdiction. Information is provided for educational and amusement purposes only. page 23
23. Q&A Ask us anything! @KILTProtocol @WilliamFreude #kilt-general:matrix.org kilt.io github.com/KILTprotocol/portablegabi
24. Imprint BOTLabs GmbH Managing Director: Ingo Rübe Keithstr. 2-4 AG Charlottenburg HRB 193450 B 10787 Berlin USt-IdNr.: DE316284270 Germany info@botlabs.org https://botlabs.org Requirements according to § 5 TMG (Germany) Thank you for your attention! page 25 @Kiltprotocol kilt.io