Anastasia: Cinderella's Stepsister Turning Shabby X.509 Certificates into Elegant Anonymous Key Attestations

Presented at IIW 41 (Internet Identity Workshop), October 21, 2025

Transcript

1. Anastasia: Cinderella's Stepsister Turning Shabby X.509 Certificates into Elegant Anonymous Key Attestations Dan Yamamoto (Internet Initiative Japan Inc.) / Katsuyoshi Ozaki (DataSign Inc.) Keisuke Hasegawa (SECOM Intelligent Systems Laboratory) / Kazue Sako (Waseda University) IIW41 / October 21, 2025
2. Digital Identity Wallet 1 Issuer Verifier Wallet n Name n IsOver21 Credential Presentation n n IsOver21
3. with Device Binding 2 Issuer Verifier Wallet n Name n IsOver21 n 𝑑𝑝𝑘 n Signed nonce verifiable with 𝑑𝑝𝑘 𝑑𝑠𝑘 𝑑𝑝𝑘 Credential PoP Presentation n n IsOver21 n 𝑑𝑝𝑘 𝑑𝑠𝑘: device private key, 𝑑𝑝𝑘: device public key
4. with Key Attestation 3 Issuer Verifier Wallet n Name n IsOver21 n 𝑑𝑝𝑘 n Signed nonce verifiable with 𝑑𝑝𝑘 𝑑𝑠𝑘 𝑑𝑝𝑘 X.509 Certs for Key Attestation n “𝑑𝑝𝑘 is in a secure device” Credential PoP Attestation CA Presentation n n IsOver21 n 𝑑𝑝𝑘 𝑑𝑠𝑘: device private key, 𝑑𝑝𝑘: device public key
5. Example: Android Key Attestation Certificate Chain 4 Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Key Attestation CA Validity: 2022-03-20 -- 2042-03-15 Subject Public Key: 𝑝𝑘! Signature: 𝜎! Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Google Droid CA2 Validity: 2022-01-26 -- 2037-01-22 Subject Public Key: 𝑝𝑘" Signature: 𝜎" Algorithm: ES384 Issuer: Google Droid CA2 Subject: Google Droid CA3 Validity: 2025-10-07 -- 2025-12-16 Subject Public Key: 𝑝𝑘# Signature: 𝜎# Algorithm: ES256 Issuer: Google Droid CA3 Subject: StrongBox Validity: 2025-10-06 -- 2025-10-31 Subject Public Key: 𝑝𝑘$ Signature: 𝜎$ Algorithm: ES256 Issuer: StrongBox Subject: Android Keystore Key Validity: 1970-01-01 -- 2048-01-01 Subject Public Key: 𝑝𝑘% == device PK Signature: 𝜎% Root Cert CA Cert 1 CA Cert 2 CA Cert 3 EE Cert
7. Challenge: Unlinkable Key Attestation with X.509 6 n X.509 certificates consist of many correlating factors: lSerial number lValidity period (exact datetime) lSubject public key lSignature value lKey identifiers lExtended attributes for attestation, (e.g., Boot key hash) n … But they do not support selective disclosure or range proofs n Do not provide unlinkability
8. Prior Work: Cinderella 7 n Microsoft Research (Presented at IEEE S&P 2016) n Use zk-SNARKs (Pinocchio) to anonymize RSA-based X.509 certificates n 👍 Tiny proofs (288 B) & fast verification (milliseconds) → verifier-friendly n 👍 “Parse outside, re-serialize inside” design → efficient circuits n 👍 Support proof of OCSP-stapling for revocation n 😢 Huge parameters (GB-scale) & non-universal trusted setup n 😢 Proof generation takes hundreds of seconds → not suitable for mobile devices
9. Cinderella in an ETSI Techinical Report 8 One immediate issue is proving performance. Since the resulting Cinderella pseudo-certificates can take up to 9 minutes to generate for complex policies on a computer, it is recommended that they are generated offline and refreshed typically on a daily basis. … Yet, progress in zk-SNARK proving performance - e.g. lookup table with PLONKish arithmetization, assembly provers for mobile platforms, and tolerance of "bigger" proofs (hundreds of kilobytes) would arguably make a re- implementation of Cinderella practical on mobile phones
10. Our Proposal 9 n Pseudonymous key attestation: an attestation scheme that verifies a device key as genuine while keeping it unlinkable to the device’s real-world identity n Built upon the Cinderella approach, enabling on-device execution on smartphones: l Uses UltraHonk (a PLONKish scheme) instead of Pinocchio to reduce prover computation cost l Prevents memory overflow by concatenating per-certificate proofs instead of generating a single chain-wide proof l Leverages zk-DSL Noir for circuit design, enabling developer-friendly circuit implementation and maintenance, and integrates with Mopro for seamless mobile deployment n Performance: Generates a two-level chain proof (CA → EE; ES256) in about 30 seconds on an Android device (Google Pixel 9a) Anastasia: Cinderella's Stepsister Turning X.509 Certificates into Pseudonymous Key Attestations
11. Example: Pseudonymous Android Key Attestations 10 Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Key Attestation CA Validity: 2022-03-20 -- 2042-03-15 Subject Public Key: 𝑝𝑘! Signature: 𝜎! Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Google Droid CA2 Validity: 2022-01-26 -- 2037-01-22 Subject Public Key: 𝑝𝑘" Signature: 𝜎" Algorithm: ES384 Issuer: Google Droid CA2 Subject: Google Droid CA3 Validity: 2025-10-07 -- 2025-12-16 Subject Public Key: 𝑝𝑘# Signature: 𝜎# Algorithm: ES256 Issuer: Google Droid CA3 Subject: StrongBox Validity: 2025-10-06 -- 2025-10-31 Subject Public Key: 𝑝𝑘$ Signature: 𝜎$ Algorithm: ES256 Issuer: StrongBox Subject: Android Keystore Key Validity: 1970-01-01 -- 2048-01-01 Subject Public Key: 𝑝𝑘% Signature: 𝜎% Root Cert CA Cert 1 CA Cert 2 CA Cert 3 EE Cert 𝑛𝑦𝑚
12. Current Implementation 11 Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Key Attestation CA Validity: 2022-03-20 -- 2042-03-15 Subject Public Key: 𝑝𝑘! Signature: 𝜎! Algorithm: RSA4096 Issuer: Key Attestation CA Subject: Google Droid CA2 Validity: 2022-01-26 -- 2037-01-22 Subject Public Key: 𝑝𝑘" Signature: 𝜎" Algorithm: ES384 Issuer: Google Droid CA2 Subject: Google Droid CA3 Validity: 2025-10-07 -- 2025-12-16 Subject Public Key: 𝑝𝑘# Signature: 𝜎# Algorithm: ES256 Issuer: Google Droid CA3 Subject: StrongBox Validity: 2025-10-06 -- 2025-10-31 Subject Public Key: 𝑝𝑘$ Signature: 𝜎$ Algorithm: ES256 Issuer: StrongBox Subject: Android Keystore Key Validity: 1970-01-01 -- 2048-01-01 Subject Public Key: 𝑝𝑘% Signature: 𝜎% Root Cert CA Cert 1 CA Cert 2 CA Cert 3 EE Cert Not supported (Our ZK circuit currently supports only ES256 anonymization) 𝑛𝑦𝑚
13. Demo 12 1. Generate a key pair and X.509 certificate chain on Android 2. Prove the validity of attestation certificates on Android 3. Verify proof on Web verifier
14. ZK Circuits 13
15. Summary and Future Works 14 Summary n We design Anastasia, a system that transforms X.509 certificate chains into anonymous key attestations using ZKP, building upon Microsoft’s Cinderella n In the prototype, a two-level chain proof (CA → EE; ES256) is generated in about 30 seconds on Google Pixel 9a Future Works p Additionally support ES384 and RSA4096 certificates p Support privacy-preserving revocation applying ZK to CRL p Add iOS support p Provide formal security audit Repository