Issue No. 01 - January/February (2012 vol. 10)
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MSP.2012.7
Anja Lehmann , IBM Research - Zurich
Gregory Neven , IBM Research - Zurich
Jan Camenisch , IBM Research - Zurich
For transactions on the Internet, user authentication typically involves usernames and passwords. When creating an account, users often must provide additional personal information. Usually, this is a list of self-claimed attributes such as name, address, or birth date. Only a few attributes such as email address and credit card information have some mechanism to authenticate them. Solutions such as the Security Assertion Markup Language, OpenID, or X.509 certificates let users authenticate and transfer attributes, certified by an issuer, to a relying party in a more trusted way. However, these technologies still have considerable security and privacy concerns. Private credentials are a superior solution. With them, issuers don't have to be involved during authentication. Also, users disclose only those attributes required by the relying parties and can do so without being easily tracked across their transactions.
private credentials, X.509 certificates, identity management, cryptography, authentication, public keys, computer security
Anja Lehmann, Gregory Neven, Jan Camenisch, "Electronic Identities Need Private Credentials", IEEE Security & Privacy, vol. 10, no. , pp. 80-83, January/February 2012, doi:10.1109/MSP.2012.7