DAPPCON 2025: Privacy Invariants in Digital Identity - Ying Tong

Transcript

Uh thank you Migala. Yes I am also a human. Um and recently yeah I've been getting interested in digital identity. So digital ID systems like Worldcoin are being widely deployed all over the world. Um so for instance the EU commission is rolling out the EU digital identity wallet next year. And the more I looked into these systems, the more troubled I became. Um, the EU digital ID wallet, for example, has selected a design that does not uh afford the user any privacy. It's uh

user actions are fully linkable and this is what they're going to deploy in 2026 in violation of their own regulations which specify the need for unlinkability. So my question was um how is it that the EU commission could sleepwalk into choosing such an inadequate design? Um how can we prevent this? And how can we furthermore prevent the deployment of digital ID systems in contexts that are inappropriate that don't need strong authentication and how uh how can we prevent deploying

them in context where they're strictly worse than existing physical forms of verification. So this talk introduces a threat modeling framework called privacy invariance or invariant centric threat modeling and I propose this as one systematic way uh we can identify uh privacy violations in our protocols. So first of all I want to introduce two related but distinct concepts. Um authentication and authorization. So authentication refers to proving a unique identity like

a a national ID or employee ID that can map to a natural person or like just a single entity. Whereas authorization um expands this access list to a set of size n. So I am one of n citizens. I am one of n employees. And of course in cases where this set is size one. So like the set of people who can access Mika's bank account is Mika. Um this uh authorization reduces the authentication. that it's important to distinguish between them because a digital ID um affords us the ability to

authenticate people to uniquely identify them and they are right now being deployed in context that do not require such strong authentication. for example, age verification that requires only weak authorization that requires you to prove membership in the set of people above 18. So digital ID is not appropriate um for such context. It should not be naively used for such context. And this principle is called purpose limitation.

It's um simply limiting the amount of data that you collect, limiting what you can even do with it. So in order to reason um about the requirements of these applications and in order to identify when our solutions violate them, uh one useful framework I found is invariant centric threat modeling. So if if you guys are familiar with threat modeling, usually threat modeling frameworks um they approach the problem from is like imagining possible attacks. So like enumerating all the possible adversaries and all the

creative ways they could attack uh your system. So the main drawback of this frame the um like attacked centric frameworks is they are prone to a failure of imagination. Um so invariant centric threat modeling flips this and starts with zero assumptions um about your adversaries and then it sets out basically the invariance that you want to preserve. um the guarantees that you want to pro provide your users. And so it's building up um this series of guarantees of invariance and identifying

um when they're violated. So um and the Zcash wallet application uses this framework for example. Um so I'm going to take us through two edge cases uh two use cases where uh digital identity is being applied and to me these are edge cases because I think these are cases where digital ID should not be applied.

So the first one is humanitarian aid distribution. um basically in a crisis zone. You're like a organization like the Red Cross is trying to distribute aid but make sure that for example nobody double claims it that everyone who claims it is a registered legitimate recipient and so on and um to do this uh a bunch of organizations have simply created a digital ID system in the community of refugees. So for example, the World Food Program in Yemen, um Western actors in Afghanistan, they built up in in these two cases a database of biometric data about the

refugees. And in some cases, these were political opponents um of the authorities of the regimes in power. And when when these external actors leave, they often leave behind um these banks of biometric data that would endanger um the refugees. Another edge case is a very very common uh age verification. So I'm going to focus in particular on physical age verification which means um whenever you present your physical ID right now. So, in the pub, this on on your left is a screenshot from a UK government that say

like pubs, clubs, and shops will now start to accept digital IDs. Um, and the other screenshot is from my Colorado digital ID program. they are also partnering with physical businesses breweries and so uh I'm going to argue here that digital ID is strictly worse in these cases should not replace um physical ids. So the first edge case is um eight distribution. So this screenshot is from a research paper um called not yet another digital ID system. So these researchers were

working with um the Red Cross and they basically argued um that an aid a successful aid distribution system does not need yet another digital ID system. So they've set it up um with these parties whereby um the recipient registers into the system and then receive some credentials and is able to then use them to uh redeem um uh goods at the distribution station.

And uh another requirement of the system is that it needs to be auditable after the fact. So the auditor needs to be able to access the logs uh in a privacy preserving way. So now we're going to go through the exercise of um invariant centric threat modeling. What are the privacy invariants that we want to preserve here? So firstly um the registration station they they are learning a lot of personal information about you like your name your household your household needs etc. So they are learning all that but what they should not learn is how you're transacting in the system after you

register into it. So it's kind of like the world kind apps shouldn't learn uh about your transactions. The registration systems should not be able to observe you making a transaction. The distribution systems should not learn anything about you beyond whether or not you're registered. So yeah, they they should only be able to uh authorize you and not authenticate you. the auditors uh looking at the logs should not be able to tell uh whether two transactions were made by the same recipient. Um so they should not be able

to trace a single recipient through the logs. So yeah, this is I I really like the the privacy requirements, privacy invariance framework here because then we can sort of analyze um different alternatives, different solutions according to whether or not they preserve um these invariants. So um a lot of eight distributions systems um still use manual pen and paper.

solutions. So to register people, they create a list uh of registered households um and they then give it to the distribution system. So after you're registered uh they cannot track you anymore because you're not leaving a trace um of your actions. Uh sorry because the distribution stations are not um communicating anymore with with the regists but the distribution stations do receive all your information uh all your particulars your name and they uh request that data from you at the point

of distribution. So for them it is extremely clear uh who is receiving aid from which station. So this violates um the privacy invariant that this distribution station should not learn any information any personal information about you and the auditors after the fact also get access to the logs that the distribution system used. So they learn basically the same information that the distribution stations do.

Now this is not an optimal solution but biometrics are even worse. Um so in the case of biometrics the registration station like worldcoin scans uh say all your irises and then the distribution distribution station afterwards um checks against the database um whether or not your iris appears there. So I guess if you actually used WorldCoin, the distribution station could uh just check that you're in the stat of participants. But as they're deployed in these um eight distribution systems, the distribution station

literally asks um literally scans your IRS and asks the registration station if you're in the list. Um and because these transaction logs are personally identifying once again any auditor would be able to trace your actions. Um so what this research paper concluded was that digital identity is way too strong of a system um for humanitarian aid distribution. And really all we need is a weak authorization that preserves certain security invariance. So all we need to do is check that you're not

double claiming. All we need to do is check that you're registered and we don't need to know any personal information about you beyond what you've given it registration. Um the other so basically they introduced a system where the registration station blindly signs tokens and distributes them to households so that at the point of distribution um there is no way for the registration station to identify that it's your token and there is no way for the distribution station to learn anything about your identity. Um, and at the same time, these tokens are stateful, so they encode how many times

they've been redeemed within a certain time period. Um, and so an auditor only needs to check that um, each token uh, that that the tokens add up to the total amount of aid distributed without learning uh, any personal information. So yeah, I I recommend everyone read um this paper, not yet another digital ID um because it's really questioning the premise of whether digital ID is um appropriate uh in in many situations.

So yeah, the other use case that I wanted to go through is physical age verification. So this is another edge case because it's replacing a physical interaction with a digital interaction and that is strictly worse. Um so how it's been proposed like the EU digital identity wallet um for them age verification is one of their main use cases and how they propose to do it is um you the holder um you get some kind of credential let's say a passport from your government and

you're able to make proofs um about this credential. and present let's say a proof that you're over 18 to a verifier. So this is very nice because uh the verifier doesn't need to phone home to the issuer get your credential. So you can locally make a proof about your credential. Um now what are the privacy invarants that we want to preserve here? So first of all uh as before the issuer should not be able to link presentations to a holder. So by looking at transactions um happening in a system

the issuer should not be able to relate two transactions to one holder. The verifier once again should not learn any personal information about the holder. They should only learn that she is above 18. And similarly to the issuer, the verifier should not be able to tell whether or not two presentations came from the same holder. Um so the solution currently proposed by the e digital identity wallet is something called SD Jets. um selective disclosure

JSON web tokens and these violate the privacy inv these violate um the privacy and variance about linkability. So SDJ jets allow issuers and verifiers to link transactions to individual holders. How it works just really quickly is that um it takes the credential um and it kind of uh kind of obuscates the plain text values by hashing them um with some salt.

So the issuer instead of signing the plain text credentials signs these salted hashes of them. And the idea is that the holder can then present uh a can then disclose a subset um of these hashes while keeping the other ones um closed. Um so I could choose to just open the first hash my name and then leave the other two as random strings.

Um the issue with this is that the hashes themselves are unique. They are random but they are unique. And so if I present the same hash twice even if I don't open them um I can be linked. So this is the solution that the EU commission settled on um and will likely roll out in um next year. Yeah. Um, so most ZK ID solutions that you might be familiar with try to improve this um by uh concealing the salted hashes as private inputs in a ZK

snark. Um, so this does solve the problem. Um, yeah. And uh the project I'm working on is trying to integrate these um and propose it to the EU commission. So yeah, if once again um we compare these protocols according to the privacy and variance, we'll find that yeah, the SDJ jets um they do not they violate linkability for both issuer and verifier.

they actually do preserve selective disclosure. So that's a typo there. Um whereas a physical ID presentations are not linkable like the issuer has no idea uh when you're who who you're showing your license to. Um the verifier is not recording your license and so does not have a log um of credential presentations. um that it can link but yeah physical ID does not preserve the selective disclosure and variant because you are showing everything um about yourself whereas anonymous credentials ZK ID um

preserves all the invariant I think I'm at time now um but yeah just to wrap up there's this final privacy and variant that is unique um to physical um ID which is repudiation. As I mentioned just now uh a physical ID presentation does not create any logs and meaning that after presenting the ID you can plausibly deny um having made that transaction. Like if I buy um alcohol at the liquor store with cash, I can later just deny that I did that. Whereas like for example, as

the jets do not allow you to do so and anonymous credentials using ZK's narks may or may not depending on um which fields you reveal. So that's the end of my talk. Um thank you for your attention. [Applause] Uh questions questions. Hello. Thanks for this speech. Um I was talking to a colleague of yours both in terms of uh as a human and as a cryptographer and he's also driving for

making this AOD less um a catastrophe and he was telling me that from a code point of view from a cryptographical point of view like it's like just a disaster and so I was wondering why um what do you feel is missing because actually I feel um being a little close to these kind of institutions that there is not bad intentions behind this behind this like very bad deployment or theory. Um I think for sure there is like lack of diversity in the in the team that then go to to to to deploy these systems and work on this these digital systems. But

um I'm wondering like for this this friend of mine Jar you know him uh he's a matter of it's a matter of lacking of meritocracy. Um and so given that I really feel that there is not bad intentions behind like let's build shitty systems so that we can rape all the the identities. I'm wondering what is for you lacking that what's missing um and why there are not like good cryptographers working on this and how do you feel we can manage to actually speak with these institutions and help out to build something more meaningful because I think that there are many good people there around and I think personally my take on this is that

um don't don't disturb me please uh I I personally feel that um thanks I got lost uh I personally feel that what's missing is um I I think I have a hypothesis on what's missing as well. So, um the EU commission actually do have a series of requirements and guidelines that um have like strong privacy requirements. For example, unlinkability. They themselves wrote it there. Um and so given already

um a list of privacy invariants, I think what was lacking was a systematic analysis of whether their solution violated or preserved these invariants. So like like I think we need an easy framework that can make it very very clear when they are in violation of a great um privacy and variance. So yeah, cuz there is really no way they can deny it um once they're shown an analysis that's laid out so clearly. And in fact, that's what happened. They ask for cryptographers feedback on their protocol and this consortium of cryptographers like just ripped it to

shreds. Um, so we need like to start with these privacy invariants and then we need a systematic way to analyze whether or not they're preserved. I think thank you. Other questions here. Oh, can we Hi. Can we change something? Can we complain to the commission in order to awareness for them to change this. That's what I've been wondering too. So um the cryptographers feedback is public and in response to that they are actively looking for other

solutions. So they are considering zero knowledge proofs um as a solution but uh I think the damage has been done in many ways. Um the reason I say this is that many other countries are following the EUI. Uh so I know for example the Taiwan digital ID wallet has chosen SD jets um and they're going to have the same unlinkability problem. So the question of like in Taiwan for example there's a very strong civil society. There are these groups that um make a lot of noise that can pressure the government that can raise awareness that can communicate to the public. Um and I think that's very powerful. In fact, um the first

iteration of the Taiwan ZK ID was the Taiwan digital ID was so unpopular that they had to like prematurely stop it and this is their second iteration. So I think yeah in countries with a strong civil society uh where the government can be pressured um by these groups it's absolutely worth it to raise awareness and to advocate for privacy. Yeah. Do do you know sorry um what the name of these groups have been? Yeah, there's like the O open culture foundation.

There's like uh well I can tell you offline. Yeah, there's a few uh Audrey Tang is a advocate for privacy in Taiwan as well. And also there are by the way agencies that audit other min audit ministries. So if we can get the auditors to change their guidelines and requests um then we force the ministries in that way to be compliant with these guidelines. Yeah. questions then I will I would ask this one like you're dealing with the government officials and as I said you're going through the maze of bureaucracy uh from

from this scene how um the so-called web free builds a language and mutual understanding with like government officials and how we should be build collaboration and where we should sort of like as a culture put heart no or had stopped because generally speaking this realization is about changing power dynamics also from the government. That's a good question. Um yeah, I think I was speaking with Audrey Tang a little bit. She has experience um sort of playing the game. uh she was an activist

and then she was sort of brought into the ministry of digital affairs as a reverse mentor. Um so it's a combination of understanding the processes of government for example like targeting the auditing agency um as well as educating the government officials like yeah communicating like at a high level what privacy and variance you have and what technologies you have um to achieve them. Um so my experience uh I've been just trying my best to um just integrate to meet them where they are to integrate

with like their existing APIs to demonstrate to them like how simple it is. Um yeah, a lot of it is about understanding that government projects operate on a really long time scale and they involve multiple layers of contractors and subcontractors. So uh I think always the principle is to keep it simple um and to remember like your objective is to get uh understanding um from the other party. Yeah.