<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi all,</div><div class=""><br class=""></div><div class="">As part of research on remote identity proofing, we have come up with</div><div class="">the concept of a "rich credential": an enhanced cryptographic</div><div class="">credential that allows a subject to identify him/herself to a remote</div><div class="">verifier by proving possession of a private key, knowledge of a</div><div class="">password, and possession of one or more biometric features, without a</div><div class="">prior relationship between the subject and the verifier, with</div><div class="">biometric spoofing detection by the verifier. The concept is</div><div class="">described in <a href="https://pomcor.com/2016/10/18/rich-credentials-for-three-factor-identity-verification-without-prior-relationship/" class="">this blog post</a> and <a href="https://pomcor.com/techreports/RichCredentials.pdf" class="">this paper</a>.</div><div class=""><br class=""></div><div class="">A rich credential is based on the same simple cryptographic primitives</div><div class="">as a traditional public key certificate: a certified key pair, a hash</div><div class="">function, and a digital signature by the issuer. Yet it provides</div><div class="">unusual privacy features: selective disclosure of subject attributes</div><div class="">(as provided by anonymous credentials, but without unlinkability) and</div><div class="">selective presentation of verification factors.</div><div class=""><br class=""></div><div class="">The privacy features are achieved by means of a "typed hash tree", a</div><div class="">variation on a traditional hash tree that provides "omission-tolerant</div><div class="">integrity protection". The paper includes a proof that a typed hash</div><div class="">tree can be used to represent a multiset of key-value pairs, in a way</div><div class="">that allows key-value pairs to be removed, but not added, without</div><div class="">modifying the root label.</div><div class=""><br class=""></div><div class="">While working out the proof we ran into the problem of how to</div><div class="">formalize the security properties of an unkeyed, or keyless, hash</div><div class="">function. We worked around the difficulty by first formally proving a</div><div class="">result that relates the "addition intolerance" of a typed hash tree to</div><div class="">the structure of the tree without reference to any security</div><div class="">properties, then informally justifying corollaries based on security</div><div class="">properties that we do not define formally, including "collision</div><div class="">resistance", and either "cross-collision resistance" between two hash</div><div class="">functions or "preimage resistance of a hash function relative to a</div><div class="">random or pseudo-random number generator" (depending on how salts in</div><div class="">the tree are generated).</div><div class=""><br class=""></div><div class="">Cross-collision resistance is formalized in the online draft of Boneh</div><div class="">and Shoup’s <a href="https://crypto.stanford.edu/~dabo/cryptobook/draft_0_2.pdf" class="">Graduate Course in Applied Cryptography</a> (Section 8.1) in</div><div class="">terms of their concept of a "system parameterization" (Definition</div><div class="">2.9). I believe the concepts of "cross-collision resistance" and</div><div class="">"relative preimage resistance" are new. It should be possible to</div><div class="">formalize them as well using the same concept of system</div><div class="">parameterization. We hope to be able to do that in the future, then</div><div class="">formally prove the corollaries, unless somebody beats us to it :-)</div><div class=""><br class=""></div><div class="">Comments on any of this would be appreciated. If anybody makes the</div><div class="">effort to check the proof of Theorem 1 (Section 5.4.3), beers will be</div><div class="">on us the next time we meet :-)</div><div class=""><br class=""></div><div class="">Francisco</div><div class=""><br class=""></div><div class=""><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>