Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 subject areas, so bear with me as I try to explain my question.

I'm wondering whether it is/isn't viable to have something analogous to a public/private key infrastructure, such that the private key is the personal data that is being kept secret. This would also be analogous to symmetric crypto in that only the issuer (government/corporate) and the individual have the originals which are never actually used anywhere but are kept secret. Since the number only has to identify the individual (and is not sending some message that has to be decrypted) then it need only be verified by one of the 2 parties holding it. One could also add something analogous to a certification authority, although this would likely come down to implants of some sort which would be unpopular and I don't think they're necessary anyhow since the private info (SSN,DOB,etc) can be kept secret.

The goal is to minimize identity theft, although eradication would probably never happen. In this system, instead of writing down your DOB, SSN, credit card numbers, or whatever data is exclusive to some entity would instead be known only the 2 parties issuer and individual. Everyone else, when using that data, would get some public version of it, that can be replaced using another pin/password to encrypt it differently if it gets compromised. Some form of hash could also be used, since it needs only identify someone as authentic. So going to the grocery store or applying for college, someone would put down their hashed data and this could be verified within some national system as authentic, and used to identify the individual. This could be a vast improvement over the current system of simply using some number that is directly related to you such as SSN, DOB, or credit card number, and which can't (without serious difficulty and with poor propagation through the system) be changed.

Perhaps someone can point out the logical and/or logistical problems that would make this impractical.

share|improve this question
    
There's going to be an authority to most systems, whether you like it or not. That's why I said specifically here that the only 2 parties trusted are issuer and individual. But I can see how this could be a question in the security SE, even though this is really a matter of analogizing the current PKI to some hash or symmetric system for this specific purpose. More talking about a new public system, not necessarily unrelated to crypto. –  stackuser Dec 9 '13 at 18:54
add comment

migrated from crypto.stackexchange.com Dec 15 '13 at 22:18

This question came from our site for software developers, mathematicians and others interested in cryptography.

2 Answers

Something very similar to what you say already happens: eg driving licences. I prove my identity through possession of a birth certificate / passport, which is validated against a government database (Top level certificate?), and am then provided with a [possibly provisional] driving licence.

From this point on, at almost any time that I need to validate my identity I can do so by showing a driving licence.

For an even more general scheme (although at the moment I can't think of much that a passport isn't enough for?), the main problem seems to be finding an issuer everyone is happy with - many people here in the UK have an issue with the amount of data the government holds about them already. The idea of a single certification authority with access to even more detail than currently held would really worry civil liberties organisations.

Alternatively, perhaps you're discussing a less general scheme than a driving licence, in which case I suggest a 'company/student ID card' as an example? To do this, one uses a higher authority (passport&driving licence) to validate their identity to the company, who then issue a sub-certificate (company ID card) which henceforth they use as suitable proof that the person is indeed a member of staff.

share|improve this answer
    
No I'm talking about something analogous to PKI for individuals, and actually I'm not sure where you're getting this national ID card idea from but it doesn't sound like you're understanding the question. The system I'm talking about would allow numbers/data such as SSN to be kept secret while a public version is used. If that public version is compromised by theft, this can be re-issued using a new pin/password possibly as salt, or possibly even a mix of private data as salt. That's why this is more of a crypto question. This could be used by any issuer such as credit card companies, etc. –  stackuser Dec 9 '13 at 19:19
    
" So going to the grocery store or applying for college, someone would put down their hashed data and this could be verified within some national system as authentic, and used to identify the individual" - My driving licence validates who I am without me having to supply the cornershop with DNA etc, and they check it against a national database. I will freely admit I may have misunderstood you, but this seems to meet your requirements? (aside: removed my comment from question to keep it neat) –  figlesquidge Dec 9 '13 at 19:25
    
Yes I agree some possible implementations would look like that. But your DL will not be reissued with a new number if it gets stolen (not in the USA) you just get a new license, a copy of the original. As in my example, you apply for college using a hash of your SSN, DL, and credit card number as payment. If those are your numbers, then that hash should authenticate. Grocery shopping, your credit card scans with a hash of your credit number/pin into the store's database for payment/authentication. In your example, someone could steal your DL (with other data) and pretend to be you. –  stackuser Dec 9 '13 at 19:43
add comment

Turns out PKI in the classical (PKIX) sense is pretty hard to deploy unless you can control the client environment which is typically only an option in an enterprise. For regular users (private citizens) this gets tricky because the UI in most browsers for doing client certificates for TLS sucks royally.

Instead some alternatives are starting to crop up targeted at individuals. There is the fido alliance for instance with some interesting ideas. Unfortunately they are a very closed group. Fido tries to build a form of PKI-like set of protocols for using hw tokens to authenticate to websites. Fido is essentially an attempt to make "smartcards" deployable as consumer technology by radically changing the interfaces and moving the (usb) interface into the browser.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.