I found the following definition here :

From a privacy perspective a better solution would be the use of attribute-based authentication (Goyal et al. 2006) which allows access of online services based on the attributes of users, for example their friends, nationality, age etc

But it's not very clear to me, so:

  1. What is attribute-based authentication?
  2. What are its advantages?
  3. How can it enhance privacy protection while online?
  • Looks like a typo as it should read attribute-based authorization since one cannot have attributes until they've identified who they are via authentication. Possible duplicate: security.stackexchange.com/questions/56844/… Apr 15 '16 at 2:27
  • 1
    When I do a Google search for "attribute-based authentication", I get a lot of high quality hits. It would help if you could tell us what research you've done so that we don't end up repeating what you're already read (and what others have said with authority).
    – schroeder
    Apr 15 '16 at 5:00

What is attribute-based authentication?

Attribute based authentication is a way of "minimal disclosure" authentication in that (at least in theory) it's only checked whether you have some attribute, rather than "who you are". This means that if a website requires you to have a certain age authentication will only leak your age, but not your identity.

This goes further in advanced systems which allow for predicates to be tested (i.e. 'age > 18') which means that even less information is leaked because now the website knows you're older than 18 but it's not leaked how old exactly.

In trivial systems you could just have somebody sign your attributes and then the website verifies the signature of your attributes. However, the problem with that is that if you try to authenticate twice you can be fingerprinted because if you just send your age signed then if you do it again you'll send the exact same content (signature is still the same) so the website knows it's the same person. Advanced systems don't do that as they create a new temporary pseudonym for each authentication which makes it impossible to fingerprint the person who tries to authenticate.

If you want to find out more you should read about 'privacy-preserving attribute-based credentials' and look into cryptoengines like UProve (Microsoft) and Idemix (IBM).

What are its advantages?


  • Minimum disclosure
  • Not linkable (you can authenticate twice without anybody knowing it's you again)
  • Decentralized (you're in possession of your attributes)

However, not all attribute-based authentication schemes necessarily fulfill this. You could for example have an authentication provider and the website you try to authenticate to contacts that provider and asks whether you are older than 18. This however leaks information to the authentication provider about what websites you visit so in practice a scheme that is not decentralized isn't exactly good for your privacy.

How can it enhance privacy protection while online?

Same deal. In privacy-preserving attribute based credentials/authentication you are 100% anonymous (excluding of course that you leak your IP and things like that) and not linkable and only leak the minimum amount of information required and it can be done offline.

The funny thing is that once they started developing this they faced the problem that users are now 100% anonymous and in some contexts you're required to be able to tell the government who used your service so effort had to be spent to develop backdoors that leak information about you.

There are also issues with revocation. Some systems thus require also proof that your credentials have not be revoked yet. But anyway... in THEORY privacy-preserving attribute based credentials/authentication are really good for privacy but they have drawbacks (revocation / DE-anonymization for legal purposes) and more user interaction. A website for example might just ask for "everything" and if the user doesn't intervene they will leak everything so software has to display to the user what is being leaked and the user has to confirm it which means these systems require much more from the user which is a huge problem for your average user.

Also... you need additional architecture... such as an issuer a revocation authority an inspection authority you need a crypto engine you need storage for the credentials which are all things that don't really make it practical for web-based authentication YET unless you're willing to install a browser plugin... you need to synchronize your credentials somehow (for example to be able to login in from your tablet, phone and PC) which means you also need software to synchronized your credentials etc... In theory the technology is great... in practice it's just not there YET and maybe it will have the same fate as PGP: it'll be considered to cumbersome/difficult for your average user to manage. A centralized system will surely be accepted but you lose out on privacy.


Attribute based authentication implies that when a user or entity acquires certain attributes, like belonging to a team, that in itself is enough information about the entity to authenticate the user.

Lets say you work in a corporate environment and all employees at your work-place have SSO based access-controls in place.

Some sensitive market-surveys and case-studies are protected behind a bastion host. Your SSO does not authenticate you into this bastion host since the rest of the attributes that its looking for are not a part of your SSO profile. Now suppose you join the customer-facing technical-marketing team. One of your profile attributes changes. That is, your team changed from "Engineering" to "Marketing".

Now this attribute match is enough for you to be authenticated into the bastion host and then get authorized to perform reads on the sensitive data.

Does that make sense ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.