Using public key infrastructure or hashing for personal identification privacy?

Question

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 subject areas, so bear with me as I try to explain my question.

I'm wondering whether it is/isn't viable to have something analogous to a public/private key infrastructure, such that the private key is the personal data that is being kept secret. This would also be analogous to symmetric crypto in that only the issuer (government/corporate) and the individual have the originals which are never actually used anywhere but are kept secret. Since the number only has to identify the individual (and is not sending some message that has to be decrypted) then it need only be verified by one of the 2 parties holding it. One could also add something analogous to a certification authority, although this would likely come down to implants of some sort which would be unpopular and I don't think they're necessary anyhow since the private info (SSN,DOB,etc) can be kept secret.

The goal is to minimize identity theft, although eradication would probably never happen. In this system, instead of writing down your DOB, SSN, credit card numbers, or whatever data is exclusive to some entity would instead be known only the 2 parties issuer and individual. Everyone else, when using that data, would get some public version of it, that can be replaced using another pin/password to encrypt it differently if it gets compromised. Some form of hash could also be used, since it needs only identify someone as authentic. So going to the grocery store or applying for college, someone would put down their hashed data and this could be verified within some national system as authentic, and used to identify the individual. This could be a vast improvement over the current system of simply using some number that is directly related to you such as SSN, DOB, or credit card number, and which can't (without serious difficulty and with poor propagation through the system) be changed.

Perhaps someone can point out the logical and/or logistical problems that would make this impractical.

Answer 1

Something very similar to what you say already happens: eg driving licences. I prove my identity through possession of a birth certificate / passport, which is validated against a government database (Top level certificate?), and am then provided with a [possibly provisional] driving licence.

From this point on, at almost any time that I need to validate my identity I can do so by showing a driving licence.

For an even more general scheme (although at the moment I can't think of much that a passport isn't enough for?), the main problem seems to be finding an issuer everyone is happy with - many people here in the UK have an issue with the amount of data the government holds about them already. The idea of a single certification authority with access to even more detail than currently held would really worry civil liberties organisations.

Alternatively, perhaps you're discussing a less general scheme than a driving licence, in which case I suggest a 'company/student ID card' as an example? To do this, one uses a higher authority (passport&driving licence) to validate their identity to the company, who then issue a sub-certificate (company ID card) which henceforth they use as suitable proof that the person is indeed a member of staff.

Answer 2

Turns out PKI in the classical (PKIX) sense is pretty hard to deploy unless you can control the client environment which is typically only an option in an enterprise. For regular users (private citizens) this gets tricky because the UI in most browsers for doing client certificates for TLS sucks royally.

Instead some alternatives are starting to crop up targeted at individuals. There is the fido alliance for instance with some interesting ideas. Unfortunately they are a very closed group. Fido tries to build a form of PKI-like set of protocols for using hw tokens to authenticate to websites. Fido is essentially an attempt to make "smartcards" deployable as consumer technology by radically changing the interfaces and moving the (usb) interface into the browser.