Building Privacy-Preserving Cryptographic Credentials from Federated Online Identities

John Maheswaran, Daniel Jackowitz, Ennan Zhai
Yale University

David Isaac Wolinsky

Bryan Ford
Swiss Federal Institute of Technology (EPFL)

6th ACM Conference on Data and Application Security and Privacy (CODASPY)
New Orleands, LA, March 2016


Federated identity providers, e.g., Facebook and PayPal, offer a convenient means for authenticating users to third-party applications. Unfortunately such cross-site authentications carry privacy and tracking risks. For example, federated identity providers can learn what applications users are accessing; meanwhile, the applications can know the users’ identities in reality.

This paper presents Crypto-Book, an anonymizing layer enabling federated identity authentications while preventing these risks. Crypto-Book uses a set of independently managed servers that employ a (t,n)-threshold cryptosystem to collectively assign credentials to each federated identity (in the form of either a public/private key-pair or blinded signed messages). With the credentials in hand, clients can then leverage anonymous authentication techniques such as linkable ring signatures or partially blind signatures to log into third-party applications in an anonymous yet accountable way.

We have implemented a prototype of Crypto-Book and demonstrated its use with three applications: a Wiki system, an anonymous group communication system, and a whistleblower submission system. Crypto-Book is practical and has low overhead: in a deployment within our research group, Crypto-Book group authentication took 1.607s end-to-end, an overhead of 1.2s compared to traditional non-privacy-preserving federated authentication.

Paper: PDF


This work is supported in part by NSF grants CNS-1407454 and CNS-1409599.