[论文解读] Bringing data minimization to digital wallets at scale with general-purpose zero-knowledge proofs

Matthias Babel, Johannes Sedlmeir|arXiv (Cornell University)|Jan 2, 2023

Cryptography and Data Security被引用 16

一句话总结

本论文证明通用目的的 zk-SNARKs 能实现可扩展的数据最小化的匿名凭证用于自我主权身份（SSI），在移动设备上展示了实际性能，并概述了如私有撤销、凭证连锁和指定验证者呈现等优势。

ABSTRACT

Today, digital identity management for individuals is either inconvenient and error-prone or creates undesirable lock-in effects and violates privacy and security expectations. These shortcomings inhibit the digital transformation in general and seem particularly concerning in the context of novel applications such as access control for decentralized autonomous organizations and identification in the Metaverse. Decentralized or self-sovereign identity (SSI) aims to offer a solution to this dilemma by empowering individuals to manage their digital identity through machine-verifiable attestations stored in a "digital wallet" application on their edge devices. However, when presented to a relying party, these attestations typically reveal more attributes than required and allow tracking end users' activities. Several academic works and practical solutions exist to reduce or avoid such excessive information disclosure, from simple selective disclosure to data-minimizing anonymous credentials based on zero-knowledge proofs (ZKPs). We first demonstrate that the SSI solutions that are currently built with anonymous credentials still lack essential features such as scalable revocation, certificate chaining, and integration with secure elements. We then argue that general-purpose ZKPs in the form of zk-SNARKs can appropriately address these pressing challenges. We describe our implementation and conduct performance tests on different edge devices to illustrate that the performance of zk-SNARK-based anonymous credentials is already practical. We also discuss further advantages that general-purpose ZKPs can easily provide for digital wallets, for instance, to create "designated verifier presentations" that facilitate new design options for digital identity infrastructures that previously were not accessible because of the threat of man-in-the-middle attacks.

研究动机与目标

• 在 SSI 和数字钱包中阐明隐私保护、数据最小化的数字身份的需求。
• 评估在大规模、受监管环境中当前匿名凭证方法的局限性。
• 提出基于一般用途零知识证明的匿名凭证设计，以解决撤销、硬件绑定和可串联性。
• 展示在边缘设备上的实际性能并讨论部署考虑因素。

提出的方法

• 采用零知识简洁非互动证明（zk-SNARKs）实现匿名凭证。
• 使用通用验证器/证明工作流，持有者在不暴露输入的情况下证明凭证验证的正确执行。
• 在 Circom 中实现电路并转换为 Groth16 风格证明系统的 R1CS 表示。
• 讨论可信设置的考虑（CRS），并与通用或透明 zk-SNARK 变体进行比较。
• 提供性能分析，显示移动钱包部署的可行性。

Figure 1 : Issuance and verification of a credential using general-purpose ZKPs .

实验结果

研究问题

• RQ1 通用目的的 zk-SNARKs 是否能够在大规模下支持适用于 SSI 的数据最小化匿名凭证？
• RQ2 在典型的边缘设备（如智能手机）上，基于 zk-SNARK 的匿名凭证的实际性能如何？
• RQ3 在此框架内，如何实现私有撤销、凭证连锁和硬件绑定等特性？
• RQ4 指定验证者呈现（designated verifier presentations）在降低隐私风险方面的收益与权衡是什么？

主要发现

• 性能测试表明在移动电话上部署基于 zk-SNARK 的凭证具有实际可行性。
• zk-SNARKs 使匿名凭证系统中的私有撤销、凭证连锁和硬件绑定成为可能。
• 指定验证者呈现通过将可验证性限定给指定的验证者来帮助解决安全与隐私问题。
• 通用的 ZKPs 促进可定制的谓词和数据最小化发行，超越手工设计的原语。
• 该方法将 SSI 要求与密码学灵活性结合，提高可审计性并与现有身份基础设施集成。

Figure 2 : Example workflow for generating the zk-SNARK proving and verification program in the case of the Groth16 proof system. These programs need to be integrated into the wallet app and verification backend, respectively.