In this paper we present reclaimID: An architecture that allows users to reclaim their digital identities by securely sharing identity attributes without the need for a centralised service provider. We propose a design where user attributes are stored in and shared over a name system under user-owned namespaces. Attributes are encrypted using attribute-based encryption (ABE), allowing the user to selectively authorize and revoke access of requesting parties to subsets of his attributes. We present an implementation based on the decentralised GNU Name System (GNS) in combination with ciphertext-policy ABE using type-1 pairings. To show the practicality of our implementation, we carried out experimental evaluations of selected implementation aspects including attribute resolution performance. Finally, we show that our design can be used as a standard OpenID Connect Identity Provider allowing our implementation to be integrated into standard-compliant services.
DP5 @cite_3 is a privacy-friendly presence notification service that through the use of asymmetric pairing functions and pseudo-random functions provides a secure and private personal information retrieval (PIR). While DP5 addresses the most relevant privacy and security issues, it does not address availability as does with a redundant DHT. A powerful attacker might coerce a DP5 service provider to discontinue its services without having to deal with any of the users trying to share information. Participants in are not individually protected against such an attack, but the lack of central service instances mitigates the collapse of the whole system.
@cite_3
2242794960
Users of social applications like to be notified when their friends are online. Typically, this is done by a central server keeping track of who is online and offline, as well as of all of the users' "buddy lists", which contain sensi- tive information. We present DP5, a cryptographic service that implements online presence indication in a privacy-friendly way. DP5 allows clients to register their online presence and query the presence of their list of friends while keeping this list secret. Besides presence, high-integrity status updates are supported, to facilitate key update and rendezvous protocols. While infrastructure services are required for DP5 to operate, they are designed to not require any long-term secrets and pro- vide perfect forward secrecy in case of compromise. We pro- vide security arguments for the indistinguishability properties of the protocol, as well as an evaluation of its scalability and performance.