NODE e47b0447Re: anonymous age credentials, sharing of
gw <geeman@best.com>Fri, 16 Feb 1996 05:07:59 +0800
At 02:38 PM 2/14/96 -0500, you wrote:
>Suppose Alice is a CA who issues anonymous age credentials.
>Bob is 15
>Carol is 25
>
>Carol gets a legitimate anonymous age credential from Alice bound to an
>anonymous public key generated for this purpose. Carol then gives the
>key pair to Bob. Bob uses to do things only adults are legally permitted
>to do. (It's not bound to Carol's everday keypair because that's not
>anonymous....)
>
>What can stop Bob and Carol from subverting a scheme that relies on
>anonymous age creditials in this manner?
>
>If the answer is "nothing" this might mean that purveyors of "adult"
>material might have no defense against a law requiring that they collect a
>True Name + age creditential....
>
>A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
>Associate Professor of Law |
>U. Miami School of Law | froomkin@law.miami.edu
>P.O. Box 248087 | http://www.law.miami.edu/~froomkin
>Coral Gables, FL 33124 USA | It's warm here.
>
>
I believe the answer is nothing ... but the situation is no different than
Carol going into Le Sexxey Shoppey, buying a porn-pack of restricted
material, and then giving it to Bob.
As has been said in this forum and others before, in the limit all access
control comes down to positive identification of an individual. Unless We,
the People, want to support permanently binding a traceable, non-anonymous
identity to all certificate attributes that are used in electronic exchange
(age, etc...) then there is going to be the potential for someone to
deliberately allow their credential to be misused.
IMO, to prevent this totally would require implanting a non-forgable i.d.
chip in everyone at birth ..... not very appealing.
NODE 6074688dRe: anonymous age credentials, sharing of
"Rev. Ben" <samman-ben@CS.YALE.EDU>Fri, 16 Feb 1996 17:41:17 +0800
On Thu, 15 Feb 1996, gw wrote:
> the People, want to support permanently binding a traceable, non-anonymous
> identity to all certificate attributes that are used in electronic exchange
> (age, etc...) then there is going to be the potential for someone to
> deliberately allow their credential to be misused.
>
> IMO, to prevent this totally would require implanting a non-forgable i.d.
> chip in everyone at birth ..... not very appealing.
And even then, what about the people that undergo surgery to swap chips?
The only REAL way of authentication is biometrics. Anything else can be
swapped. But if you amputate someone's hand or retinas then they won't
work(check for things like blood flow, etc.)
Ben.
____
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then
I will never know happiness. For I am possessed by a fever for knowledge,
experience, and creation." -Anais Nin
PGP Encrypted Mail Welcomed Finger samman@powered.cs.yale.edu for key
Want to give a soon-to-be college grad a job? Mail me for a resume