Information Technology Reference
In-Depth Information
Unique User-Generated Digital Pseudonyms
Peter Schartner and Martin Schaffer
University of Klagenfurt, Austria,
Computer Science
ยท
System Security Group
{
p.schartner, m.schaffer
}
@syssec.at
Abstract.
This paper presents a method to generate unique and never-
theless highly random pseudonyms in a distributed environment. More
precisely, each user can now generate his pseudonym locally in his per-
sonal security environment, e.g. in his smart card or his personal digital
assistant. There is no need for any information interchange between is-
suing parties or global data (especially keys), except unique identifiers
for each user and each device of the system. Additionally the holder can
prove, that he generated a specific pseudonym without revealing his iden-
tity and he can reveal his identity by disclosing the pseudonym. Whereas
the verifier of a disclosed pseudonym can be sure, that the presenter of
the pseudonym is the holder of the pseudonym (i.e. the person which
originally generated it). The identifier of the user and the identifier of
the user's device will be used to generate unique pseudonyms, but to
ensure pseudonymity, both components will be stored in the pseudonym
in encrypted form.
1
Introduction
Pseudonyms (or nyms) are identifiers of subjects. The subject that may be iden-
tified by the pseudonym is the holder of the pseudonym (see [7,9]). From the
technical point of view, a pseudonym is a bit string which is
-
(locally or globally) unique as identifier and
-
suitable to be used to authenticate the holder and his/her data (e.g. messages
sent).
Most of the applications of pseudonyms have in common, that there should be
no way to correlate data (of the pseudonym) stored in different applications or
to link these data to the holder of the pseudonym and his identity. So another
important aspect in the scope of pseudonyms is linkability, i.e. the knowledge of
the relationship between the holder and his/her pseudonym. This linking may
be known to third parties or only to the holder of the pseudonym.
Up to date, there are two ways to generate globally unique pseudonyms for
a person (here called holder):
Centralized Generation:
This approach employs a centralized third party,
which generates the pseudonym on the user's behalf. This party can easily avoid
duplicates and hence the generated pseudonyms are unique. On a larger scale, we
