While decentralized identity promises to give users greater control over their private data, it burdens users with management of private keys, creating a significant risk of key loss. Existing and proposed approaches also presume the spontaneous availability of a credential-issuance ecosystem, creating a bootstrapping problem. They also omit essential functionality, like resistance to Sybil attacks and the ability to detect misbehaving or sanctioned users while preserving user privacy.
CanDID addresses these challenges by issuing credentials in a user-friendly way that draws securely and privately on data from existing, unmodified web service providers. Such legacy compatibility similarly enables CanDID users to leverage their existing online accounts for recovery of lost keys. Using a decentralized committee of nodes, CanDID provides strong confidentiality for user's keys, real-world identities, and data, yet prevents users from spawning multiple identities and allows identification (and blacklisting) of sanctioned users.
We present the CanDID architecture and its technical innovations and report on experiments demonstrating its practical performance.
Category / Keywords: applications / decentralized identity, distributed cryptography, Sybil-resistance Date: received 29 Jul 2020, last revised 28 Sep 2020 Contact author: sm2686 at cornell edu Available format(s): PDF | BibTeX Citation Note: Revised version. Version: 20200928:150626 (All versions of this report) Short URL: ia.cr/2020/934