Blockchain at the service of digital identity

A girl walks into a pub and asks for a beer; the bartender asks for her identity card to check that she is of age. That is how it works today — or at least, how it should work. There is a catch, though: an identity card is a document holding a great deal of information, and a sharp-eyed bartender can learn not only her age but also her name and her address, look her up on social media or, worse, find her at home.

The paradigm of self-sovereign identity (SSI) offers a way out of this problem, and it makes the advantages of a digital identity evident. In the new scenario the information held in the identity document is issued to the girl in digital form and stored on her smartphone (or wherever she prefers); the bartender can then ask her for a “proof” of her age, which she can produce through an app. The SSI system takes care of verifying that her declaration is true, and it does so without transmitting any information beyond what is strictly necessary — not even her age: transmitting only the proof of being over 18 is enough. All of this is possible thanks to sophisticated cryptographic techniques known as zero-knowledge proof (ZKP).

This new way of thinking is enjoying remarkable success. Data schemas and transfer protocols are already governed by some W3C standards, the body that oversees the development of the web led by Sir Tim Berners-Lee. Several implementations of those standards rest on distributed ledgers (typically blockchains) which hold no data but only the keys of the cryptographic algorithms that let the exchange of data happen in a way that cannot be tampered with.

The fact that no personal data is stored on the ledgers keeps the system consistent with the strictest reading of the GDPR. And there is more: the principal characteristic of blockchains is precisely the immutability and perpetual persistence of the data they hold; if we write personal information into them we expose ourselves to a significant risk, even when that information is encrypted with the most sophisticated algorithms — it is well known that quantum-computing processes capable of breaking present-day ciphers may come to exist, and when quantum computers reach sufficient power, perhaps only a few decades from now, any data stored on a blockchain today could be disclosed. The most sophisticated implementations of SSI address that risk as well.

A significant side effect is the guaranteed portability of one’s personal data, which resides in a digital wallet under its owner’s complete control. Whoever issues credentials can revoke them, and the holder is equally free to delete them, preventing their verification and any unauthorised use by third parties. Unlike what happens today, SSI makes profiling a person without their knowledge far harder, discouraging the trade in personal data.

The LinkedData.Center laboratories are engaged in developing the potential of SSI technologies, with a product line dedicated to automating customer due-diligence processes (KYC — Know Your Customer).

Figure: the verifiable-credential model developed in Mopso, from the source article.

Some of the technologies developed in Mopso have been made available to the SafeTogether project, an initiative that produced specifications and prototypes of digital tools to counter Covid-19. In particular the “Safe Together Shielding” system allows a “health cordon” of immune volunteers to be organised and managed safely, so that they can assist frail people, in line with what Prof. Udi Shapiro of the Weizmann Institute hoped for.

The use of “verifiable credentials” standards and of “zero-knowledge proof” algorithms protects the volunteers’ privacy: their condition can be verified without exposing the type and the results of the tests, and without having to demonstrate whether immunity was acquired through contact or thanks to a vaccine. The possibility of revoking certificates immediately is essential should the virus mutate or new clinical evidence require a new kind of attestation to be issued.

SafeTogether Shielding was built by volunteers and students in collaboration with the Politecnico di Milano, under the guidance of LinkedData.Center. The software is freely available on the g0v.it page, the civic-hacker community coordinated by the Copernicani association.

The SSI paradigm is a further piece that could enrich the potential of digital-identity instruments such as SPID, CIE and PEC, which will soon — one hopes — be available to all citizens. The European Community and the Italian Ministry for Economic Development are already working to define a common strategy on shared-ledger technologies; the Covid-19 emergency may, in conclusion, give a useful acceleration to a process that is in part already under way.