A Technical Overview of Digital Credentials Dr. Stefan Brands Credentica
[email protected] February 20, 2002 Abstract Applications that involve the electronic transfer of credentials, value tokens, profiles, and other sensitive information are quickly gaining momentum. Traditional attempts to introduce electronic authentication, such as PKI and biometric verification, expose organizations to po- tentially unlimited liability, lead to consumer fear, and stifle the adoption of new systems. To overcome these barriers, innovative solutions are needed that address the entire spectrum of security and privacy interests for all parties involved. This paper is a technical overview of Digital Credentials. Digital Credentials are the digital equivalent of paper documents, plastic tokens, and other tangible objects issued by trusted parties. At the same time, they are much more powerful than their physical counterparts. For example, individuals can selectively disclose properties of the data fields in their Digital Credentials while hiding any other information. Digital Credentials also provide much greater security. As a result, they can be used to securely implement objects that traditionally are made identifiable in order to deal with certain kinds of fraud. Examples are diplomas, work permits, access cards, and drivers’ licenses. 1 Introduction Around the world, influential organizations are rushing to provide individuals with digital identity certificates that will be the sole means of participating in their systems. Among the front-runners are telecommunication organizations, health care providers, mobile service providers, financial institutions, and state and federal governments. A digital identity certificate is just a sequence of zeros and ones, and so it can be transferred electronically and can be verified with 100 percent accuracy by computers.