Candid: Can-do decentralized identity with legacy compatibility, sybil-resistance, and accountability
发表信息
作者
- Deepak Maram
- Harjasleen Malvai
- Fan Zhang
- Nerla Jean-Louis
- Alexander Frolov
- Tyler Kell
- Tyrone Lobban
- Christine Moy
- Ari Juels
- Andrew Miller
笔记
We present CanDID, a platform for practical, user-friendly realization of decentralized identity, the idea of empowering end users with management of their own credentials.While decentralized identity promises to give users greater control over their private data, it burdens users with management of private keys, creating a significant risk of key loss. Existing and proposed approaches also presume the spontaneous availability of a credential-issuance ecosystem, creating a bootstrapping problem. They also omit essential functionality, like resistance to Sybil attacks and the ability to detect misbehaving or sanctioned users while preserving user privacy.CanDID addresses these challenges by issuing credentials in a user-friendly way that draws securely and privately on data from existing, unmodified web service providers. Such legacy compatibility similarly enables CanDID users to leverage their existing online accounts for recovery of lost keys. Using a decentralized committee of nodes, CanDID provides strong confidentiality for user’s keys, real-world identities, and data, yet prevents users from spawning multiple identities and allows identification (and blacklisting) of sanctioned users.We present the CanDID architecture and report on experiments demonstrating its practical performance.
我们提出了CanDID，这是一个用于实现去中心化身份的实用、用户友好的平台，旨在赋予终端用户管理自己凭证的能力。虽然去中心化身份承诺给予用户对其私人数据更大的控制权，但它也让用户承担了管理私钥的负担，这造成了重大的密钥丢失风险。现有和提议的方案还假定凭证发行生态系统能够自发形成，这造成了引导问题。它们也忽略了一些基本功能，比如防止女巫攻击和在保护用户隐私的同时能够检测不当行为或受制裁用户的能力。
CanDID通过以用户友好的方式发放凭证来解决这些挑战，该方式安全且私密地利用来自现有、未经修改的网络服务提供商的数据。这种遗留系统兼容性同样使CanDID用户能够利用其现有的在线账户来恢复丢失的密钥。通过去中心化的节点委员会，CanDID为用户的密钥、现实世界身份和数据提供了强大的保密性，同时防止用户创建多重身份，并允许识别（和拉黑）受制裁的用户。我们介绍了CanDID的架构，并报告了证明其实际性能的实验结果。