EL PASSO: Efficient and Lightweight Privacy-preserving Single Sign On

Abstract

Anonymous credentials are a solid foundation for privacy-preserving Single Sign-On (SSO). They enable unlinkable authentication across domains and allow users to prove their identity without revealing more than necessary. Unfortunately, anonymous credentials schemes remain difficult to use and complex to deploy. They require installation and use of complex software at the user side, suffer from poor performance, and do not support security features that are now common, such as two-factor authentication, secret recovery, or support for multiple devices. In contrast, Open ID Connect (OIDC), the de facto standard for SSO is widely deployed and used despite its lack of concern for users’ privacy. We present EL PASSO, a privacy-preserving SSO system based on anonymous credentials that does not trade security for usability, and can be incrementally deployed at scale alongside Open ID Connect with no significant changes to end-user operations. EL PASSO client-side operations leverage a WebAssembly module that can be downloaded on the fly and cached by users’ browsers, requiring no prior software installation or specific hardware. We develop automated procedures for managing cryptographic material, supporting multi-device support, secret recovery, and privacy-preserving two-factor authentication using only the built-in features of common Web browsers. Our implementation using PS Signatures achieves 39x to 180x lower computational cost than previous anonymous credentials schemes, similar or lower sign-on latency than Open ID Connect and is amenable for use on mobile devices.

UPPRESSO: Untraceable and Unlinkable Privacy-PREserving Single Sign-On Services

“…Certified RP-Verified Credential. A user of EL PASSO [13] keeps a secret on his device. After authenticating the user, the trusted IdP issues a certified credential binding the secret, also kept on the user's device.…”

“…Then, the user proves to the RP that he owns this secret to login. These RP-verified credentials protect user privacy well and two kinds of privacy threats are prevented [13,15,16], but the user has to by himself locally manage pseudonyms for different RPs. For example, the domain of an RP is used as a factor to generate the user's account (or pseudonym) at this RP.…”

“…Although EL PASSO calls itself an SSO scheme [13] and the service signing tokens or credentials in EL PASSO, Un-limitID and PseudoID is also called the IdP [13,15,16], there are some authentication steps between the user and RPs. Therefore, in EL PASSO, UnlimitID or PseudoID, a user needs to notify each RP if a credential was lost or compromised, because the user is authenticated by the RP with his credentials to prove that he owns the long-term secret.…”

True2F: Backdoor-Resistant Authentication Tokens

“…However, neither prevents colluding relying parties from linking a user's accounts across relying parties. EL PASSO [90], UnlimitID [53], UPRESSO [50], PseudoID [29] and Hammann et al [51] show how to build single sign-on services that protect clients from curious identity providers while ensuring that relying parties cannot link users' accounts.…”

Hidden Issuer Anonymous Credential

“…SSI frameworks allow for versatile, user-centric, privacypreserving IMSs. Many SSI implementations have appeared in recent years, from EL PASSO [3] to the more decentralized Sovrin implementation [4,5]. Most of them protect privacy by relying on a cryptographic primitive known as Anonymous Credential (AC).…”