Are you old enough to buy this? (Zero-knowledge age restriction with GNU Taler)
Today, age verification in e-commerce implies identity verification, one way or the other. In this talk, we first look at existing solutions for age restriction and their shortcomings. We then present a design for a privacy-friendly method that binds age restriction to the ability to pay (rather than identification) and that is aligned with the [principle of subsidiarity](https://en.wikipedia.org/wiki/Subsidiarity). We show how this scheme is integrated with the [GNU Taler](https://taler.net) payment system, making it the first fully privacy-friendly payment system with age restriction.
Privacy in e-commerce is currently a sad story, especially with respect to age-restriction and -verification. Existing commercial solutions are mostly implemented by identity verification. Even privacy-friendly approaches, using attribute-based credentials, anchor on an external, higher authority which verifies the identity of the consumer before issuing a certificate.
The [principle of subsidiarity](https://en.wikipedia.org/wiki/Subsidiarity) suggests that the appropriate level of authority to set age restriction is the level of parents and caretakers - not merchants, banks or governmental institutions. Our design for an age verification scheme fully aligns with this principle.
The design is presented as an extension of [GNU Taler](https://taler.net), a privacy-friendly payment protocol. The extension augments the protocol with a zero-knowledge scheme for age verification that cryptographically augments coins for this purpose. Our scheme enables buyers to prove to be of sufficient age for a particular transaction without disclosing the age. The modification preserves the privacy and security properties of GNU Taler, in particular the anonymity of buyers and unlinkability of transactions.
We show how our scheme can be instantiated with various cryptographic signature schemes, how it is integrated with the GNU Taler payment system and what work is left to do.
This work is funded by the project [_Concrete Contracts_](https://concretecontracts.codeblau.de) by the [German Federal Ministry of Education and Research](https://www.forschung-it-sicherheit-kommunikationssysteme.de/projekte/concrete-contracts).
Additional information
| Live Stream | https://streaming.media.ccc.de/jev22/hip1 |
|---|---|
| Type | Talk/panel 45 min + 10 min Q&A (55 Minuten) |
| Language | English |
More sessions
| 12/27/22 |
We'll look at the role IT and software play in modern manufacturing, with a twist on the semiconductor industry. Since I'm a security guy, we'll mostly focus on the sorry state of that.
|
| 12/27/22 |
Das US-Militär hat massenhaft Geräte zur biometrischen Erfassung von Menschen in Afghanistan genutzt. Einige Geräte wurden beim hastigen Abzug der NATO-Truppen zurückgelassen. Wir haben bei Analysen solcher Geräte große Mengen an biometrischen und weiteren personenbezogenen Daten gefunden. In den falschen Händen bedeuten diese Daten Lebensgefahr für Menschen in Afghanistan und Irak.
|
| 12/27/22 |
Nazis, Querdenken und andere verschwörungsideologische Aufmärsche - welche Möglichkeiten gibt es, in Einklang mit Versammlungsgesetzen und in Verhandlungen mit Polizei und Versammlungsbehörden legal zu blockieren? Ein How-To aus den Erfahrungen bei @QuerstellenDD.
|
| 12/27/22 |
In IT security we have been preoccupied with failures, with things that go wrong, and so we count the negatives -- the times when we failed. How about we seriously started counting the positives? More importantly, what if by adding more and more constraints to avoid the holes we have found, we are also removing the positive capacities in the system, thereby hurting our chance of success more than we hurt our chance of failure? In this talk, I will try to highlight how IT security could be done ...
|
| 12/27/22 |
The C programming language first appeared in 1972 and became enormously popular. It has this magical combination of features that allows developers to quickly write portable code that can be reused and easily ported to different architectures. It has been the foundation of most operating systems and systems programming in the past 50 years.
|
| 12/27/22 |
The "Enhanced Border Security Partnership" poses an unprecedented threat to civil liberties in Europe.
|
| 12/27/22 |
We summarize howto secure Kubernetes clusters in critical infrastructure and give insights from the machine rooms.
|
