Investigating Anonymity in Group Based Anonymous Authentication

In this paper we discuss anonymity in context of group based anonymous authentication (

$\mathcal{GBAA}$

). Methods for

$\mathcal{GBAA}$

provide mechanisms such that a user is able to prove membership in a group

$\mathcal{U}'\subseteq\mathcal{U}$

of authorized users

$\mathcal{U}$

to a verifier, whereas the verifier does not obtain any information on the actual identity of the authenticating user. They can be used in addition to anonymous communication channels in order to enhance user’s privacy if access to services is limited to authorized users, e.g. subscription-based services. We especially focus on attacks against the anonymity of authenticating users which can be mounted by an external adversary or a passive verifier when

$\mathcal{GBAA}$

is treated as a black box. In particular, we investigate what an adversary can learn by solely observing anonymity sets

$\mathcal{U}'$

used for

$\mathcal{GBAA}$

and how users can choose their anonymity sets in case of

$\mathcal{U}'\subset\mathcal{U}$

. Based on the information which can be obtained by adversaries we show that the probability of user identification can be improved.