SSI, from specifications to protocol? : Formally verify security!

Braun, Christoph H.-J. and Horne, Ross and Käfer, Tobias and Mauw, Sjouke; (2024) SSI, from specifications to protocol? : Formally verify security! In: WWW '24: Proceedings of the ACM on Web Conference 2024. ACM, Singapore, 1620–1631. ISBN 9798400701719 (https://doi.org/10.1145/3589334.3645426)

[thumbnail of Braun-etal-ACM-2024-SSI-from-specifications-to-protocol]
Preview
 Text. Filename: Braun-etal-ACM-2024-SSI-from-specifications-to-protocol.pdf
Final Published Version
License: Creative Commons Attribution-NonCommercial-ShareAlike 4.0 logo
Download (1MB)| Preview

Abstract

We evaluate a bundle of specifications from the Self-Sovereign Identity (SSI) paradigm to construct an authentication protocol for the Web. We demonstrate how relevant standards such as W3C Verifiable Credentials (VC), W3C Decentralised Identifiers (DIDs), and components of the Hyperledger Aries Framework are to be assembled methodologically into a protocol. We make those assumptions from standard trust models explicit that underlie the derived protocol, and verify security and privacy properties, notably secrecy, authentication, and unlinkability. This enables us to formally justify the additional precision that we urge these specifications to consider, to ensure that implementors of SSI-based systems do not neglect security-critical controls.

ORCID iDs

Braun, Christoph H.-J., Horne, Ross ORCID logoORCID: https://orcid.org/0000-0003-0162-1901, Käfer, Tobias and Mauw, Sjouke;
CORE (COnnecting REpositories)