A EU Regulation from 2019 aims to achieve a minimal degree of interoperability of personal identity documents in Europe (eID). In particular, eID document verification should be performed according to ICAO protocols, including biometric verification. At the same time, additional functionalities implemented by the Member States must not interfere with the obligatory ICAO part. As presenting personal data from an eID requires an explicit consent of the eID owner, PACE - a password authenticated key exchange (PAKE) protocol, the core part of the ICAO specification - must be used. A side effect of the EU Regulation are problems regarding already deployed additional functionalities, such as digital signatures. In this paper we present a pragmatic approach for solving this problem. Instead of installing these functionalities independently - e.g. at a cost of extra code on the eID chip and potential compatibility problems - we may reuse the basic ICAO protocols. As an example of this approach we show a proof-of-presence protocol derived from PACE.

A recent CSCML'2020 paper by Dolev and Liber presents a low cost blockchain based on cryptographic mechanism. Its main feature is a mechanism discouraging a user to fork a blockchain - if this happens, then a user's secret is leaked and thereby a proof of his misbehavior emerges. This approach is very attractive as long as we can guarantee that breaking the underlying cryptographic problem is infeasible for all parties. The situation changes dramatically in case of a partial compromise of a cryptographic scheme: when a powerful adversary can break the underlying scheme, while for the regular users the scheme is still resistant to attacks. In this case the blockchain techniques proposed becomes a dangerous trap allowing discrediting the users by powerful parties hiding own cryptanalytic power. To address this problem we introduce a David and Goliath adversary model, where a powerful adversary (Goliath) can break the underlying cryptographic assumption, but for a regular user (David) this is infeasible. For almost all cryptographic schemes, the situation of David is hopeless in this model: e.g., Goliath can forge standard signatures of David. Such an advantage of Goliath in case of a blockchain would be disastrous. We show that one can create a blockchain such that the advantage of Goliath is limited: if he creates a fork in a blockchain mimicking a double-spending attempt by David, then David can prove to be innocent.

Anonymous credential systems have to provide strong privacy protection: a user may prove his (chosen) attributes without leaking neither his identity nor other attributes. In this paper we consider U-Prove - one of the major commercial anonymous credential systems.

We present a variant of the protocol stack for anonymous authentication implemented in German personal identity documents. We strengthen the system by eliminating group keys - a potential target of attack for a powerful adversary aiming to undermine Restricted Identification mechanisms. We provide a mechanism of authentication that merges Chip Authentication protocol with Restricted Identification.

A cascade of mix servers is a crucial part of e-voting protocols and other schemes which aim for user's anonymity. We present kleptographic attacks on such cascades. In order to show interesting consequences, we focus on a cascade used as a building block of a Prêt à Voter e-voting protocol. However, the attacks might be generalized to any cascade of probabilistic mix servers.