A Critique of Immunity Passports and W3C Decentralized Identifiers

by   Harry Halpin, et al.

Due to the widespread COVID-19 pandemic, there has been a push for `immunity passports' and even technical proposals. Although the debate about the medical and ethical problems of immunity passports has been widespread, there has been less inspection of the technical foundations of immunity passport schemes. These schemes are envisaged to be used for sharing COVID-19 test and vaccination results in general. The most prominent immunity passport schemes have involved a stack of little-known standards, such as Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) from the World Wide Web Consortium (W3C). Our analysis shows that this group of technical identity standards are based on under-specified and often non-standardized documents that have substantial security and privacy issues, due in part to the questionable use of blockchain technology. One concrete proposal for immunity passports is even susceptible to dictionary attacks. The use of `cryptography theater' in efforts like immunity passports, where cryptography is used to allay the privacy concerns of users, should be discouraged in standardization. Deployment of these W3C standards for `self-sovereign identity' in use-cases like immunity passports could just as well lead to a dangerous form identity totalitarianism.



There are no comments yet.


page 1

page 2

page 3

page 4


A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems

Identity management systems (IDMSs) are widely used to provision user id...

Is Blockchain for Internet of Medical Things a Panacea for COVID-19 Pandemic?

The outbreak of the COVID-19 pandemic has deeply influenced the lifestyl...

Cyclic group based mutual authentication protocol for RFID system

Widespread deployment of RFID system arises security and privacy concern...

Certifying Provenance of Scientific Datasets with Self-sovereign Identity and Verifiable Credentials

In order to increase the value of scientific datasets and improve resear...

COVID-19 Antibody Test / Vaccination Certification: There's an app for that

Goal: As the Coronavirus Pandemic of 2019/2020 unfolds, a COVID-19 'Immu...

SoK: Why Johnny Can't Fix PGP Standardization

Pretty Good Privacy (PGP) has long been the primary IETF standard for en...

Comparative Analysis and Framework Evaluating Web Single Sign-On Systems

We perform a comprehensive analysis and comparison of 14 web SSO systems...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.