A Critique of Immunity Passports and W3C Decentralized Identifiers
This paper identifies critical technical flaws in proposed immunity passport systems for the general public, highlighting potential security and privacy risks.
This paper critiques the technical foundations of immunity passport schemes, specifically those utilizing W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). The analysis reveals that these standards are based on under-specified and non-standardized documents, leading to substantial security and privacy issues, including susceptibility to dictionary attacks in one concrete proposal.
Due to the widespread COVID-19 pandemic, there has been a push for `immunity passports' and even technical proposals. Although the debate about the medical and ethical problems of immunity passports has been widespread, there has been less inspection of the technical foundations of immunity passport schemes. These schemes are envisaged to be used for sharing COVID-19 test and vaccination results in general. The most prominent immunity passport schemes have involved a stack of little-known standards, such as Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) from the World Wide Web Consortium (W3C). Our analysis shows that this group of technical identity standards are based on under-specified and often non-standardized documents that have substantial security and privacy issues, due in part to the questionable use of blockchain technology. One concrete proposal for immunity passports is even susceptible to dictionary attacks. The use of `cryptography theater' in efforts like immunity passports, where cryptography is used to allay the privacy concerns of users, should be discouraged in standardization. Deployment of these W3C standards for `self-sovereign identity' in use-cases like immunity passports could just as well lead to a dangerous form identity totalitarianism.