Report - Guardian

266 The LSE Identity Project Report: June 2005Figure 2 - Enrolment and access to Government servicesStep 1: In a one-time enrolment phase, Bob’s ID card retrieves several “unidirectional”identifiers from a Government Authority. The Authority endows these identifiers withrelevant security properties (e.g., to prevent Bob from cloning or lending his identifiers),and cryptographically embeds a unique number into all of Bob’s identifiers. TheAuthority may also endow Bob’s unidirectional identifiers with optional attributeinformation (e.g., residency information) to allow service providers to make a moreinformed decision about Bob. However, the Authority never actually gets to see theunidirectional identifiers it issues to Bob. From a privacy perspective, each of Bob’sunidirectional identifiers is the equivalent of a unique randomly self-generated number,in spite of the fact that the Authority has “certified” it.Step 2: The first time that Bob accesses a Government Service, his ID card transmits afresh unidirectional identifier to that Service. In doing so, Bob’s card can selectivelyhide any irrelevant attribute information that may have been tied to the presentedidentifier. The invisibly embedded unique number remains unconditionally hidden.Bob’s card uses a different identifier at each Service.