SCIS 2022
2022 Symposium on
Cryptography and Information Security
Osaka, Japan & Online, Jan. 18 – 21, 2022
The Institute of Electronics,
Information and Communication Engineers

Copyright ©2022 The Institute of Electronics,
Information and Communication Engineers

Attested Execution Secure Processor-based Architecture for
Self-Sovereign Identity Systems Preserving Privacy
Koichi Moriyama ∗Akira Otsuka †Keywords: Decentralized Digital Identity, Self-Sovereign Identity, Permissionless Blockchain, andAttested Execution Secure Processors

Abstract
The recent momentum of research and discussion regarding Self-Sovereign Identity (SSI) utilizing blockchaintechnology in academia and the tech industry has inspired us to realize a true SSI system. David Chaumaddressed an approach in 1985 by utilizing pseudonyms,
digital signatures, and card computers to avoid unexpected tracing by someone else like Big Brother [1].
Our proposal in this paper is to incorporate the concept of that approach and build an SSI system by utilizing modern techniques of blockchain and cryptography, especially Rafael Pass et al.’s contribution of theformal abstraction of Attested Execution Secure Processors (AESPs) [2] instead of the card computers. Ourproposal of the AESP-based SSI architecture and system protocols, ΠGatt , demonstrates the powerfulness ofhardware-assisted security and the formal abstractionof AESPs that fit into building a true SSI system. Assuming AESPs and Gatt , the protocols may eliminate
the online distributed committee assumed in other research such as CanDID [3]. Also, ΠGatt allows not torely on multi-party computation (MPC); thus, it brings
drastic flexibility and efficiency when compared withthe existing SSI systems.

Figure 1: AESP-based SSI Architecture
Security Properties and Proof Sketch

Architecture and Protocols Overview
Unlike the existing SSI systems, we propose to utilize
hardware-assisted security and incorporate Gatt into
the SSI system protocols, ΠGatt . It consists of genericfunctions relying on Gatt , Setup(1λ ) → (pkM , skM ),Install(prog) → eid, and Resume(eid, inp) → (outp, σM ),as well as ΠGatt SSI-featured functions of KeyGen(1λ ) →(pkU , skU ), IssueCred (skU , pkU , Stmt) → cred,IssueDCred (skM , skU , pknew
U , ctx, cred) → derivedCred,and VerifyCred(skU , cred) → {true, false}.

The full paper also describes security properties ofSybil-resistance, Unforgeability, Privacy of Credentialissuance and Credential-verification, and Unlinkabilityfor ΠGatt , as well as a proof sketch of those security
properties. We believe that the Existence in the ten
principles of SSI systems [4] indicates the exact requirement for Sybil-resistance, so that we will demonstrate how the proposed architecture enables the requirement of Sybil-resistance with ideas of identification map among credentials and the construction ofΠGatt .

References[1] David Chaum. Security Without Identification: Transaction Systems to Make Big Brother Obsolete. Commun. ACM 28, 10 (1985), 1030–1044[2] Rafael Pass et al. Formal Abstractions for Attested
Execution Secure Processors. In EUROCRYPT 2017,
LNCS, Vol. 10210, 260–289[3] Deepak Maram et al. CanDID: Can-Do Decentralized
Identity with Legacy Compatibility, Sybil-Resistance,
and Accountability. In IEEE Symposium on Security
and Privacy 2021, 1348–1366∗Institute of Information Security, 2-14-1 Tsuruyamachi,Kanagawa-ku, Yokohama, JAPAN (moriyama@ai.iisec.ac.jp).
Also belonging to NTT DOCOMO, INC.
† Institute of Information Security, 2-14-1 Tsuruyamachi,
Kanagawa-ku, Yokohama, JAPAN (otsuka@iisec.ac.jp)[4] Christopher Allen. The Path to Self–Sovereign Identity.
https://www.lifewithalacrity.com/2016/04/the-pathto-self-soverereign-identity.html

1