# Decentralized Identity Authentication with Auditability and Privacy
## 5 Privacy-Preserving Protocol
### Final Protocol
#### 5.2.1 New Token and Its Consistency
We observed that the throughputs running on AWS were slightly lower for the baseline and higher for the other protocol. This was because the network bandwidth across the AWS regions was lower than that of the local cluster, and the AWS instances had more powerful CPUs than the local cluster's VMs. We examined the cost breakdown at the blockchain node to better understand the performance difference. In particular, we measured the cost of consensus and transaction

$A, pk(~ltkA))]

rule Register_did:

[!Pk($9 Peak throughput and latency. $A, h(pkA))]

rule Register_tkn:

[!Ltk($0 Throughput with varying client request rates (\(f=4\)). execution at the blockchain. Figure 4 compares these costs for the two protocols, with different values of \(f\). Consensus was the major cost in the baseline protocol, whereas transaction execution contributed the most to the cost in the privacy-preserving protocol. In particular, for \(f=1\), the consensus and execution latency in the baseline protocol were 0.074 and 0.0023 s, respectively (0.0052 and 0.0036 s for AWS). In the privacy-preserving protocol, they were 0.0037 and 3.16 s, respectively (0.0012 and 2.3 s for AWS). As a result, the baseline protocol was sensitive to the consensus cost, which increased with \(f\), whereas the other protocol was only affected by the execution cost. So far, we have ignored the cost of generating proofs at the client. Before generating proofs, the system first has to perform a one-time setup phase (i.e., executing \(zkGen\)), after which clients can generate proofs (i.e., calling \(zkProve\)). The costs of the setup phase and proof generation are shown in $A, h(pkA))]

rule Register_tkn:

[!Ltk($1 It can be seen that the setup phase was expensive, and its cost increased when more signatures were included in the proof (since the circuit size increased). For example, with \(f=5\) (or 16 nodes), the setup took almost 2 h to complete. We note, however, that this cost was incurred only once and can be amortized over time. ### Discussion

We remark that even though the throughput of the privacy-preserving protocol was low, the baseline protocol achieved a high enough throughput for it to be practical. In particular, we note that the authentication workload at Google is reported to be 20 requests per second over a dataset of \(677,000\) users [48]. Extrapolating from this, the baseline protocol can support workloads of up to 13 M users. Importantly, this protocol can scale horizontally with a sharded blockchain because different identities can be partitioned and processed independently in multiple shards. This means that the protocol can scale out to support billions of users. ### Integration

Our privacy-preserving protocol can be integrated with the latest verifiable credential schemes, such as Coconut [27] and EL Passo [28], to provide logging of authentication events, which can help users detect credential misuse. We briefly explain how our protocol can be integrated. Coconut is a selective disclosure credential scheme in which a user first sends a coconut issue request to a set of authorities (identity providers) with public and private \begin{table}
\begin{tabular}{c c c} \hline \hline
**\# signs in \(\pi_{in}^{thw}\)** & **Setup (min)** & **Generate Proof (s)** \\ \hline
2 & 60.53 & 14.44 \\
3 & 73.41 & 15.35 \\
4 & 97.81 & 16.79 \\
5 & 109.60 & 17.88 \\
6 & 118.86 & 18.09 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The costs of setup and generating proofs at the client. Figure 4: Cost breakdown at blockchain nodes. attributes, using which each authority issues a partial credential. Next, the user aggregates a threshold number of shares to obtain a consolidated credential and then invokes a show protocol to selectively disclose attributes or make statements about them to a service (doing authentication). This credential can be used across multiple services without connecting with the authorities during every show protocol execution.