Re: Unique identifiers and privacy

> I am concerned with the general statement that we should merely "do no
> worse than the current state of the art". I am specifically concerned
> with the use of long lived unique identifiers. We have already got
> significant feedback on such identifiers in a number of products, e.g.
> identifiers of CPU chips, identifiers of users of audio-video players,
> host identifiers in IPv6, use of social security numbers in data bases,
> and the list goes on. Any unique identifier is a privacy time bomb.

Hi Christian,

We have presented a HIP variant (see below) in our latest Cambridge
Security Workshop paper that offers identity privacy protection for
long lived unique identifiers, e.g., for HITs. I believe that it is
possible to apply the same mechanism with other wedge layer 3.5
identifiers.

"Jukka Ylitalo, and Pekka Nikander,  "BLIND: A Complete Identity 
Protection Framework for End-points", to appear in Proceedings of the 
Twelfth International Workshop on Security Protocols,  (Cambridge'04), 
Sidney Sussex College, Cambridge, England, April 26-28, 2004."

http://www.hut.fi/~jylitalo/publications/Cam04-Ylitalo-Nikander.pdf

br, Jukka