A Critique of Immunity Passports and W3C Decentralized Identifiers

TL;DR

This paper critically examines the technical foundations of immunity passports based on W3C standards, highlighting security, privacy issues, and potential risks of misuse in self-sovereign identity systems.

Contribution

It provides a detailed critique of W3C's Decentralized Identifiers and Verifiable Credentials standards in the context of immunity passports, exposing their vulnerabilities and risks.

Findings

W3C standards have significant security and privacy issues.

Some immunity passport proposals are vulnerable to dictionary attacks.

Using cryptography as a privacy shield can be misleading and problematic.

Abstract

Due to the widespread COVID-19 pandemic, there has been a push for `immunity passports' and even technical proposals. Although the debate about the medical and ethical problems of immunity passports has been widespread, there has been less inspection of the technical foundations of immunity passport schemes. These schemes are envisaged to be used for sharing COVID-19 test and vaccination results in general. The most prominent immunity passport schemes have involved a stack of little-known standards, such as Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) from the World Wide Web Consortium (W3C). Our analysis shows that this group of technical identity standards are based on under-specified and often non-standardized documents that have substantial security and privacy issues, due in part to the questionable use of blockchain technology. One concrete proposal for immunity passports is even susceptible to dictionary attacks. The use of `cryptography theater' in efforts like immunity passports, where cryptography is used to allay the privacy concerns of users, should be discouraged in standardization. Deployment of these W3C standards for `self-sovereign identity' in use-cases like immunity passports could just as well lead to a dangerous form identity totalitarianism.