The document discusses the problems with using blockchain for identity, noting that blockchains are more centralized than advertised, have poor scalability, consume large amounts of energy, and still require middlemen. It argues that self-sovereign identity using attribute-based credentials provides a better solution by allowing users to control access to attributes without relying on centralized identity providers or having all parties online simultaneously.

1. Blockchain &
Identity
(Why you should avoid
the blockchain like the
plague)
Jaap-Henk Hoepman
Radboud University
jhh@cs.ru.nl / @xotoxot

2. www.pilab.nl
”The” blockchain does not exist
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20172

3. www.pilab.nl
Bitcoin: the first blockchain
• Invented by ‘Satoshi Nakamoto’
in 2008
• Satoshi’s goals
– Irreversible, immutable,
transactions
– Lower transaction costs
• Satoshi’s insight
– Secure, peer-to-peer, transaction
processing is possible
– Using ‘proof-of-work’ to create
distributed consensus
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20173

4. www.pilab.nl
Blockchain problems
• More centralised than you think
– Four largest (>75%) mining pools are
from China
– Developers decide (cf. Ethereum and
Ethereum classic fork): transactions
are reversible
– ”fundamentally incompatible with
democratic society”
• Poor scalability
– Max 7 transactions per second (cf 7000
for creditcards)
– Blockchain grows rapidly (60 GB, 2x
size of 2015)
• Unsustainable: Mining consumes
enormous amounts of energy
– 1tx can power 1 US household for a
week (2017)
• Incentives necessary
– To guarantee progress and keep nodes
honest
• Not privacy friendly
– Though altcoins that are exist
• Security poorly understood
– Especially for ”Proof-of-stake”
• Still a middleman
– Consolidates centralized power of
corporations and governments
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20174

5. www.pilab.nl
So should you use a
blockchain?
• Only when
– The order of (trans)actions matters
– And there is no central authority you can trust
• Otherwise
– Use a peer to peer network,
– Or a distributed database, or …
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20175

6. www.pilab.nl
So… what about identity?
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20176
Identity Provider Relying Party
User
No transactions
A lot of trust

7. www.pilab.nl
Traditionally, a lot of stuff is
wrong…
Privacy by design - practical aspects / Jaap-Henk Hoepman / 03-02-20167
Identity Provider Relying Party
User
attributes
All parties are on line
Security and privacy risks

8. www.pilab.nl
Self-sovereign identity?
• Attribute based credentials!
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-20178
https://privacybydesign.foundation

9. www.pilab.nl
eID: ABC based : Issuing
Privacy by design - practical aspects / Jaap-Henk Hoepman / 03-02-20169
Credential Issuer Relying Party
User

10. www.pilab.nl
eID: ABC based : showing
Privacy by design - practical aspects / Jaap-Henk Hoepman / 03-02-201610
Credential Issuer Relying Party
User
unlinkable Has certificate granting
access to attributes

11. www.pilab.nl
[Monty Python’s
Argument Clinic sketch]
Questions / Discussion
Identity and the Blockchain / Jaap-Henk Hoepman / 5-09-201711
jhh@cs.ru.nl