Pith. sign in

REVIEW 3 major objections 4 minor 61 references

Understanding the Identity-Transformation Approach in OIDC-Compatible Privacy-Preserving SSO Services

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper shows that the identity transformations behind UppreSSO's privacy-preserving single sign-on are exactly an oblivious pseudorandom function of the HashDH type, meaning any OPRF that satisfies a few extra security and privacy…

desk verdict Solid OPRF-unification result for UppreSSO, but the 2HashRSA_N construction is conditionally secure at best and the proofs are sketches; still deserves refereeing. read the letter →

arxiv 2506.01325 v2 pith:L5OV4D2Y submitted 2025-06-02 cs.CR

Jingqiang Lin , Baitao Zhang , Wei Wang , Quanwei Cai , Jiwu Jing , Huiyang He This is my paper
classification cs.CR
keywords singlesign-onOpenIDConnectprivacyidentitytransformationobliviouspseudorandomfunctionunlinkabilityuntraceability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Identity transformations in UppreSSO, a privacy-preserving single sign-on (SSO) scheme for OpenID Connect, are not a bespoke design: this paper shows they are exactly an oblivious pseudorandom function (OPRF), a protocol in which a server evaluates a pseudo-random function on a user's private input without seeing it. The paper builds a generalized UppreSSO from any OPRF by mapping account, pseudo-identity, and account-recovery functions to the OPRF's blind, evaluate, and unblind steps. It then defines the extra properties an OPRF must have to make SSO secure and private—user identification, RP designation, and key-identifier freeness—and proves which standard OPRFs (HashDH, DYHE, a revised 2HashRSA) satisfy them, while NRHE fails account uniqueness. If the unification is right, future SSO systems can be assembled from the OPRF literature instead of invented from scratch, and existing OPRF protocols can be evaluated as SSO candidates by checking a small set of properties.

What carries the argument

The load-bearing object is the oblivious pseudorandom function formalized as four algorithms—$PR(k,x)$ for the pseudorandom output, $BL(x,t,\omega)$ for blinding an input with randomness $t$, $OPR(k,x',\omega)$ for evaluating the blinded input under the server's key, and $UBL(z',x,t,\omega)$ for unblinding—together with the paper's identification of these with UppreSSO's functions $F_{Acc*}$, $F_{PID_{RP}}$, $F_{PID_U}$, and $F_{Acc}$. This mapping carries the argument: it turns SSO's security and privacy requirements into properties of a known primitive, and it lets the paper classify existing OPRF protocols by account uniqueness, user identification, RP designation (with or without $PID_{RP}$ checking), and key-identifier freeness. The two variants of the security properties, with and without an RP checking the pseudo-identity $PID_{RP}$, are the second piece of machinery: they determine which OPRFs can be safely deployed in which SSO configuration.

What would settle it

Instantiate generalized UppreSSO with an OPRF that is pseudo-random but not key-identifier-free (for example, the unmodified 2HashRSA with a distinct modulus per key), then run colluding relying parties to see whether they can link a user's logins by recognizing the modulus; if the logins remain unlinkable, the claimed equivalence between RP unlinkability and indistinguishability of OPRF keys is wrong.

Watch

Extended reading notes

Core claim

Section 4.2 states the core discovery directly: the (finite-field versions of the) identity transformations proposed in UppreSSO mathematically utilize the same functions as the OPRF of HashDH. With the correspondence $ID_U = k$, $ID_{RP} = x$, $Acc = PR(k,x)$, $PID_{RP} = BL(x,t,\omega)$, $PID_U = OPR(k,x',\omega)$, and $Acc = UBL(z',x,t,\omega)$, any OPRF conforming to the standard blind/evaluate/unblind formalization yields a generalized UppreSSO system with the same SSO guarantees. The paper then proves SSO-specific properties for OPRFs—account uniqueness, user identification and RP designation in two variants (with and without $PID_{RP}$ checking), and key-identifier freeness—and shows that HashDH, DYHE, and a revised 2HashRSA (called 2HashRSA$_N$) qualify, while NRHE fails account uniqueness. Notably, 2HashRSA$_N$ only supports the stronger security properties when the intermediate value $x^{k_i}_j$ is assumed either fully secret or fully public, an assumption the protocol itself does not enforce.

Load-bearing premise

The load-bearing premise for the 2HashRSA_N construction is that the intermediate value $x^{k_i}_j$, computed by a relying party during each login, is either fully secret or fully public; the protocol provides no mechanism to guarantee either state, so a real deployment with partial leakage fits neither proof.

Editorial extensions

If this is right

  • New SSO systems can be built by picking any OPRF that satisfies account uniqueness, user identification, RP designation, and key-identifier freeness, so the design problem reduces to choosing an algebraic setting and checking these properties.
  • DYHE (homomorphic encryption) and 2HashRSA$_N$ (RSA) become proven alternatives to the elliptic-curve HashDH construction for the same OIDC-compatible privacy-preserving SSO.
  • An RP can skip $PID_{RP}$ checking when the underlying OPRF is HashDH, DYHE, or 2HashRSA$_N$ with the intermediate value kept secret; otherwise it must check $PID_{RP}$ and the IdP must choose exponents so that no exponent difference lies in the key set.
  • RP unlinkability is equivalent to indistinguishability of OPRF keys, which is pseudo-randomness plus key-identifier freeness; an OPRF whose public parameters (like an RSA modulus) identify the key cannot provide RP unlinkability unless keys are refreshed or unified.
  • Regular account synchronization between IdP and RP lets an RP accept tokens without $PID_{RP}$ checking even when new users join, and without such synchronization a malicious user can register multiple meaningless accounts at the same RP.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the equivalence turns SSO protocol design into an OPRF selection problem, so the security of any future identity-transformation SSO can be audited by checking key-identifier freeness and the two designation properties rather than building a bespoke SSO model.
  • Editorial inference: an OPRF whose public parameters identify its key can never achieve RP unlinkability without per-login key refresh; this is a testable criterion that could be applied to other OPRF families beyond the four analyzed.
  • Editorial inference: the paper's integration suggestions imply that the OIDC authorization-code flow can be made privacy-preserving with standard PKCE plus a ring signature or privacy-pass token for anonymous retrieval, which could be validated with a prototype implementation.
  • Editorial inference: because the mapping requires the user key $k$ to be known only to the IdP, the whole scheme inherits a single point of failure; distributing the OPRF key across multiple servers with a threshold OPRF is a natural extension that the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The manuscript analyzes the identity-transformation approach used in UppreSSO for OIDC-compatible privacy-preserving SSO. Its central observation (Section 4.2, Table 3) is that UppreSSO's four transformations—F_Acc*, F_PID_RP, F_PID_U, and F_Acc—are exactly the PR, BL, OPR, and UBL components of a HashDH oblivious PRF, and that any OPRF conforming to the same formalization can be used to build a generalized UppreSSO system. The paper defines two SSO-security variants (user identification and RP designation, with and without PID_RP checking), introduces weak and strong key-identifier freeness for OPRFs, analyzes HashDH, NRHE, DYHE, and 2HashRSA against these properties, proposes a modified 2HashRSA_N with a shared RSA modulus, and states five theorems about these properties. It also makes integration suggestions for OIDC flows (Section 3.2).

Significance. The claimed OPRF-to-identity-transformation relationship is plausible and genuinely useful: it recasts UppreSSO's bespoke design as an instance of an established primitive and opens the way to instantiating privacy-preserving SSO from other OPRFs. The distinction between weak and strong key-identifier freeness, and the two variants of user identification and RP designation, are valuable conceptual additions to the OPRF and SSO literature. The paper's value is moderated, however, by two factors: the proofs of the new theorems are sketches rather than formal reductions, and the one genuinely new OPRF instantiation (2HashRSA_N) is shown only conditionally, under an assumption about an internal intermediate value that the protocol does not enforce.

major comments (3)
  1. [Section 4.4, Theorems 2 and 3] The proofs of Theorem 2 and Theorem 3 for 2HashRSA_N are stated under the assumption that {x^{k_i}_j} is kept secret from adversaries, while Theorem 4 and Theorem 5 assume that x^{k_i}_j is known to adversaries. The protocol itself neither enforces secrecy nor guarantees disclosure of this value: it is an intermediate result computed inside the RP during UBL(), and the model explicitly allows malicious RPs and users. An honest user can thus visit a malicious RP that stores and shares x^{k_i}_j, which makes the w/o-PID_RP-checking claims in Table 4 for 2HashRSA_N (rows 'User Identification' and 'RP Designation') not properties of the protocol as specified. The paper should either modify the protocol so that the secrecy assumption is enforced by a protocol mechanism, or explicitly mark the construction as conditional on a non-protocol assumption and adjust Table 4 and the abstract accordingly.
  2. [Section 4.4, Theorems 2, 3, 4, and 5] The proofs consist largely of statements such as 'this is equivalent to the DLP' or 'this cannot be solved' without a formal adversary model, success-probability bounds, or reductions in either direction. Since a claimed contribution is proving SSO-related properties of OPRF schemes, the absence of precise game-based definitions and explicit hardness assumptions makes the theorems hard to verify as stated. Please provide formal reductions, or at least precise security games with explicit adversary capabilities and negligible-function statements, for each of Theorems 2 through 5.
  3. [Section 4.4, Theorems 4 and 5] The sufficient condition that the IdP select {e_i} so that e_{i2} - e_{i1} is not in e for all e_{i1}, e_{i2} in e is asserted but not instantiated. The paper does not show how to generate multiple RSA key pairs with the same modulus N that satisfy this difference-closed exclusion while preserving the pseudorandomness properties of 2HashRSA_N. A concrete exponent-generation procedure, or at least an existence proof with an explicit construction, is needed for the w/ PID_RP-checking claims to be usable.
minor comments (4)
  1. [Section 4.4, Proof of Theorem 1] The last sentence of the proof refers to 'account correctness' being not ensured in NRHE, but the theorem and Table 4 are about 'account uniqueness'; please align the terminology.
  2. [Section 3.2, ArpSSO flow] The numbered list describing ArpSSO's original flow jumps from step 1 to step 3; renumber the steps or add the missing step.
  3. [Section 4.3.3] The phrase 'honest-but-colluding RPs and users' is confusing; it should probably read 'honest-but-curious IdP' for IdP untraceability and 'colluding RPs and users' for RP unlinkability.
  4. [References [28] and [29]] Both references point to the same arXiv identifier for UppreSSO versions 2 and 3; please make the version distinction explicit in the bibliography.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the OPRF mapping is checked against external definitions, and the new proofs are self-contained; the 2HashRSA_N conditionality is a stated limitation, not a circular step.

full rationale

The derivation chain is: (i) observe that the F_q identity transformations of UppreSSO coincide with the HashDH OPRF (Section 4.2, Table 3); (ii) build a generalized UppreSSO from any OPRF with PR/BL/OPR/UBL; (iii) define SSO-related OPRF properties; (iv) prove them for HashDH, DYHE, and 2HashRSA_N. Step (i) is a direct algebraic check against the equations in Section 2.2 and the external HashDH definition [38,51], not a consequence of the authors' own prior papers. Steps (ii)-(iv) are self-contained reductions to DLP/RSA/HE assumptions; the proofs do not rename a fitted parameter as a prediction. Self-citations to UppreSSO [28,29] appear for background and for earlier proofs (e.g., Section 3.2 says 'security and privacy guarantees are still strictly provided [29]'), but those guarantees are re-derived and extended for the generalized constructions in Section 4.4, so the self-citations are not the load-bearing input to the new central claim. The 2HashRSA_N analysis is explicitly conditional: Section 4.4 states 'we prove Theorems 2 and 3 for 2HashRSA_N under the assumption that {x^{k_i}_j} is kept secret to adversaries' and later 'under the assumption that k_i is kept secret but x^{k_i}_j is known to adversaries.' The paper honestly notes that x^{k_i}_j is an intermediate UBL value that an RP could leak, and Table 4 marks the w/o-checking rows 'bottom' in the public case. This is a genuine protocol-validity gap, but it is a stated assumption, not a hidden reuse of the conclusion. No equation is forced by definition, and no cited uniqueness theorem is used to forbid alternatives. Verdict: no significant circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The construction rests on standard cryptographic hardness assumptions plus a domain assumption of an honest-but-curious IdP. The only ad hoc element is the revision of 2HashRSA to share a modulus and to constrain the exponent set, which is needed to satisfy the newly defined key-identifier freeness.

free parameters (1)
  • Exponent set {e_i} in revised 2HashRSA_N = not specified; must satisfy e_i2 - e_i1 is not in {e_i} for any distinct i1, i2
    Theorems 4 and 5 require the IdP to choose RSA exponents e_i so that pairwise differences avoid the set of all exponents; this is a hand-chosen constraint needed to make the security proof go through, not derived from a prior standard.
assumptions (5)
  • standard math Hardness of the discrete logarithm problem in the relevant group (F_q or elliptic curve).
    Theorems 2 and 3 reduce user identification and RP designation to the adversary being unable to solve DLP; without this, the HashDH and DYHE constructions do not achieve the claimed security.
  • domain assumption The OPRF formalization in Section 4.1 (BL, OPR, UBL with optional omega) captures all OPRF protocols considered.
    The generalized UppreSSO construction in Section 4.2 is only valid if every OPRF can be expressed in this three-function form; NRHE itself fits only loosely (footnote 5 acknowledges a non-conforming variant).
  • standard math RSA assumption and collision-freeness of hash H2 for 2HashRSA_N.
    Theorem 1 uses collision-freeness of H2 and RSA security to claim account uniqueness; Theorems 2 and 3 use secrecy of x^{k_i}_j.
  • domain assumption Honest-but-curious IdP, authenticated and confidential links, and correctly implemented honest software.
    The entire UppreSSO and generalized UppreSSO model in Section 2.1 assumes these; the privacy claims collapse if the IdP colludes with RPs (acknowledged in Section 5).
  • ad hoc to paper The identity provider can generate multiple RSA key pairs sharing the same modulus N with e_i * k_i = 1 mod phi(N) (2HashRSA_N revision).
    This modification is introduced in Section 4.4 to achieve key-identifier freeness; it is not an existing standard 2HashRSA deployment, and its security depends on the secrecy of phi(N) and the added e_i-difference condition.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Understanding the Identity-Transformation Approach in OIDC-Compatible Privacy-Preserving SSO Services." pith.science (2026). https://pith.science/paper/L5OV4D2Y

@misc{pith2026250601325,
  author       = {Pith},
  title        = {Pith review of: Understanding the Identity-Transformation Approach in OIDC-Compatible Privacy-Preserving SSO Services},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L5OV4D2Y}},
  note         = {Machine review of arXiv:2506.01325}
}
read the original abstract

OpenID Connect (OIDC) enables a user with commercial-off-the-shelf browsers to log into multiple websites, called relying parties (RPs), by her username and credential set up in another trusted web system, called the identity provider (IdP). Identity transformations are proposed in UppreSSO to provide OIDC-compatible SSO services, preventing both IdP-based login tracing and RP-based identity linkage. While security and privacy of SSO services in UppreSSO have been proved, several essential issues of this identity-transformation approach are not well studied. In this paper, we comprehensively investigate the approach as below. Firstly, several suggestions for the efficient integration of identity transformations in OIDC-compatible SSO are explained. Then, we uncover the relationship between identity-transformations in SSO and oblivious pseudo-random functions (OPRFs), and present two variations of the properties required for SSO security as well as the privacy requirements, to analyze existing OPRF protocols. Finally, new identity transformations different from those designed in UppreSSO, are constructed based on OPRFs, satisfying different variations of SSO security requirements. To the best of our knowledge, this is the first time to uncover the relationship between identity transformations in OIDC-compatible privacy-preserving SSO services and OPRFs, and prove the SSO-related properties (i.e., key-identifier freeness, RP designation and user identification) of OPRF protocols, in addition to the basic properties of correctness, obliviousness and pseudo-randomness.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

61 extracted references · 60 canonical work pages

  1. [1]

    Abdalla, M

    M. Abdalla, M. Cornejo, A. Nitulescu, and D. Pointcheval. 2016. Robust password- protected secret sharing. In 21st European Symposium on Research in Computer Security (ESORICS)

    work page 2016

  2. [2]

    Bagherzandi, S

    A. Bagherzandi, S. Jarecki, Y. Lu, and N. Saxena. 2011. Password-protected secret sharing. In 18th ACM Conference on Computer and Communications Security (CCS). 433–444

    work page 2011

  3. [3]

    X. Bao, X. Zhang, J. Lin, D. Chu, Q. Wang, and F. Li. 2019. Towards the trust- enhancements of single sign-on services. In 3rd IEEE Conference on Dependable and Secure Computing (DSC)

    work page 2019

  4. [4]

    Bender, J

    A. Bender, J. Katz, and R. Morselli. 2006. Ring signatures: Stronger definitions, and constructions without random oracles. In 3rd Theory of Cryptography Conference (TCC). 60–79

    work page 2006

  5. [5]

    Camenisch, A

    J. Camenisch, A. de Caro, E. Ghosh, and A. Sorniotti. 2019. Oblivious PRF on committed vector inputs and application to deduplication of encrypted data. In 23rd International Conference on Financial Cryptography and Data Security (FC)

    work page 2019

  6. [6]

    Camenisch and E

    J. Camenisch and E. Herreweghen. 2002. Design and implementation of the Idemix anonymous credential system. In 9th ACM Conference on Computer and Communications Security (CCS)

    work page 2002

  7. [7]

    Camenisch and A

    J. Camenisch and A. Lehmann. 2017. Privacy-preserving user-auditable pseudo- nym systems. In2nd IEEE European Symposium on Security and Privacy (EuroS&P)

    work page 2017

  8. [8]

    Camenisch and A

    J. Camenisch and A. Lysyanskaya. 2001. An efficient system for non-transferable anonymous credentials with optional anonymity revocation. In EUROCRYPT

    work page 2001

Show all 61 references
  1. [9]

    Casacuberta, J

    S. Casacuberta, J. Hesse, and A. Lehmann. 2022. SoK: Oblivious pseudorandom functions. In 7th IEEE European Symposium on Security and Privacy (EuroS&P)

    2022

  2. [10]

    Chase, S

    M. Chase, S. Meiklejohn, and G. Zaverucha. 2014. Algebraic MACs and keyed- verification anonymous credentials. In 21st ACM Conference on Computer and Communications Security (CCS)

    2014

  3. [11]

    D. Chu, J. Lin, F. Li, X. Zhang, and Q. Wang. 2019. Ticket transparency: Account- able single sign-on with privacy-preserving public logs. In 15th International Conference on Security and Privacy in Communication Networks (SecureComm)

    2019

  4. [12]

    P. Das, J. Hesse, and A. Lehmann. 2022. DPaSE: Distributed password- authenticated symmetric-key encryption, or how to get many keys from one password. In 17th ACM Asia Conference on Computer and Communications Secu- rity (AsiaCCS)

    2022

  5. [13]

    Davidson, I

    A. Davidson, I. Goldberg, N. Sullivan, G. Tankersley, and F. Valsorda. 2018. Priva- cyPass: Bypassing Internet challenges anonymously. Privacy Enhancing Tech- nologies 2018, 3 (2018), 164–180

    2018

  6. [14]

    Dey and S

    A. Dey and S. Weis. 2010. PseudoID: Enhancing privacy for federated login. In 3rd Hot Topics in Privacy Enhancing Technologies (HotPETs)

    2010

  7. [15]

    Dingledine, N

    R. Dingledine, N. Mathewson, and P. Syverson. 2004. Tor: The Second-Generation Onion Router. In 13th USENIX Security Symposium . 303–320

    2004

  8. [16]

    Duong and N

    T. Duong and N. Trieu D.-H. Phan. 2020. Catalic: Delegated PSI cardinality with applications to contact tracing. In ASIACRYPT

    2020

  9. [17]

    Ernstberger, S

    J. Ernstberger, S. Chaliasos, G. Kadianakis, S. Steinhorst, P. Jovanovic, A. Gervais, B. Livshits, and M. Orru. 2024. zk-Bench: A toolset for comparative evaluation and performance benchmarking of SNARKs. In 14th International Conference on Security and Cryptography for Networks (SCN)

    2024

  10. [18]

    Everspaugh, R

    A. Everspaugh, R. Chaterjee, S. Scott, A. Juels, and T. Ristenpart. 2015. The Pythia PRF service. In 24th USENIX Security Symposium

    2015

  11. [19]

    Faz-Hernandez, S

    A. Faz-Hernandez, S. Scott, N. Sullivan, R. Wahby, and C. Wood. 2022. draft- irtf-cfrg-hash-to-curve-16: Hashing to elliptic curves . Internet Engineering Task Force

    2022

  12. [20]

    D. Fett, R. Küsters, and G. Schmitz. 2014. An Expressive Model for the Web Infrastructure: Definition and Application to the BrowserID SSO System. In 35th IEEE Symposium on Security and Privacy (S&P)

    2014

  13. [21]

    D. Fett, R. Küsters, and G. Schmitz. 2015. Analyzing the BrowserID SSO system with primary identity providers using an expressive model of the Web. In 20th European Symposium on Research in Computer Security (ESORICS)

    2015

  14. [22]

    D. Fett, R. Küsters, and G. Schmitz. 2015. Spresso: A secure, privacy-respecting single sign-on system for the Web. In 22nd ACM Conference on Computer and Communications Security (CCS). 1358–1369

    2015

  15. [23]

    Freedman, Y

    M. Freedman, Y. Ishai, B. Pinkas, and O. Reingold. 2005. Keyword search and oblivious pseudorandom functions. In 2nd Theory of Cryptography Conference (TCC). 303–324

    2005

  16. [24]

    Freedman, Y

    M. Freedman, Y. Ishai, B. Pinkas, and O. Reingold. 2020. PESTO: Proactively secure distributed single sign-on, or how to trust a hacked server. In 5th IEEE European Symposium on Security and Privacy (EuroS&P)

    2020

  17. [25]

    Google for Developers. [n. d.]. Google Identity: Integration considerations. https: //developers.google.com/identity/gsi/web/guides/integrate/. Accessed January 13, 2025

    2025

  18. [26]

    Grassi, E

    P. Grassi, E. Nadeau, J. Richer, S. Squire, J. Fenton, N. Lefkovitz, J. Danker, Y.-Y. Choong, K. Greene, and M. Theofanos. 2017.SP 800-63C: Digital identity guidelines: Federation and assertions. National Institute of Standards and Technology

    2017

  19. [27]

    C. Guo, F. Lang, Q. Wang, and J. Lin. 2021. UP-SSO: Enhancing the user privacy of SSO by integrating PPID and SGX. In International Conference on Advanced Computing and Endogenous Security (ICACES)

    2021

  20. [29]

    C. Guo, J. Lin, Q. Cai, W. Zhu, W. Wang, J. Jing, Q. Wang, B. Zhao, and F. Li

  21. [30]

    Hammann, R

    S. Hammann, R. Sasse, and D. Basin. 2020. Privacy-preserving OpenID Connect. In 15th ACM Asia Conference on Computer and Communications Security (AsiaCCS) . 277–289

    2020

  22. [31]

    Hardjono and S

    T. Hardjono and S. Cantor. 2018. SAML v2.0 subject identifier attributes profile version 1.0. OASIS

    2018

  23. [32]

    D. Hardt. 2012. RFC 6749: The OAuth 2.0 authorization framework . Internet Engineering Task Force

    2012

  24. [33]

    Hazay and Y

    C. Hazay and Y. Lindell. 2008. Efficient protocols for set intersection and pattern matching with security against malicious and covert adversaries. In 5th Theory of Cryptography Conference (TCC)

    2008

  25. [34]

    J. He, L. Lei, Y. Wang, P. Wang, and J. Jing. 2024. ArpSSO: An OIDC-compatible privacy-preserving SSO scheme based on RP anonymization. In 29th European Symposium on Research in Computer Security (ESORICS)

    2024

  26. [35]

    Heinrich, M

    A. Heinrich, M. Hollick, T. Schneider, M. Stute, and C. Weinert. 2021. Private- Drop: Practical privacy-preserving authentication for Apple AirDrop. In USENIX Security Symposium

    2021

  27. [36]

    Hyperledger Fabric. [n. d.]. MSP implementation with Identity Mixer. https: //hyperledger-fabric.readthedocs.io/en/release-2.2/idemix.html. Accessed July 20, 2022

    2022

  28. [37]

    Isaakidis, H

    M. Isaakidis, H. Halpin, and G. Danezis. 2016. UnlimitID: Privacy-preserving federated identity management using algebraic MACs. In 15th ACM Workshop on Privacy in the Electronic Society (WPES) . 139–142

    2016

  29. [38]

    Jarecki, A

    S. Jarecki, A. Kiayias, and H. Krawczyk. 2014. Round-optimal password-protected secret sharing and T-PAKE in the password-only model. In AsiaCrypt

    2014

  30. [39]

    Jarecki, H

    S. Jarecki, H. Krawczyk, and J. Resch. 2019. Updatable oblivious key management for storage systems. In 26th ACM Conference on Computer and Communications Security (CCS). 379–393

    2019

  31. [40]

    Jarecki, H

    S. Jarecki, H. Krawczyk, and J. Xu. 2018. OPAQUE: An asymmetric PAKE protocol secure against pre-computation attacks. In EUROCRYPT

    2018

  32. [41]

    Jarecki and X

    S. Jarecki and X. Liu. 2009. Efficient oblivious pseudorandom function with applications to adaptive OT and secure computation of set intersection. In 6th Theory of Cryptography Conference (TCC) . 577–594

    2009

  33. [42]

    Kroschewski and A

    M. Kroschewski and A. Lehmann. 2023. Save the implicit flow? Enabling privacy- preserving RP authentication in OpenID Connect.Privacy Enhancing Technologies 2023, 4 (2023), 96–116

    2023

  34. [43]

    Lee and S

    M. Lee and S. Cho. 2013. Web certificate API . World Wide Web Consortium (W3C)

    2013

  35. [44]

    A. Lehmann. 2019. ScrambleDB: Oblivious (Chameleon) Pseudonymization-as-a- Service. Privacy Enhancing Technologies 2019, 3 (2019), 289–309

    2019

  36. [45]

    Li and C

    W. Li and C. Mitchell. 2016. Analysing the security of Google’s implementation of OpenID Connect. In 13th International Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMV A)

    2016

  37. [46]

    G. Liu, J. Lin, D. Chu, X. Zhang, Q. Wang, C. Ma, F. Li, and D. Ye. 2023. En- hanced ticket transparency (eTT) framework for single sign-on services with pseudonyms. In 22nd IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)

    2023

  38. [47]

    W. Ma, Q. Xiong, X. Shi, X. Ma, H. Jin, H. Kuang, M. Gao, Y. Zhang, H. Shen, and W. Hu. 2023. GZKP: A GPU accelerated zero-knowledge proof system. In 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) . 340–353

    2023

  39. [48]

    Maganis, E

    G. Maganis, E. Shi, H. Chen, and D. Song. 2012. Opaak: Using mobile phones to limit anonymous identities online. In 10th International Conference on Mobile Systems, Applications, and Services (MobiSys)

    2012

  40. [49]

    Maler and D

    E. Maler and D. Reed. 2008. The venn of identity: Options and issues in federated identity management. IEEE Security & Privacy 6, 2 (2008), 16–23

    2008

  41. [50]

    P. Miao, S. Patel, M. Raykova, K. Seth, and M. Yung. 2020. Two-sided malicious security for private intersection-sum with cardinality. In CRYPTO

    2020

  42. [51]

    Naor and O

    M. Naor and O. Reingold. 2004. Number-theoretic constructions of efficient pseudo-random functions. J. ACM 51, 2 (2004), 231–262

    2004

  43. [52]

    Paillier

    P. Paillier. 1999. Public-key cryptosystems based on composite degree residuosity classes. In EUROCRYPT

    1999

  44. [53]

    C. Paquin. 2013. U-Prove technology overview v1.1 . Microsoft Corporation

    2013

  45. [54]

    Pointcheval and O

    D. Pointcheval and O. Sanders. 2016. Short randomizable signatures. In The Cryptographers’ Track at the RSA Conference (CT-RSA)

    2016

  46. [55]

    Sakimura, J

    N. Sakimura, J. Bradley, and N. Agarwal. 2015. RFC 7636: Proof key for code exchange by OAuth public clients . Internet Engineering Task Force

    2015

  47. [56]

    Sakimura, J

    N. Sakimura, J. Bradley, M. Jones, B. de Medeiros, and C. Mortimore. 2014.OpenID Connect core 1.0 incorporating errata set 1 . The OpenID Foundation

    2014

  48. [57]

    Thomson and C

    M. Thomson and C. Wood. 2024. RFC 9458: Oblivious HTTP . Internet Engineering Task Force

    2024

  49. [58]

    Uber Developers. [n. d.]. OIDC Web SDK. https://developer.uber.com/docs/ consumer-identity/oidc/web. Accessed April 10, 2025

    2025

  50. [59]

    Web Incubator CG. [n. d.]. TrustToken API. https://github.com/WICG/trust- token-api. Accessed July 20, 2022

    2022

  51. [60]

    R. Xu, S. Yang, F. Zhang, and Z. Fang. 2023. Miso: Legacy-compatible privacy- preserving single sign-on using trusted execution environments. In 8th IEEE European Symposium on Security and Privacy (EuroS&P)

    2023

  52. [61]

    Zhang, M

    Z. Zhang, M. Król, A. Sonnino, L. Zhang, and E. Rivière. 2021. EL PASSO: Ef- ficient and lightweight privacy-preserving single sign on. Privacy Enhancing Technologies 2021, 2 (2021), 70–87

    2021

  53. [2025]

    https://arxiv.org/abs/2110.10396

    UppreSSO: Untraceable and unlinkable privacy-preserving single sign-on services (version 3). https://arxiv.org/abs/2110.10396

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.