CoChat
Sign Up
Cited by 416Blockchain Technology Applications and SecurityUser Authentication and Security SystemsBlockchain Technology in Education and Learning

A first look at identity management schemes on the blockchain

Open access
Dunphy, Paul, Petitcolas, Fabien A.P.·2018·IEEE Security & Privacy
DOI 10.1109/msp.2018.3111247
Open this paper in CoChat — free accountOpen PDF

Abstract

The emergence of distributed ledger technology (DLT) based on a blockchain data structure has given rise to new approaches to identity management that aim to upend dominant approaches to providing and consuming digital identities. These new approaches to identity management (IdM) propose to enhance de-centralization, transparency, and user control in transactions that involve identity information; however, given the historical challenge to design IdM, can these new DLT-based schemes deliver on their lofty goals? We introduce the emerging landscape of DLT-based IdM and evaluate three representative proposals—uPort, ShoCard, and Sovrin—using the analytic lens of a seminal framework that characterizes the nature of successful IdM schemes.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/msp.2018.3111247

Cites

5 of 5 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • A DID by itself is only useful for the purpose of authentication, and becomes particularly useful when used in combination with verifiable claims or credentials.

    “ADIDbyitself is only useful for the purpose of authentication. It becomes particularly useful when used in combination with verifiable claims or credentials-another W3C standard that can be used to make any number of attestations about a DID subject (Dunphy and Petitcolas, 2018).”

    From Self-Sovereign Identity in a Globalized World: Credentials-Based Identity Systems as a Driver for Economic Inclusion (2020) · cites this paper as Dunphy and Petitcolas, 2018

    Section 4.1 Design describes a DID as containing an identifier and public key, while section 4.2 Analysis describes Sovrin users sharing attribute credentials with relying parties. Section 6.2 also discusses attestations of identity attributes. The paper does not say that a DID alone is useful only for authentication, nor does it identify verifiable claims or credentials as a W3C standard. Page numbers are unavailable in our copy. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • DLT acts as a replacement for centralized registration authority in traditional identity management systems, where the pairing of identifier and authentication method is maintained.

    “It acts as a replacement for centralized registration authority in traditional identity management systems, where the pairing of identifier and authentication method is maintained [18].”

    From Decentralized and Self-Sovereign Identity: Systematic Mapping Study (2021) · cites this paper as [18]

    Section 2, “Identity management on the blockchain?” (page not provided), describes decentralized identifier–attribute mappings and a scheme that binds public keys to identifiers. But §6.1 says the schemes studied reshape the roles of central authorities and intermediaries rather than eliminate them. The paper therefore does not support the unqualified claim that DLT replaces a centralized registration authority. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • DIDs and VCs are directly managed and controlled by the identity holder, stored in user-controlled off-chain storage, and can be presented to any relying party when needed.

    “DIDs and VCs are directly managed and controlled by the identity holder.They are stored in the user-controlled off-chain storage and can be presented to any relying party when needed [18].”

    From Decentralized and Self-Sovereign Identity: Systematic Mapping Study (2021) · cites this paper as [18]

    Section 4.1 (page unavailable) says Sovrin DIDs are managed by the user or an appointed guardian, while identifiers, keys, and endpoint addresses are stored on the ledger. Section 4.2 (page unavailable) says users choose which attribute credentials to share with relying parties and generally prefer phone or agent storage, but may store attributes on the ledger. The claim overstates the paper by saying both DIDs and credentials are directly holder-controlled and stored off-chain. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • In information sharing, traditional trusted third parties (TTPs) that use certificates to provide non-repudiation services are being replaced with distributed ledger or blockchain technology (DLT).

    “In information sharing, traditional trusted third parties (TTPs) that use certificates to provide non-repudiation services, are being replaced with distributed ledger or blockchain technology (DLT) (Dunphy & Petitcolas, 2018;Ølnes, Ubacht, & Janssen, 2017).”

    From Data governance: Organizing data for trustworthy Artificial Intelligence (2020) · cites this paper as Dunphy & Petitcolas, 2018

    The Introduction describes DLT as operating without a central authority to validate ledger transactions, and §6.2 discusses sharing identity attributes certified by third parties. But §6.1 says the schemes reshape rather than eradicate intermediaries. The paper does not establish that certificate-based trusted third parties providing non-repudiation services are being replaced in information sharing. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • SSI is user-centric, allowing users to generate and manage unique decentralized identifiers (DID) independent of any third party and acquire identity attributes from third-party issuers.

    “Therefore SSI is user-centric [18], allowing users to generate and manage unique decentralized identifiers (DID) independent of any third party [19] and acquire identity attributes from third-party issuers.”

    From Decentralized and Self-Sovereign Identity: Systematic Mapping Study (2021) · cites this paper as [18]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. [4]4. Muneeb Ali, Jude Nelson, Ryan Shea, and Michael J. Freedman, 'Blockstack: A Global Naming and Storage System Secured by Blockchains', in 2016 USENIX Annual Technical Conference (USENIX ATC 16), Denver, CO, 2016, pp. 181-194.
  2. [15]15. Shayan Eskandari, David Barrera, Elizabeth Stobert, and Jeremy Clark, 'A First Look at the Usability of Bitcoin Key Management', presented at the NDSS Workshop on Usable Security 2015 (USEC 2015), San Diego, California, 2015.

Cited by

Sorted by citations

Related

Authors
Dunphy, P., & Petitcolas, F. A. P.
Affiliations
OneSpan Innovation Centre
ORCID
Petitcolas, Fabien A.P.
Venue
IEEE Security & Privacy
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2018-07
Volume
16
Issue
4
Pages
20-29
ISSN
  • 1540-7993 (ISSN-L)
  • 1558-4046
DOI
10.1109/msp.2018.3111247
OpenAlex
W2783837064
Cited by
416
References
5
Citations by year
2026: 13 · 2025: 41 · 2024: 46 · 2023: 54 · 2022: 55 · 2021: 71 · 2020: 78 · 2019: 50 · 2018: 8
FWCI
83.46
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Security & Privacy (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology in Education and Learning
Keywords
identity management, blockchain, distributed ledger technology, digital identity, decentralization (distributed systems), user control, transparency

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review