fbrusch

In Italy every citizen has an electronic ID card that contains a private key and can sign challenges. It also has state-signed credentials/certificates that bind the public key to info about the citizen (date of birth etc).

You can do this: when you want to log into a service, the service provider gives you a fresh challenge C, bound to that service/session. You sign the challenge, and then generate a zkp of the fact that:

1. you have the signed challenge C with a certain public key P 2. you have a state-signed credential/certificate that binds P with a person with birth date BD 3. current date - BD > 18 years 4. optionally, you derived a per-service nullifier, e.g. from the card/credential secret, the service origin and a time bucket, so the service can rate-limit abuse without getting a global cross-site identifier

You send the proof to the service provider, that verifies it, and learns nothing about you (except for the fact that you're of age).

An adult can of course give away the card/PIN, but you need to have it physically to sign fresh challenges, so it cannot be passed around as easily as a bearer token. Moreover he loses access to his actual ID, which is required for other services.

yeah, hashcash is a very neat idea! but had problems like: how do you determine the threshold for the amount of work to be proven? there are values that makes it too expensive for a well intentioned human, and not enough for a bad intentioned spammer... moreover, it would induce economies of scale like it happens in bitcoin mining (spammers would invest in ASICs etc.) Signatures, on the other hand, allow to cheaply leverage other forms of "capital" (digital identity, github activity)

Could this be addressed with cryptography, digital ids and signatures? Imagine it were possible to add a signature that proves that I own some "human" identity (like a national id), or that I possess some scarce resource (like a github account with some level of activity) and that today I sent no more that 20 emails. If I want to conceal my identity, I can use zero knowledge proofs. If you don't sign this way, or if your daily email counter exceeds 100, your mail ends up as spam.