Or is authentication essentially incompatible with anonymity?

If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown identity, could you have a system that could authenticate you but that you could still use anonymously?

Would adding a 3rd party service to the mix change the answer?

  • 1
    How does that differ from having multiple, uncorrelated identities? – Gilles Jan 1 '14 at 16:30
  • well the idea here would be that within a system (so presumably with the single identity you're known by there) you could be both authenticated and anonymous. Indeed I guess one option would be that you sign in with Identity 1 and then are only known by Identity 2 after that... – Rоry McCune Jan 1 '14 at 16:33
  • Nick P. on Bruce Schneier's blog recently linked to an interesting related paper. I can't pretend to understand the whole thing, but it is fascinating reading. – Jonathan Garber Jan 14 '14 at 15:19

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national.

A person may well have multiple identities. For example, people with dual citizenship have two passports and what they do with one is somewhat decoupled with what they do with the other.

Multiple identities are the basis of anonymity. Indeed, as soon as you interact with anyone else in any way, this creates an identity: you're the person who did this thing at that time. Anonymity is not a lack of identity, but a lack of a link between a certain identity and any other identity that you may have.

Coming back to authentication, it is a link between two identities: the person who did that thing at this time is the same person who owns these credentials. Phrased this way, authentication is exactly contradictory with anonymity. However, there are many situations where it is useful to have partial authentication or partial anonymity.

An obvious solution to partial anonymity is to have a trusted third party as an intermediary. I'm using one right now: you know me by my Stack Exchange account, and you can use this identity to authenticate my Stack Exchange activity. Stack Exchange knows me by an identity with an OpenID provider, but isn't telling you. My OpenID provider in turn knows some things about me, but they only know the name on my passport if I've been telling them. There is a chain of links between identities (which could be traced all the way to, say, my home address via ISP logs), but you need the collaboration of multiple parties to resolve the chain.

How satisfactory such situations are depends on how the identification linkage chain is set up and what parties you're prepared to trust. Having identification linkage chains that are practically impossible to trace is the basis of anonymity systems such as TOR.

Going in another direction, authentication is very often used for authorization. I may use this account because I am the account owner. I may enter this building because I am an employee. An authorization system can be set up to decouple the action that is being authorized from the identity that led to the authorization. A well-known example is voting systems: they have both strong authorization requirements (only registered voters may vote, and only once per election) and strong anonymity requirements (even I cannot prove who I voted for, at least not if I want my vote to be counted). In traditional voting systems, anonymity is ensured by stepping into a booth to put a standardized piece of paper in an opaque envelope. Anonymity is ensured by observers who control that everyone steps into the booth and by rules that make non-anonymous ballots void.

  • 1
    Nice answer. Despite some opinions on the security behind voting, voting is only one way communication once authorized. Can you think of any Authorization & Anonymity examples where the system would be able to return data to the anonymous party? Not that your answer is incomplete, this is just to serve my own curiosity. – David Houde Jan 2 '14 at 16:25
  • @DavidHoude An obvious, but contrived, example would be to modify voting include some random data (such as a freshly generated public key) in the ballot. This preserves anonymity if the voter desires (but of course destroys the anonymity enforcement that is desirable in voting), and the nonce can be used to communicate back (only the voter would know that he knows the private key). – Gilles Jan 2 '14 at 19:00
  • More generally, if the system is to track something back to the voter, it needs to know an identity of the voter, but there may well be anonymity protocols that allow this identity to be decoupled from the identity “the voter who was in booth 3 at 11:32”. I can't think of a more natural example right now. – Gilles Jan 2 '14 at 19:01
  • 1
    @Gilles, Isn't Bitcoin effectively authenticated and anonymous at the same time? – Pacerier Jun 5 '14 at 7:54

There are several definitions of anonymous.

As per the free dictionary for example, "Having no distinctive character or recognition factor" is anonymous. Eg: Having an unknown or unacknowledged name: an anonymous author.


As per Google, (of a person) not identified by name; of unknown name.

tl;dr: Through all these definitions the one thing we can establish is the fact that behind every real or fake anonymous persona, there is inherently a very real person who made it. Anonymity therefore lies in the lack of information correlating the real identity and "anonymous identity" of the person. The more the correlation's tangibility, the lesser the obtained anonymity.

For example, voting in a democratic process, votes must be verifiable, but yet anonymous. It's a clear example of how it is possible to have a system where within the system you are anonymous. Votes are termed anonymous because you can not correlate a vote to a specific individual.

There are three limitations to this approach:

1) For anonymity, there can not be a distinguishing factor. For example, in an "anonymous publishing system" writing works would have distinctive characteristics that could be used for recognition. Or in a voting system, those close to the person voting would know his vote. Or you can interrogate a person until he gives up his anonymous vote (both of which can be flawed by disinformation).

2) Numerical Strength Numerical strength makes it harder to tie patterns to one individual.

3) Legal Standpoint Any system that goes "against the law" will have to prove accountability for the accused illegal actions. If it fails to do so, there will be attempts to shut/disrupt the system's functioning. Additionally as history shows, all its members will be treated equally liable as the anonymous identity that committed the accused crime.

In practice, if you had to authenticate someone, you would need a secret.

If this secret was shared amongst all trusted members based on an identity requirement (how voting is done), then when inside the system with static input their identity would be anonymous. In case of dynamic input systems, the person would have to reduce recognizable marks enough to blend into the system's population to stay anonymous. The problem in this system that gives you authentication and anonymity, is accountability if data leak prevention fails. That is, if the shared secret is leaked, there is no viable long term defense measure.

If the secret is not a shared secret, but rather unique to a each person, then the system must be designed such that it does not leak session data when making a post. Eg. All posts on /b/ appear as Anonymous. Obviously, the backed should not have logs for IP, etc as well. In this scenario, a leak is isolated to that person's online identity on that system only, thus preserving system security. Since in this implementation there is no correlation between the now selectively isolated user and his real life identity, he is still anonymous. Obviously, the limitation of this is a reset. In case of a forum, banning an anonymous member would mean that he can re-register. In case of a voting systems, banning a compromised account would mean that the user would have to wait until the entire systems' users reset. Eg: If the counter for voting for a candidate fails, then people can't really complain about it while being anonymous. They would have to wait for next year or complain about it after giving up anonymity. However, it would work when banning a member from a system that does not accept new members.

So in this case, you can build systems to have authentication and ensure anonymity of actions while within the system, however unless you fake legal documents, being truly anonymous in the system of life is not a possibility.

A 3rd party in this case would be to ensure the system itself is not compromised. But the system is inherently only as safe or as vulnerable as any other software built.

Lastly, BitCoins is another example of where it is possible to have a system with authentication, accountability and anonymity within the system. So yes, it is possible. What's not possible is to guarantee that all successful authentications by the original real identity that formed the online identity.

  • “In practice, if you had to authenticate someone, you would need a secret.” This is true in any information-theoretic setting, but not always in the real world. What you really need is something that cannot be replicated. Any mathematical object can be replicated if known, but this is not always true of physical objects. – Gilles Jan 2 '14 at 19:06
  • I guess that's where I'm stuck then. As per my limited understanding, authentication is just a mechanism to try to associate two identities accurately. Eg. Allowing Rohan from irl access to Decode141 at Gmail for example. The way I see it even if you have an in-replicable physical object, the authentication fails if the object and its functioning become available to one other than the authorized party. Eg: The password is useless when it is no longer a secret. Could you point out where I'm going wrong? – Rohan Durve Jan 2 '14 at 22:10
  • Biometric measurements are an authentication mechanism. They're difficult to use properly, but that's a different problem. Another example: cash. – Gilles Jan 2 '14 at 22:16
  • Yes, I agree, they can both serve in authentication mechanisms, but both biometrics and cash are examples of replicable objects. The question really is that if your biometrics or your government's processes and mechanisms to print currency are an open secret or not. If your iPhone fingerprint lock can be broken by a fingerprint clone of your actual finger, then the systems security lies in the secrecy of your fingerprint. Does it not? – Rohan Durve Jan 2 '14 at 22:20
  • I partly agree with the cash example: the processes are secret, however the objects are out in the wild. With biometrics: a clone in the biological sense is out of reach of current technology. A good-enough replica reaches the limit of current technology if used right (which involves a reliable guard to verify that a real finger is used, not a cutoff). – Gilles Jan 2 '14 at 22:23

Batman was temporarily stunned. The goon crouched over him and tried to grasp his mask.
- What are you doing, you fool ? rasped the Joker.
- Hu, I wanna see his real face, guv'.
The Joker lashed his cane at the thug, sending him rolling to the floor.
- Idiot ! The mask is his real face !

Authentication is about making sure that some data (or action, as @Gilles says) really originates from somebody who matches a given notion of identity. However, any individual has a lot of identities. Consider, for instance, a Web forum (or a Q&A site as this one). And a user; let's call him Bruce. Bruce has created an account under the pseudonym of "racoonman". The account is linked to his email address, which is "racoonman@anonemail.com", obtained from a provider of "free mail accounts". Bruce connects to both the Web forum and the email provider only through Tor (for this question, we assume that Tor provides perfect "anonymity" in that connections cannot be traced back to Bruce's name or IP address).

In a sense, Bruce is completely anonymous: the messages he posts on the Web forum cannot be linked to his "true name", as defined by legal authorities. On the other hand, he is not anonymous at all. To illustrate this, let's assume that another individual tries to create his own account on the forum, with the same pseudonym of "racoonman", and then proceeds to posts messages under that name, with outrageous contents that Bruce finds demeaning. Bruce will be very irate; he will denounce the framing with the utmost vehemence; he will call upon the forum administrators to make the usurpation cease; at the very least, he will unleash all his rhetoric fury on the villain who dared steal the good name of Racoonman.

Therefore Bruce is "anonymous" on the forum because Bruce is not really using the forum; Racoonman is connecting. And Racoonman is certainly not anonymous; he will defend to the death his name and fame. Yet Racoonman's identity is limited in scope; it exists only on the Web forum, and, more importantly (for Bruce), it is not traceable to Bruce's legal identity. The anonymity that Bruce is looking for is really this absence of link between his two personae. Yet Racoonman is certainly well-authenticated from the point of view of the forum administrators: he uses his password and they are quite sure that it is the same Racoonman all along. That is the notion of identity which is at work on the Web forum: that several messages can be unambiguously linked together as being from the same author, whoever that guy may be.

The many facets of identity and anonymity are an attractive playground for cryptographers. For instance, there is the nice concept of ring signatures as described in 2001 by Rivest, Shamir and Tauman. In this algorithm, each user in a group has his public/private key pair, and the public keys are all known and unambiguously linked to the individual group members. Then one group member can take an arbitrary message and produce a signature on it, with the following properties:

  • The group member signs using a combination of his private key, and the public keys of all other group members. The other group members need not cooperate or even be aware of the signature generation.
  • Anybody can verify that the message was signed by one of the group members. It is not feasible, for someone not knowing at least one of the members' private keys, to generate a signature that the verification algorithm will accept.
  • Nobody can pinpoint which group member produced the signature. Even if all other group members collude and reveal their private keys, it cannot be proven that the message was signed by a specific group member.

Ring signatures thus realize an interesting mixture of authenticity and anonymity. A ring signature absolutely demonstrates involvement of "a group member" while absolutely protecting the member's identity within that group (even against the other group members) -- that is, everybody knows who is member of the group, but the signed message cannot be traced back to a specific member.

(On the surface, we could have the same kind of property by using a single signature private key that all group members know; but ring signatures allow for adding and removing members at will, and the signer can even "create" the group whenever he signs, since the other members are not actively involved.)

An important point to make is that this notion of anonymity is not the same as the one used above in the Web forum example. Depending on the context, someone who wants to be "anonymous" might want to refer to one notion of anonymity, or the other, or yet another of the myriads of possible definitions.

  • 1
    "Guys, we're wasting our time, I'm pretty sure there's a cryptographic protocol designed exactly for this" - Some Wise Guy on DMZ. – Rohan Durve Jan 2 '14 at 16:06
  • racoonman strikes again :P – Tobias Kienzler Jan 3 '14 at 8:19

This all depends on the purpose of the authentication. Authentication has nothing directly to do with identification, rather authentication is a process by which one person or system determines that they are okay dealing with another person or system.

In most cases this means something like a user log in system, where each user has some identity, and something like a password is used to authenticate.

However that is not necessary, maybe I'm not trying to say only people the system knows are allowed, but rather, only people are permitted. That is what capchas are for, they authenticate the humanity of a user.

Another example is a great history of persecuted groups (often underground religions) that would use special signs/symbols/phrases to tell others that they were part of the group. In such cases anonymity was incredibly important, but authentication was still possible.

So the answer is that anonymous authentication is most certainly possible, but the applicability depends on the particular use case.

  • "Authentication has nothing directly to do with identification" - hmm? Authentication is, by definition, verifying proof of an identity. E.g. from Wikipedia: "This might involve confirming the identity of a person or software program [...] Authentication often involves verifying the validity of at least one form of identification." – AviD Jan 2 '14 at 10:51
  • Authentication is the process of determining that something is authentic. THe question is: we want to know if it's an authentic what? Registered user? Needs identity. Human? Adult? Member of secret cult? Identity not required, just some way to verify that you have a certain quality that the system requires of you. – zeel Jun 6 '14 at 5:51
  • ... and that quality is precisely the "identity" which we are authenticating. Digital identity is not necessarily "who you are for reals", it is a set of attributes defining what the system knows about you (e.g. a subset of "who you are", or some facet of this). I often like to point out, yknow what the most often used form of identity on the web is...? "YES I am over 18 years old, now let me in." – AviD Jun 8 '14 at 19:14

You could have authenticated communication over a system in which you do not use your real names, but you have set up together so that the two of you know who each-other is. In this way you would be anonymous to everyone else but be authenticated to each-other (Off-The-Record chat, or OTR, would be an example of this). A third party makes it easier, because it could authenticate both participants but they would not know who the other is. This idea is used in the "web of trust" concept that GPG and PGP users use to authenticate each-other, they use cryptographic signatures of people they trust to confirm the validity of encryption keys they do not know.


The SQRL project over at GRC offers a pretty simple but brilliant system for Authentication without identification. Granted, without the necessary precautions (using a VPN or such to anonymize your IP), you may still be able to be identified by certain means.

  • 1
    This doesn't really answer the question, perhaps it would be more suitable as a comment. That said, please note that SQRL has been debunked, e.g. see this question. Simple, yes, brilliant - not so much. – AviD Jun 8 '14 at 19:18

Your Answer

