Architecting against fraud: How digitizing credentials helps post-breach

In an era where data breaches are not a matter of if, but when, a critical part of organisational threat modelling is to consider what damage can be done when the data they collect and store is leaked. With digitally verifiable credentials starting to gain adoption around the world, will this help or hinder the subsequent threat of identity fraud once this data is inevitably leaked?

Having worked for over a decade in network security, particularly network detection and response, I’ve seen the number of times security defences are bypassed or otherwise fail, ultimately leading to the detection of a data breach. Whilst every breach of personally identifiable information likely has negative knock-on effects, ones that enable identity fraud are particularly troublesome. 

In many jurisdictions, the possession of the unique number identifying a passport, driver’s license or other government-issued credential is sufficient to prove one’s identity in another system. In Australia, three high-profile data breaches in the past three years have seen this kind of information leaked, with each breach affecting between 40% and 50% of the Australian population. 

At first one might assume the adoption of digitally verifiable credentials across the world will make this problem worse, in part due to the perceived loss-of-control over what were once physical credentials held in one’s wallet. However, the reality is quite the opposite. Using the world’s most prominent digital credential format – the ISO/IEC 18013-5 mdoc / mobile driver’s license / mDL – as an example, this session will walk through that standard’s technical characteristics that result in a world where even if presentations of those credentials are leaked, they cannot be re-used for subsequent identity fraud. This will include detailing the mandatory cryptographic key binding and mandatory selective disclosure support for all fields that is present in this standard. Comparisons will be drawn with other standards that provide optional facilities for these characteristics.