KuppingerCole's Advisory stands out due to our regular communication with vendors and key clients, providing us with in-depth insight into the issues and knowledge required to address real-world challenges.
Unlock the power of industry-leading insights and expertise. Gain access to our extensive knowledge base, vibrant community, and tailored analyst sessions—all designed to keep you at the forefront of identity security.
Get instant access to our complete research library.
Access essential knowledge at your fingertips with KuppingerCole's extensive resources. From in-depth reports to concise one-pagers, leverage our complete security library to inform strategy and drive innovation.
Get instant access to our complete research library.
Gain access to comprehensive resources, personalized analyst consultations, and exclusive events – all designed to enhance your decision-making capabilities and industry connections.
Get instant access to our complete research library.
Gain a true partner to drive transformative initiatives. Access comprehensive resources, tailored expert guidance, and networking opportunities.
Get instant access to our complete research library.
Optimize your decision-making process with the most comprehensive and up-to-date market data available.
Compare solution offerings and follow predefined best practices or adapt them to the individual requirements of your company.
Configure your individual requirements to discover the ideal solution for your business.
Meet our team of analysts and advisors who are highly skilled and experienced professionals dedicated to helping you make informed decisions and achieve your goals.
Meet our business team committed to helping you achieve success. We understand that running a business can be challenging, but with the right team in your corner, anything is possible.
In a world where everyone has a large amount of different personas and credentials stored and managed by government, banks, socials and other, we call for consolidation and control while preserving privacy and security. With DLT a lot of that call can be answered, but how do we roll-out. There are some major challenges to adoption such as usability, network economics, governance, privacy and recoverability. How do we approach these challenges to reach a global self-sovereign identity platform?
In a world where everyone has a large amount of different personas and credentials stored and managed by government, banks, socials and other, we call for consolidation and control while preserving privacy and security. With DLT a lot of that call can be answered, but how do we roll-out. There are some major challenges to adoption such as usability, network economics, governance, privacy and recoverability. How do we approach these challenges to reach a global self-sovereign identity platform?
Thank you. It's your turn and the device should be somewhere over here. Thank you. And apologies. I'm I have a little bit of a cold. Yeah. So I saw you struggle a little bit with the title. And when I was preparing for the call for papers here, I was thinking about, what do I want to talk about? And I made the mistake of writing that down concisely and then forgetting to change that into a proper title. So I wanna talk about the adoption of blockchain identity or self-sovereign identity, basically.
And I also wanna thank my predecessor because he has introduced the concept of self-sovereign identity, leveraging blockchain for me, which chased me a bit of time. On the other hand, he did also cover a lot of the topics that I will be speaking to, but I'll try to keep it engaging and interesting for you. So why do I think this is an interesting topic because technology just doesn't J in itself doesn't drive adoption. There are more things that drive adoption, and we've heard before today in this, not today, but in this conference, how do I get people to care about self-sovereign identity?
And that's an interesting question. And when I hear a question like that, I think, I think about my father, my dad, what, what, what do, what needs to happen for my dad to start using and caring about self-sovereign identity? And I think that's, that's a difficult question. So just to set the stage and I won't reiterate too much, but what do I mean when I think about self-sovereign identity, it's a place where everyone can create their, create their online identity, manage it and use it.
You can put attributes claims on, on your identity, have that verified by an organization that you already have a trust relationship with such as a bank or a government. And then you can use that to make yourself known with new organizations or people that you don't have an existing relationship with. And one thing that I want to add, and that's, that's the sovereignty part that is very important, I think, and I'm aiming high that it should be resilient.
This, this network, this solution should be resilient preferably to something like a nation state attack, not only at the technology level, but also the governance and the process level. So that's why I think it makes a lot of sense to think about a tool, which it is such as blockchain or distributed leisure technology. So what's the value of this. First of all, to organizations, relying parties, the value is, and this has been said that you don't need to do the validation of attributes when during onboarding over and over again, you can trust.
What's been presented to you and you also don't have to manage credentials because people are responsible for keeping own private key, private, and use that to make theirself themselves known. So you don't have to let's say store a password and all the, all the mess around that for the end user, for the consumer, the promise and the value is that you have a single set, you have a single place where your identity is stored and you have complete control over it. So it's mostly privacy. So if I look at adoption of technology, I want to look at the past.
So I'll, I'll look at some examples of past technology adoption. And I'll give you a few seconds to look at this diagram and to look at this picture and think if you know, what, what I mean with this? This is distribution. This is the power grid across the world. This is technology, which is interconnected. It's ubiquitous, it's global. And still we have the situation where there are 16 different power plugs. And this is because when this, the power grid was adopted, it was regional. It was local and it was parallel. And the second question is, why are we still here?
Why do we still have this? It's because the adoption was accompanied by large investments into infrastructure. So the cost of changing greatly outweighs the cost of integrating. Then add to that the free market, which is more than willing to provide adapters. And you have an additional pressure to keep us in the same space. Another one, which I think is even more extreme, the real way system. Does anyone know what this is? This is the border between China and Mongolia. Where when a train from China goes to Mongolia, it has to stop. Everyone has to get out.
The train is literally lifted into the air and the wheels are changed to fit the different gauge size in Mongolia. And when I learned about this, I was really, it baffled me, how can this still exist in something as interconnected and, and, and global as, as railway tracks. And it's not only in Mongolia where this, where this is the case, another example, keyboard layouts, you might recognize this. You may not. Most of you are probably more familiar with the QUT layout, which was designed in the 19th century when the typewriter was created. And it was optimized to prevent collisions of hammers.
When you were using the typewriter. Then later, when we switched to electronic type writing, new layouts came there, it came and they were optimized for typing speed, which makes most sense because you want to, to be easy to use. And that's what this layout is. It's layout created in 1930s, and the adoption is close to zero.
I, I would, I would has, I, I would almost say that I'm, I'm pretty confident that almost no one in his room uses a Devor keyboard on a daily basis. And then finally, because there's so much fun and then I'll go onto the contents. This is left and right driving countries in the world. And here you combine the two, right? So it's both an investment in infrastructure and it's behavior where, which is keeping us in the same, in the same space, in an equilibrium, there was a country in 1967 that switched from left driving to right driving. It was Sweden and it looked like this.
So imagine what happens, what it would look like today, if, for example, the United Kingdom, which would switch from, from left driving to right driving. Okay. So the point of all this adoption of standards is hard and the global adoption of standards is very hard. So when thinking about, let's say a blockchain for self-sovereign identity, should we aim?
Should we, do we really need a single global standard? I think it's not realistic to expect that we will get there, but I do think that we really need to aim for as little as few networks as possible. Ideally one. And the reason I think that is because if you look at, for example, the security of blockchain, it scales with size. So if you want the network to be really resilient, you need a lot of participants. So I do think that we will end up with multiple that's. Why during this conference, the D I D universal resolver was presented multiple times.
I think it's a pivotal piece of technology that we need that we will need in the end, but I would hope that it would only resolve to a few blockchains because then you can really say that these blockchains are really, really secured due to their size. So what does academia say about technology a lot? I don't want to make this too academic. There is the adoption curve. There is something like the technology adoption acceptance model. And there is one that I like really much, which is the lazy user model, which is basically saying that my dad is lazy, which is true.
It describes how technology is adopted by end users. So in the middle, you'll see, you see that there is a certain set of solutions available, for example, social ID or government ID or self-sovereign identity. And that is basically defined by what the user needs, and this is changing ever so slightly. So if you look at the rule today, I think the user need is changing a little bit due to things like, for example, the Cambridge Analytica scandal, where the user need is changing, even just a little bit towards wanting more privacy, it's also limited by user state.
So for example, let's say we define, we create a self-sovereign blockchain based identity system that forces you to authenticate using your fingerprint. Well, then people without hands won't be able to use it. And then on the right hand side, it basically says that if you have this resulting set of solutions, then we will take the one with, we will take the one with the low, lowest cost, lowest energy state. Now look talking about energy states. I have a background in theoretical biology, believe it or not. And theoretical biology is about modeling dynamical systems.
So for example, population sizes of praise and predators and how they evolve over time. And it's all about equilibria. It's about defining and finding equilibria and choosing, determining the paths to switch between equilibrium. And I think we are now in an equilibrium where social identity and government identity and local identity is. What's what, we're, what we're stuck at. And that's why this, this is the first big challenge.
If we are able to define a new solution self-sovereign identity, which is if you will, at the lower energy state, then the first challenge is you need this critical mass to put us over the hump and into that new equilibrium, by the way, this diagram is borrowed from quantum physics. It describes quantum tunneling. These are energy states, actually energy states of electrons. And quantum tunneling says that in quantum physics, the electron can go to a lower energy state without taking the hump. So that's the yellow arrow.
And if anyone here knows how to what the real world equivalent of that is, then please let me know. I'm very interested. So this is the first challenge, critical mass having the, the, the power to put us over the hump. And then the second big one is how do we define self-sovereign identity such that it actually is that equilibrium in a lower energy state than what we currently have with social identity and government identity. So critical mass. And I'm sorry to say, this is the exact same example as my predecessor is really a chicken and hand problem.
What is the, if you create a self-sovereign identity network, it will, people will only onboard to it. If they can use it with a lot of organizations and a lot of organizations will only invest in it, if it presents a lot of users to them. So this is the chicken and egg problem, by the way, this is a magical egg. It must be because that's the only thing that solves the chicken and egg problem. So how do we, what are the, the main challenges to bring down that energy point and divine the self-sovereign identity in a low energy state? These are the four that I think are the overall big topics.
First usability in a blockchain. When you create your own account, you are responsible for keeping your own keys safe. That also means that you have recoverability problem recovering from loss of keys and theft of keys. So for security savvy, people like myself, I would just write it down and keep it safe somewhere and encrypt it and give it to someone else. But my dad will definitely not do that. So there needs to, you need to have a fiduciary, an existing trust relationship that you can give your backup keys to. And this has to be very simple.
So then to illustrate this further, let look, let look at the onboarding scenario with usability in mind and the low energy state in mind. Nowadays, typically, if I want to onboard to a new web shop, for example, I just fill in a registration page and I know with social identity, this is even easier, but I just fill in a registration page. I verify some of my claims, for example, with text message or an email link. And then I select my password and then I'm good to go. This is what it would look like for self-sovereign identity. I would have to explain to my dad what it is.
He has to understand it and have to say, yes, I'll go for this. Then he still has to register, create his, create his, his wallet. Then he has to think about what's my backup scenario, find the fiduciary. Then he has to choose his credentials because yeah, you don't memorize your private key. So you have to have something on top. And then he has to go to one or more existing organization, such as his government to get his claims verified, where he has to authenticate and, you know, go to that process.
Again, that's a lot of work. And then finally, he can go to this workshop and, you know, present his claims. And granted, these are only two steps, which is less than three, but the first five are really a barrier and it will really limit the adoption to, to, to an extent that I think it will. It won't happen. So the second one privacy on the blockchain, the blockchain is open transparent. It's it's its nature.
It needs to be is that even reconcilable with, with privacy, where you want to make sure that, that everything, that all your attributes are completely controlled, who has access to them? I think it is because the amount of information on the blockchain that needs to be there is only needs to be sufficient to verify that the transactions are valid, so that doesn't need to be your birthdate. For example, it also doesn't have to be on the chain.
It's been, it's been set many, many times and don't want to be the umph person that says don't put PII on the blockchain, but there are challenges with that as well because it introduces additional infrastructure that has to be made available, kept secure, kept back, back up and et cetera. So if you put your, your PII off chain, for example, on your phone, then you still have the problem. If I lose my phone, then I have to reassert everything and reregister, there are some interesting developments in this area.
This is a, a diagram about zero knowledge proofs. And if you want to know more about this, I really, really recommend looking into Zcash, which is, which is a blockchain using zero knowledge, proof, Z case SNS.
And it, it has some very, very interesting effects. So for example, if you look at a chart, typical chart for Bitcoin price, you see two things, price and volume for Z cash. You can know price because that's, what's in the market, but you cannot know volume because the contents of the transactions is really unknown. No one knows who the receiver is. No one knows who the sender is and no one knows the amount and that, and all the data is on chain.
And, but it's, it supports really selective disclosure. So only the recipient and the sender know, know the amount I think even more important. And this relates also back to usability is a persona management. If I want to go to a hospital, I might share a lot of details about myself, even though it's as badly photoshopped though, crisp persona about myself. But if I go to a shopping mall, I want to be pseudonym as pseudonym as possible and managing all this needs to be very, very simple because otherwise my, my dad definitely won't do it.
And, and you end up using the same identity everywhere, and you're at the same place with social identity economics. That's the third one. So crypto economics is a very big topic and it's, it's a combination of game theory and crypto cryptography and economics. How do we create a system such that is interesting for everyone to participate and everyone can find a business model in here. This is very, very challenging, especially in public blockchain, in, in permission, blockchains, this is a bit easier to solve, but this is definitely one of the hardest things to do.
If there's not a viable business model organizations, won't, won't jump in. And finally governance governance for organizations to participate in self-sovereign identity. There needs to be trust that the governance of this, of this network is functioning and that it's fair and that they even can participate in it. So these two examples are from off chain governance. Bitcoin is completely dysfunctional from my perspective, because there is an impasse between Bitcoin core developers and minors.
And there hasn't been a change to the Bitcoin network for two years, even though it's been struggling in multiple areas and change is definitely necessary on the right hand side is an example from the best governance that we have. So in the world so far are global standards bodies like three WC WC, but it's still not impervious to nation state attacks because we all know that we now know that the NSA influenced RSA to, to choose a weaker encryption algorithm for their new elliptic curve standards, to be able to monitor the internet.
Also here, there are some very, very interesting developments that I think are very promising, which is doing governance on chain with voting. And I really recommend looking into that as well. And I'm aware that I have only one minute left, so I will sorry, including Q and a. Okay. So how to move forward. I don't want to leave you feeling very pessimistic. I think that there are, is a way forward. I think that there is a place for blockchain in self-sovereign identity. And I think these are the key ingredients that I will leave up here. And then there is one minute for Q and a. Okay.
Thank you very much, Renee. Very insightful. I like this quantum Slide. The quantum tunneling. Yes. Yeah. That's that's, that's a nice one. We should figure out how to do that for the blockchain adoption or blockchain idea, adoption stuff.
And I, I adoption stuff and yes, it will be interesting to see how our parents adopt that or in general, me and the other from the older generation on the other hand, the, the awareness for we need better. Privacy might be bigger than with younger ones. It might be the other side of things. And I think there's also, basically, that would be the question I have seen at least before I moved up to the stage, or there are a couple of questions. So younger generations are more likely to adapt and change. Is that the target audience? I think we would've casted.
So roughly maybe let's pick the first question. It's not a super easy one, but maybe you can give a quick answer on that. So what would limit a company from requiring users to provide information, verifying all and attributes, for instance, app permission. So maybe you could get a quick answer on data before we don't close, Basically nothing GDPR, maybe because asking for certain information and processing that needs to have a, a valid use, but ultimately it's a relationship that you have with your organization.
And if, if one of the requirements for you to engage in a relationship is that you give me all your information, then it's up to you to say yes or no. Okay. So thank you again, Renee. Thank you too. And I'll take this one. Yes. Okay. All right. Fair.
