Identity Proxies

Passwords or phrases, a proxy for identity, can be used at scale to assert identity. Two cultural examples of identity proxies are ancient in origin. In the “shibboleth incident” in the biblical Book of Judges, during the battle of Gilead and Ephraim tribes, Gileadite soldiers used the word “shibboleth” to detect their enemies, knowing that the Ephraimites pronounced it slightly differently in their dialect. The stakes were life and death.

In the tales of Ali Baba and the 40 thieves, the phrase "Open Sesame" was used to assert identity by proxy. The concept is that the password as a proxy for access could augment identity and that identity is associated with permission. The point of the word or phrase proxy is to be kept secret from those without privileged access. Sentries would challenge those wishing to enter an area or approaching it to supply a password or watchword, and would only allow a person or group to pass if they knew the password (Polybius). These proxies for access were physical in form as well.


Practically speaking, Herodotus tells us of secret messages physically concealed beneath wax on wooden tablets or as a tattoo on a slave's head concealed by regrown hair. While these are not proper examples of proxied identity in cryptography per se as the message, once known, is directly readable, the identity of the sender can still be kept secret. The evolution of obfuscation by proxy protected not only the content of the message but the identity of the senders. Combined with a encryption; proxied identity evolved greater complexity. The simplest form of passing identity or information without cryptographic protection is known as steganography.


Steganographic methods yielded plenty of outlier techniques such as the Greek Polybius method (now called the "Polybius Square").[5] and the Roman Caesar cipher which used hidden keys and provide the historical basis for modern cryptography. Some form of cryptography (cipher based obfuscation) is required for protecting identity or its password proxies at a minimum. Failures of ciphers have likewise exposed identity even when proxied or identity is kept separate from encrypted payload. The security of passwords and pass-phrases, the two most common identity proxies, being the most important in security access management in ancient times to today.