Information Disclosure in Identity Management

User Controlled Identity Management Systems have the goal to hinder the linkability between the different digital identities of a user. We perform a theoretical and an experimental study of the following information leakage problem: given a consistent view on the actions of a strong identity management system (e.g. Idemix ) where k users pseudonymously issue and show some credentials, do these observations disclose sufficient information about the linkability of the digital identities? We show that in theory, linking the different pseudonyms of a user is a NP-complete problem, by using first order logic. In addition, we evaluate practical instances of the problem, and show that there are non-negligible probabilities that despite full anonymization and use of an identity management system, pseudonyms are unambiguous linkable.