Trade-off Analysis of Identity Management Systems with an Untrusted Identity Provider