Repository navigation
secure authorization via asymmetric cryptography #3
Description
Hashing each object can only get cyphernet so far.
Things become much more interesting when you add asymmetric cryptography.
For example, if you only had a author field with a username in it,
anyone could publish a blog post, and claim it was me.
You wouldn't have to leave your phone unlocked to get a #poopin in your feed,
anyone could just distribute a post with any user name on it.
The solution is for all critical objects to be signed
(if you have a tree it may be acceptable to only sign the top object)
However, I can sign a post with a public key, and then it can be verified to be by me.
Or rather, be made with the device that I control. Subtle distinction here.
You are your device. probably want to make sure it's password protected,
or implanted under your skin, etc.
There is more work/research to do here.
I have read that PGP is basically "what you want" here.
I have looked into this a bit, but need to do more research.
Here is a list of papers
https://gist.github.com/hij1nx/6107937 @hij1nx recommends
Possibly, the best way to do this might be just to use pgp,
But then pgp has a well earned reputation for being "not easy".
And, the various things you'd require for implemented a PGP,
like, storing a bunch of keys, creating links between them (signing them)
and then evaluating them by traversing them is exactly the sort of thing
that cyphernet is to make easy to do. So, probably the best is to
build a PGP with cyphernet.
Activity
tristanls commentedon Oct 22, 2013
On the topic of trust networks, it may be beneficial for you to consider the Grant Matcher Puzzle described here: http://www.erights.org/elib/equality/grant-matcher/index.html. The Grant Matcher Puzzle is a litmus test of sorts to see if a distributed trust model is sufficient.
dominictarr commentedon Oct 22, 2013
thanks, looks interesting!
/cc @hij1nx