Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are we self-sovereign PKI yet?

buffrr.dev

Post reply on HN
Print view View original

21–30 of 92 posts

Re: Are we self-sovereign PKI yet?

#21

Post by irq-1 »

lxgr wrote: post #12
irq-1 wrote: post #6

> The same key, in every app, for every recipient. Not assignable to anyone else, not revocable, not subject to suspension. Yours forever. This is impractical and the opposite of what we want. It's a required ID to use the internet, monitored by governments, tracked by corporations, and forever unchanging. What we need is a system that allows people to easily create new IDs, that updates contacts that people choose.…

> What we need is a system that allows people to easily create new IDs, that updates contacts that people choose. > Contacts would need to be always online. That also sounds impractical. > It's a required ID to use the internet How does any of that follow? Having a reusable self-sovereign ID format for those scenarios where people want to share it is very different from having an authority-issued ID format that's man…

If the ID is permanent then governments will require it, because they can. If it has attestations or endorsements, governments will require a government endorsement. Think about what China, Iran or Russia would do with a permanent ID being a standard. The US, England and the EU are not immune to the same impulses.

Always online is no different than an email account or website, and the rate of change would be, at least, minutes not seconds.

Re: Are we self-sovereign PKI yet?

#22

Post by lxgr »

irq-1 wrote: post #21
lxgr wrote: post #12

Earlier quoted context omitted.

> What we need is a system that allows people to easily create new IDs, that updates contacts that people choose. > Contacts would need to be always online. That also sounds impractical. > It's a required ID to use the internet How does any of that follow? Having a reusable self-sovereign ID format for those scenarios where people want to share it is very different from having an authority-issued ID format that's man…

If the ID is permanent then governments will require it, because they can. If it has attestations or endorsements, governments will require a government endorsement. Think about what China, Iran or Russia would do with a permanent ID being a standard. The US, England and the EU are not immune to the same impulses. Always online is no different than an email account or website, and the rate of change would be, at leas…

If governments want to do these things, they already can. Phone numbers are KYCed in many countries, for example, and many messengers mandatorily require them.

The lack of an interoperable key standard isn’t stopping them. (In fact, it’s even helping a bit by providing cover for MITM snooping)

Re: Are we self-sovereign PKI yet?

#23

Post by Grosvenor »

growse wrote: post #20
lrvick wrote: post #18

Earlier quoted context omitted.

Self-sovereign PKI identity, key discovery, file encryption, artifact, code, review signing, security disclosures, boot signing etc etc.

Who's reinventing a tool that can do all that?

No one. The influencers are simply telling you you're wrong if you think you need that.

Which is the thing, we do need a single key that can be used for all those things. So we get PGP.

Re: Are we self-sovereign PKI yet?

#25

Post by growse »

Grosvenor wrote: post #23
growse wrote: post #20

Earlier quoted context omitted.

Who's reinventing a tool that can do all that?

No one. The influencers are simply telling you you're wrong if you think you need that. Which is the thing, we do need a single key that can be used for all those things. So we get PGP.

> No one.

I thought everyone was "trying so hard to re-invent PGP".

> we do need a single key that can be used for all those things

We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?

Re: Are we self-sovereign PKI yet?

#27

Post by iririririr »

i don't get spaces (the product) ebough to even read further the papers.

this article shows "alice@key" which looks very sensible.

then one click away, joining spaces, you can only get "horse-battery-staple@key AGE age1hsuwgduwhdiehhduwhdiheudhwi..."

and one cannot even pick the first part! pure insanity!

Re: Are we self-sovereign PKI yet?

#28

Post by noman-land »

lrvick wrote: post #18
growse wrote: post #15

Earlier quoted context omitted.

> Everyone is trying so hard to re-invent PGP Which bit of PGP?

Self-sovereign PKI identity, key discovery, file encryption, artifact, code, review signing, security disclosures, boot signing etc etc.

Don't forget authentication! Been using pgp keys on smart cards as ssh keys for ages.

Re: Are we self-sovereign PKI yet?

#29

Post by noman-land »

lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

One thing I don't like about key signing is that

1. You reveal your social graph

2. Different instances of the key can be differently signed

For someone to sign your key that information has to be stored on your key or in a central location.

Re: Are we self-sovereign PKI yet?

#30

Post by XorNot »

upofadown wrote: post #7

A cryptographic identity is a public key as used in a public key signature scheme. So a particular person is represented by a ridiculously long number. That number can be shortened with some sort of hash to a shorter value to make a key fingerprint, which is a shorter ridiculously long number. The scheme described in the system seems to use a blockchain to create a shared mapping between a name and a cryptographic id…

Technically speaking the long numbered problem is solved with QR codes though.

You want to be sure it's a particular person the you need to establish in-person trust.

Post reply on HN