Live data from Hacker News

Login with a Public Ed25519 Key

github.com

71–80 of 85 posts

Re: Login with a Public Ed25519 Key

#71
post #69
post #67

Earlier quoted context omitted.

Which is a naive way to implement reuse mitigation because you have have a db that grows endlessly. Send a nonce and have the user sign it. Make sure the nonce is only valid for one use (burn it after it’s used). Then you only have to remember active nonces and you can expire them after a short interval.

Used signatures are purged from the DB after they are no longer valid (too much time has passed). I realize this is a naive, toy implementation (in general). I wrote it to have a broader discussion.

You've got the problem that a lot of people have tried to create a lot of novel cryptographic protocols, and they are almost always lacking and insecure. It becomes useful to be able to quickly dismiss things that seem uninformed, as nobody has time to read every such thing.

The inclusion of a nonce/challenge (and other chosen-text and offline-attack mitigations) helps with a lot of security flaws, and that you've omitted them for no clear reason undermines your position as creator of a novel protocol.

As a trivial example, imagine that someone else comes up with a protocol that uses a signed current-date to authorise a bank transfer; as it's not distinguishable from your protocol, there would be many avenues for tricking a user into providing you with the ability to steal their money.

In responses elsewhere in the thread, you say that users should have a public key per website, but in your readme, you repeatedly imply that users have a single key-pair. "Register your base64 encoded public Ed25519 key with the website." "Use your private Ed25519 key to sign the current Unix Epoch Time" "Websites store the users' public keys."

Requiring users to keep generating keys and manage them manually introduces insecurity through non-compliance. It's not simple if you've got to manage something that behaves entirely like a local password database.

You say elsewhere "The demo website and the github repo contain this information" - but the demo website has no descriptive text (can you perhaps provide a link?) and the readme barely mentions threat models or goals. How do you prevent MitM attacks? Can your design support multi-party authentication or delegation of any kind?

I have no experience with WebAuthn, but it's likely that a lot of its features are to improve security in many ways, and omitting these features might make things easier at request-protocol level, but perhaps just simplistic overall.

You say you're trying to facilitate a conversation, but the proposal is so basic that you're effectively asking people to create a useful protocol for you.

Re: Login with a Public Ed25519 Key

#72
post #70
post #54

Earlier quoted context omitted.

> The point is that it takes that choice out of the users' hands. Unclear to me why you think the user--and not the IdP--should have the final say here. > You shouldn't. That's like expecting to be able to use your work laptop for personal stuff. Except FIDO identities are unlinkable even if using the same hardware.

Because for consumer auth we just go back to the CA oligarchy and client certs nobody uses if we rely on trusting vendor attestation. I understand for a corporate setup employees are threat vectors. But that depressing outlook isn't how most people view the consumer space. We want: consumer x signed this auth challenge. We do not want: authority Y said consumer X signed this auth challenge. That’s just CA SSO style o…

It depends a lot on the situation. I think it’s reasonable, for example, for banks who have different liability standards depending on how transactions are authenticated to require batch attestation.

But like I said, most consumer IdPs aren’t doing attestation checks, and it’s discouraged, so I think you’re making a big deal of it. :)

Re: Login with a Public Ed25519 Key

#73
post #67
post #38

Earlier quoted context omitted.

The web service stores used signatures. They cannot be re-used and are only good for about 30 seconds. Try to register on the demo site and see if you can actually replay a signature.

Which is a naive way to implement reuse mitigation because you have have a db that grows endlessly. Send a nonce and have the user sign it. Make sure the nonce is only valid for one use (burn it after it’s used). Then you only have to remember active nonces and you can expire them after a short interval.

I like the idea of signing a nonce rather than the current time. That solves several problems. Thanks for the advice.

Re: Login with a Public Ed25519 Key

#74
post #68
post #66

Earlier quoted context omitted.

Your tone is overly dismissive. If you want to be constructive then have a constructive conversation and not a dismissive knee jerk reaction. Your comment reads like “I haven’t read a standard for this or bothered to really take a look and it’s new therefore it’s fundamentally bad and insecure and not worth my time”. This repo is simply proposing using signed timestamps for auth. It would be nice to keep the discussi…

Which part was knee jerk? I read everything on the (minimal) webpage. It doesn’t explain anything of substance, nor does it anticipate the (obvious) issues other commenters here noted. It’s like the author just proposed to remove everything they didn’t understand from Webauthn and was left with this. Honestly, this discussion isn’t worth the time. As for software webauthn keys: - What do you mean “locked up in browse…

And what’s left is essentially wireguard for logins. People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. Yeah there are valid criticisms and I’ve critiqued the work as well in other comments. But the “this is utter shit how could anyone imagine this is a valid idea” is not productive.

> Honestly, this discussion isn’t worth the time.

That’s my point. If it’s not worth your time then let others who are interested discuss rather than just pissing all over the author’s project.

> - Softkeys are available—in fact, iOS, Android, MacOS, and Windows 11 all do webauthn by default, without the need for a hardware token.

That’s not soft keys it’s “platform authenticator”.

When I say softkeys I mean keys managed by a user agent such that they can be portable, like is common with ssh. SSH is popular because it’s gives users the freedom to easily elect their security posture: do they want a user key that can be deployed to different devices or are they super paranoid and want a device key. Do they want a software agent to manage soft keys for them and it can handle the device security and hardware crypto engine support. Not your concern, not the protocols concern, not the services concern: it’s the user’s concern.

Wireguard has soft keys, too.

WebAuthn’s crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. That’s the problem.

Re: Login with a Public Ed25519 Key

#75
post #74
post #68

Earlier quoted context omitted.

Which part was knee jerk? I read everything on the (minimal) webpage. It doesn’t explain anything of substance, nor does it anticipate the (obvious) issues other commenters here noted. It’s like the author just proposed to remove everything they didn’t understand from Webauthn and was left with this. Honestly, this discussion isn’t worth the time. As for software webauthn keys: - What do you mean “locked up in browse…

And what’s left is essentially wireguard for logins. People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. Yeah there are valid criticisms and I’ve critiqued the work as well in other comments. But the “this is utter shit how could anyone imagine this is a valid idea” is not productive. > Honestly, this discussion isn’t worth the time. That’s my point. If it’s not worth your tim…

> People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot.

I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever.

My point about certs was that OP was effectively proposing self-signed X509 client certs. It's unclear to me in what way those are harder to use than the proposal here, except that they actually are a widely accepted standard with user agent support.

> WebAuthn’s crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. That’s the problem.

https://github.com/herrjemand/awesome-webauthn#software-auth...?

Re: Login with a Public Ed25519 Key

#76
post #47
post #45

Earlier quoted context omitted.

I read the github readme. It doesn't explain the problem or threat model in any detail. My comment has nothing to do with federation or SSO, so I'm not sure why you mentioned those?

Because it was in reply to my earlier comment saying this is not SSO. People seem to think these signatures can be used on multiple websites (sign in with Google like functionality). That's not the case. These signatures are meant to be used to authenticate to a website. If multiple websites implement this idea, then end users should have multiple key pairs (one for each site). So there would be no way a signature fo…

Are you the author? If so I would love to talk with you more about your vision and goals.

I personally would like reusable keys, and I agree namespace or some other mechanism is needed.

I generally prefer to link my identity among websites and I'm generally not concerned about anonymity or privacy. "A key for each website" is nearly worthless to me.

The ability of others to spoof my identity because a website uses passwords, and most websites provide little to no logging, let alone a standardization, infuriates me. That is a outsized use case I see little attention given to.

If I tweet, users are forced to trust Twitter's authentication system that I tweeted. I don't trust Twitter's authentication systems.

Public key authentication permits third parties to verify my actions without the need to trust system authentication systems.

Re: Login with a Public Ed25519 Key

#77
post #13

This feels very broken: - The suggestion of signing the timestamp means that any web site you log into with this can log in as you to any other web site you log in to - Given that there's no namespacing of the signed messages, users can be easily phished into providing a response to a challenge posed by a different web site - It's not obvious what advantages this has over using client cert authentication with TLS, an…

> - The suggestion of signing the timestamp means that any web site you log into with this can log in as you to any other web site you log in to This is a (privacy) feature, not a bug. It forces you to use a different public key for each website.

I want to be able to link my identity across website. I want to be able to have a key on my phone that's known as my phone key.

Re: Login with a Public Ed25519 Key

#78
post #75
post #74

Earlier quoted context omitted.

And what’s left is essentially wireguard for logins. People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. Yeah there are valid criticisms and I’ve critiqued the work as well in other comments. But the “this is utter shit how could anyone imagine this is a valid idea” is not productive. > Honestly, this discussion isn’t worth the time. That’s my point. If it’s not worth your tim…

> People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever. My point about certs was that OP was effectively proposing self-signed X509 client certs. It's unclear to me in what way those are harder to use than the proposal here, except that they actually are a widely accepted standard with user agent…

It kinda feels like you’re deliberately talking around my point. I’m not saying existing VPNs use PAKEs and it makes them bad. I’m saying you don't need a PAKE to have “modern” authentication. And look at wireguard which is loved for being a dead simple protocol that uses raw keypairs. Therefor it’s not absurd to imagine a very simple protocol like this.

You are correct that client certs have user agent support. Honestly it’s a pretty poor UX though. Have you actually tried building a consumer application that uses client certs in the browser? Good luck getting users to install client certs. Client certs work fine everywhere else where you can run bespoke client software (native apps) except for the part where they authenticate the connection and not the request, but that’s not the point either.

Anyway it’s great that other implementations of webauthn exist. But like I just said for client certs: outside of the browser anyone can do anything so webauthn is not a game changer there (not to downplay it). Where WebAuthn matters is for client authentication in the browser and in that arena it is locked down to platform auth and hardware device auth mechanisms. There is no way users could benefit from webauthn right now without the browser-supplied UX.

All I’m saying is that WebAuthn would be way more viable in the way people are asking for in this thread if for example browsers/platforms allowed extensions to participate as a soft WebAuthn agent so that users could choose their preferred WebAuthn backend and UX instead of the browser supplied options. The browser client cert UX sucks and so does browser vendor WebAuthn and I think their adoption story is all the proof you need.

Re: Login with a Public Ed25519 Key

#79
post #69

Earlier quoted context omitted.

Used signatures are purged from the DB after they are no longer valid (too much time has passed). I realize this is a naive, toy implementation (in general). I wrote it to have a broader discussion.

You've got the problem that a lot of people have tried to create a lot of novel cryptographic protocols, and they are almost always lacking and insecure. It becomes useful to be able to quickly dismiss things that seem uninformed, as nobody has time to read every such thing. The inclusion of a nonce/challenge (and other chosen-text and offline-attack mitigations) helps with a lot of security flaws, and that you've om…

You might want to look at webauthn since you say you’re unfamiliar. It’s not much more than a signed nonce with relying party domain name. It actually isn't that complicated. I don’t feel like the author is asking people to implement a protocol for them. They just maybe could have done some research into why WebAuthn has the complexities it does and presented a compelling argument in the readme for why they think they’re overkill or not necessary.

Re: Login with a Public Ed25519 Key

#80
post #73
post #67

Earlier quoted context omitted.

Which is a naive way to implement reuse mitigation because you have have a db that grows endlessly. Send a nonce and have the user sign it. Make sure the nonce is only valid for one use (burn it after it’s used). Then you only have to remember active nonces and you can expire them after a short interval.

I like the idea of signing a nonce rather than the current time. That solves several problems. Thanks for the advice.

Time is just icky. I have a personal requirement/standard that I never depend on wall clocks in software I design. Timestamps can be used as an optimization, sure. But never as a fundamental component in the protocol or system.
Post reply on HN