Update: https://codeberg.org/fediverse/fep/pulls/497
Uncategorized
26
Posts
8
Posters
0
Views
-
Should one be able to publish a portable object that is repudiable? IIUC, FEP-ef61 portable objects (identified by ‘ap’ URIs) require FEP-8b32 integrity proofs, so they are non-repudiable. On the other hand, FEP-c390 identity proofs establishes links between DIDs and HTTP(S) actors, but they don’t make objects portable. So that seems to be not possible with current proposals.
I’m curious because there are cases where one doesn’t want non-repudiation. For example, you don’t want your private message to be disclosed by the recipient in a publicly verifiable way. But that does not necessarily mean that you don’t want the object to be portable.
-
Should one be able to publish a portable object that is repudiable? IIUC, FEP-ef61 portable objects (identified by ‘ap’ URIs) require FEP-8b32 integrity proofs, so they are non-repudiable. On the other hand, FEP-c390 identity proofs establishes links between DIDs and HTTP(S) actors, but they don’t make objects portable. So that seems to be not possible with current proposals.
I’m curious because there are cases where one doesn’t want non-repudiation. For example, you don’t want your private message to be disclosed by the recipient in a publicly verifiable way. But that does not necessarily mean that you don’t want the object to be portable.
If you rotate verification method, all previous FEP-8b32 proofs become unverifiable. Does this count as repudiation?
did:keydoesn't support VM rotation, but there will be other "blessed" DID methods (most likelydid:webanddid:webvh).Additionally, some cryptographic tricks may exist that enable repudiable signatures, for example I was able to find this paper: https://dl.acm.org/doi/10.1145/3659467.3659901
-
If you rotate verification method, all previous FEP-8b32 proofs become unverifiable. Does this count as repudiation?
did:keydoesn't support VM rotation, but there will be other "blessed" DID methods (most likelydid:webanddid:webvh).Additionally, some cryptographic tricks may exist that enable repudiable signatures, for example I was able to find this paper: https://dl.acm.org/doi/10.1145/3659467.3659901
silverpill:If you rotate verification method, all previous FEP-8b32 proofs become unverifiable. Does this count as repudiation?
this could work but only if the rotation was a "blind rotation", i.e. without a verifiable log of the old key being associated with the identity. if there is a log of the key rotation, then no.
more pressingly, if the key is your identity, then it cannot be rotated without also fundamentally changing your identity. so key rotation with repudiation requires a non-key identity -- in other words, a name (and authoritative name server) or description (and a way of asserting trusted claims that match the description).
silverpill:Additionally, some cryptographic tricks may exist that enable repudiable signatures, for example I was able to find this paper: https://dl.acm.org/doi/10.1145/3659467.3659901
from what i understood of the paper, it seems this is just delegating signatures to some authority who can sign things on your behalf. you can then claim the authority forged signatures on your behalf. it's basically like how fedi uses custodial keys in most cases.
-
silverpill:
If you rotate verification method, all previous FEP-8b32 proofs become unverifiable. Does this count as repudiation?
this could work but only if the rotation was a "blind rotation", i.e. without a verifiable log of the old key being associated with the identity. if there is a log of the key rotation, then no.
more pressingly, if the key is your identity, then it cannot be rotated without also fundamentally changing your identity. so key rotation with repudiation requires a non-key identity -- in other words, a name (and authoritative name server) or description (and a way of asserting trusted claims that match the description).
silverpill:Additionally, some cryptographic tricks may exist that enable repudiable signatures, for example I was able to find this paper: https://dl.acm.org/doi/10.1145/3659467.3659901
from what i understood of the paper, it seems this is just delegating signatures to some authority who can sign things on your behalf. you can then claim the authority forged signatures on your behalf. it's basically like how fedi uses custodial keys in most cases.
My question was addressed to @tesaguri
Yes,
did:keycan not be rotated, I think this is exactly what I said in my comment. -
Fedify has just laid out a comprehensive implementation plan for this fep:
https://github.com/fedify-dev/fedify/issues/288#issuecomment-3971459585
The core idea is replacing HTTP(S) URIs with server-independent identifiers:
ap://URIs that use a Decentralized Identifier (DID) as the authority component, rather than a domain name. An object identified asap://did:key:z6Mk…/actorcan live on multiple servers simultaneously and survives any single server disappearing. -
undefined hongminhee@hollo.social shared this topic on
undefined fedify@hollo.social shared this topic on
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@ipd it didn't there's no crosswalk
-
@simone chi decide se cacciarli? A chi sto parlando?
La volontà popolare non è cosa aliena da osservare col telescopio e commentare stile umarell
Siamo noi, siamo in mezzo
E definirla volontà popolare è un modo aproblematico e di farlo
La volontà popolare non è indifferente al sistema in cui si trova, basta l'etichetta di democrazia per dimenticarsi che viviamo in un sistema asfittico, dove la volontà popolare non ha modo di crescere, maturare, e esprimersi, può solo frustrarsi e sfogarsi invano
-
@david @Dr_Bombay This is me Monday through Friday
-
@andre123 essere leader a livello europeo vuol dire prendersi in carico l'unità dell'Europa, e la sua integrità di fronte alle aggressioni di altri
Sì, anche la Francia qualcosa prova, foss'anche per manie di grandezza, ma lo fa in modo isolazionista, la Spagna lo fa da sola più che altro perché è l'unica a fare reale opposizione, o almeno, è questa la mia impressione
Poi tutti cercano di salvare capra e cavoli, mandano messaggi ambigui, così facendo perdono credibilità, e non è poco, anzi
-
La Stampa (s)venduta
@giornalismo - Dopo quasi un secolo, la famiglia Agnelli lascia, dopo averla ultimamente rovinata
-
@kotaro maybe I can, but barely...
-
@gubi il PD è un partito privo di una linea politica, ovvero non è un partito: prenderne atto e scioglierlo dovrebbe essere il primo compito di una segreteria che possa chiamarsi tale
