3 ms·

Show HN: Decentralised Digital Identity and Messaging

5 points by _wwhq 6y ago

I've been working on something for a while now. It's a combination of a decentralised identity system and a decentralised messaging system that makes use of the aforementioned new identity system. It's based on cryptographic keys with one major property: keys are paired with arbitrary mnemonic strings, e.g. your favourite username, so apps can send messages in a P2P fashion addressed to the strings directly without having to worry about IP addresses. These key-string pairs can be generated on-the-fly on any computer and there's no central database. When multiple people inevitably choose the same strings as their identifiers, e.g. 5 people choose 'alice', the system has a consensus mechanism for resolving such conflicts across the entire network so 'alice' will always point to one public key that all nodes will use at a given point in time for encryption and signature verification. This means that only that specific 'alice' will receive any messages sent to that identifier. The other 4 people won't be able to read them. I've written two papers describing both systems: * Nomicle: A decentralised, identity-based, cryptography system [ http://noraco.org/projects/xp002/docs/XP002.pdf ] * xTalk: A Nomicle-powered, inter-app messaging system [ http://noraco.org/projects/hp001/docs/HP001.pdf ] I plan on releasing the source code and documentation some time later this month. It's all written in Python. Nomicle's code includes a Python library as well as a C library that developers can use to integrate it into their apps. I'm trying to make it as easy and simple as possible for anyone to pick up. These are the first projects in a pipeline of open source projects that build on this work and that I intend to work on and release in the near future. Messaging is one potential use of Nomicle, but I can already see more uses such as consensus-based packet routing and information publishing. In fact, the latter is the next project I'll be working on.

tapirl 6y ago
Interesting. Could it replace email? And what do you think is the main obstacle to achieve this.
- _wwhq 6y ago
  One of the planned projects based on this is an email-like system, but I'm not sure I have the boldness to claim it can "replace" email.
alexmingoia 6y ago
Cool! It's simpler than the cryptocurrency/Namecoin approach. I wonder what the advantage of Nomicle is if it naturally converges on the cryptocurrency approach due to incentives (Fortification as a Service)? Maybe there would be less squatting because work is behind each individual name. Also, costs scale with how secure the name needs to be. Namecoin suffers from the problem that all names have the same initial cost.
- _wwhq 6y ago
  I'm really hoping that if we ever see something like FaaS, it wouldn't be the majority of average users using such services, but rather more for businesses or high-profile individuals. If, as an average user, you pick something unique to you for identifying yourself on the network (maybe your personal email address?), others have little to no interest in competing with you over it in that case, and so maintaining your identity costs what it already costs you to keep your computer powered on. Unlike the fixed recurring cost of maintaining, say, a personal domain name. There might be use cases that I'm not thinking of. A Nomicle setup might be for apps to generate a hash based on some pre-defined rules and use that as a temporary identifier while they complete some operation that involves communicating with another app somewhere else on the network, and once it's done, that identifier is no longer ever needed and will probably never be used by anything again. This use case would be very unlikely to happen if you had to pay money for reserving that ephemeral identifier. And, like you said, a byproduct of this approach is reducing squatting and allowing the entire system to scale by recycling unmaintained identifiers. In the case of the temporary, disposable ones like I just described, we could have a potential setting in the Nomicle config file set to have the system on your machine purge or reject identities that haven't been updated in X days/months.
_wwhq 6y ago
Basically, imagine if by knowing one identifier that you've publicised as being yours, I can... * Type it into an xTalk-enabled web browser to find your personal website (the web server software you're using to host it would simply need to add support for responding to DNS-like requests coming from xTalk in addition to listening on port 80 for your usual HTTP requests; i.e. your web server also becomes something like your own DNS server that responds with its IP address over xTalk to whoever requests it so that they may then connect to it over port 80 like a standard web request). * Use it in an xTalk-enabled messenger to contact you. * Use it in an xTalk-enabled BitTorrent client to download files from you. No passwords involved, no creating user accounts anywhere. Your one private key makes all this possible and it is yours to keep on your own machine. These scenarios are just off the top of my head right now. The web browser example seems to work because it's one of the demos I've written. Obviously I haven't tested it in the real world so I can't say how fast web requests would load in practice. I also wrote an xTalk-enabled web app demo that serves a standard web page with a contact form on it for sending short messages. When you submit the form, it forwards your message on to xTalk. The recipient can read your message through a web interface or even Telnet once they receive it.

5 points by _wwhq 6y ago

tapirl 6y ago

Interesting. Could it replace email? And what do you think is the main obstacle to achieve this.

_wwhq 6y ago
One of the planned projects based on this is an email-like system, but I'm not sure I have the boldness to claim it can "replace" email.

alexmingoia 6y ago

Cool! It's simpler than the cryptocurrency/Namecoin approach. I wonder what the advantage of Nomicle is if it naturally converges on the cryptocurrency approach due to incentives (Fortification as a Service)? Maybe there would be less squatting because work is behind each individual name. Also, costs scale with how secure the name needs to be. Namecoin suffers from the problem that all names have the same initial cost.

_wwhq 6y ago
I'm really hoping that if we ever see something like FaaS, it wouldn't be the majority of average users using such services, but rather more for businesses or high-profile individuals. If, as an average user, you pick something unique to you for identifying yourself on the network (maybe your personal email address?), others have little to no interest in competing with you over it in that case, and so maintaining your identity costs what it already costs you to keep your computer powered on. Unlike the fixed recurring cost of maintaining, say, a personal domain name. There might be use cases that I'm not thinking of. A Nomicle setup might be for apps to generate a hash based on some pre-defined rules and use that as a temporary identifier while they complete some operation that involves communicating with another app somewhere else on the network, and once it's done, that identifier is no longer ever needed and will probably never be used by anything again. This use case would be very unlikely to happen if you had to pay money for reserving that ephemeral identifier. And, like you said, a byproduct of this approach is reducing squatting and allowing the entire system to scale by recycling unmaintained identifiers. In the case of the temporary, disposable ones like I just described, we could have a potential setting in the Nomicle config file set to have the system on your machine purge or reject identities that haven't been updated in X days/months.

_wwhq 6y ago

Basically, imagine if by knowing one identifier that you've publicised as being yours, I can... * Type it into an xTalk-enabled web browser to find your personal website (the web server software you're using to host it would simply need to add support for responding to DNS-like requests coming from xTalk in addition to listening on port 80 for your usual HTTP requests; i.e. your web server also becomes something like your own DNS server that responds with its IP address over xTalk to whoever requests it so that they may then connect to it over port 80 like a standard web request). * Use it in an xTalk-enabled messenger to contact you. * Use it in an xTalk-enabled BitTorrent client to download files from you. No passwords involved, no creating user accounts anywhere. Your one private key makes all this possible and it is yours to keep on your own machine. These scenarios are just off the top of my head right now. The web browser example seems to work because it's one of the demos I've written. Obviously I haven't tested it in the real world so I can't say how fast web requests would load in practice. I also wrote an xTalk-enabled web app demo that serves a standard web page with a contact form on it for sending short messages. When you submit the form, it forwards your message on to xTalk. The recipient can read your message through a web interface or even Telnet once they receive it.