3 ms·
Most E2E systems require some sort of long term identity key with the other person(s), I assume MLS is the same? (this is a good thing IMHO) If so, I would rea
by exabrial 3y ago
Most E2E systems require some sort of long term identity key with the other person(s), I assume MLS is the same? (this is a good thing IMHO)
If so, I would really like this to be flexible enough to say derive or pull a key from PGP, and/or a verifying service/website (such as Keybase). I'd really like to move away from "Your cell phone number is your identity" to a "a cryptographic primitive is your identity".
- ekr____ 3y agoYeah, MLS just assumes there is some mechanism for authorizing keys. Right now it just supports certificates and raw keys (https://www.rfc-editor.org/rfc/rfc9420.html#name-credentials https://www.rfc-editor.org/rfc/rfc9420.html#name-credentials) but this is extensible so you just need to add a new credential type, and there are others under consideration.
- EthanHeilman 3y agoYou could use OpenPubkey [0] to bind your identity key to your say Google or Okta account. With an MFA Cosigner, a malicious Google wouldn't be able to impersonate you. IF you really wanted to go full cipherpunk, you could use the stuff risc.zero [1] is building to could keep your identity secret via ZKPs on your ID Token. [0]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys, Paper: https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 Code: https://github.com/openpubkey/openpubkey https://github.com/openpubkey/openpubkey [1]: "Under the hood is JWT and OIDC verification on top of the RISC Zero zkVM" https://www.risczero.com/news/bonsai-pay https://www.risczero.com/news/bonsai-pay