Please describe your proposed solution.
Problems:
Since the Internet Protocol doesn't provide an authentic identity layer, various authentication mechanisms have been built, including password-based, authenticators (using shared secrets), federated identity via 3rd parties (OAuth), and passkeys (FIDO, U2F, and WebAuthN). However, none of these place the user in exclusive control of their own private keys for cryptographic signing, with a persistent identifier, recovery from a lost key, key pre-rotation, and multi/threshold signatures. Further, for authentication, the certificates required today often security flaws based on DNS or Certificate Authority system and process design.
Solution:
The BLOCKTRUST Authentication and Authorization Browser Extension will be a Chromium browser extension that leverages libraries and an agent from KERI projects (Signify-ts and KERIA). The extension itself will be built in C# Blazor WASM.
Identity and Credential Technology:
The KERI (Key Event Receipt Infrastructure) stack, which includes standards for credentials (ACDC) and encoding (CSER), is a set of emerging standards that address the above problems and is being incubated in the Trust Over IP Foundation, with the intention to standardize these via the IETF. We believe KERI will emerge as a very strong contender to existing identification, authentication, and authorization/credential solutions.
KERI has the promise of delivering identifiers (DIDs) and credentials that can be used in many settings, including traditional corporate settings and multiple blockchains, including Cardano.
Already, several of the KERI stack protocols have been implemented and available open-source.
The Global Legal Entity Identity Foundation (GLEIF) and their partners can provide a cryptographically and legally strong "root of trust".
Features:
The BLOCKTRUST Authentication and Authorization Browser Extension will include the following features:
- Configure to use a KERI agent
- Designate witnesses for key events
- Create identifiers and key-pairs
- Encrypted storage
- Receive Key Event Receipts from witnesses
- Import and view credentials using ACDCs (Authentic Chained Data Containers)
- Authenticate with website using cryptographic signing
- Authorize with website using credential (ACDC)
- Sample website
- Install in Developer Mode in Chromium-based browser
Stretch Goals:
- One or both of:
- Header-based integration
- authenticate with website via header-based (IEEE standard) including identifier
- authorize with website via header-based leveraging ACDC credential
- JavaScript API integration
- authenticate with website including identifier
- authorize with website leveraging ACDC credential
- Rotate keys for single signer
Engagement:
We'll engage with use cases, including existing Cardano projects who want to be regulatory compliant leveraging on-chain DIDs and Credentials, especially for legal entities and their authorized representatives. We'll engage in projects that want self-certifying identifiers leveraging a root-of-trust provided by GLEIF's Verifiable Legal Entity Identifier (vLEI) processes and technology. We'll engage with projects who want to establish their own root-of-trust, potentially related to roles in Cardano Governance.
Demonstrable Impact:
In addition to sharing engagement with other projects, we'll provide regular recorded demonstrations, and continue to build our Discord community. Ideally, we'll release an installable product via the Chrome Web Store.