Comments (9)
To clarify, in the case of a name revocation, the following things would happen:
- the name would remain in the list of registered names and would keep it's prior expiration date
- the data associated with the name would be zeroed out and the name would not be resolved by resolvers - it would essentially be a name in limbo
- the name would be able to be re-registered by anyone at the end of the registration period
- identity protocols built on top of these names could have rules in place for ignoring the identity of a revoked name (e.g. a web of trust system could have software that auto-unfollows identities with names that have been revoked)
(these rules can be played with - this is just what I came up with that should work reasonably well)
from stacks-blockchain.
It's awesome that you're thinking about this.
recommend the following: if a private key owner is compromised but the name hasn't yet been stolen, transfer the name to a new private key owner
Could you elaborate on that?
What happens if someone steals a name (i.e. gets the private key, updates the entry with bad data) and the revocation transaction is then broadcasted? Will it be respected still? (Seems like it should?)
from stacks-blockchain.
In this case, the name's data would be zeroed out and the resolution of the name would be blocked until the expiration date. That's the idea behind the revokation.
from stacks-blockchain.
Ah I see. Just gave this idea a mention in this blog post. Great idea! 👍
from stacks-blockchain.
@shea256 Thinking about this some more, it may not be necessary for name owners to lose their name if they are able to successfully revoke the key pair. Is Blockstore capable of separating the names from the keys? In other words, would it be possible for them to use the revocation message to re-associate a new key pair?
from stacks-blockchain.
Traditionally with cryptographic identity systems, revocation messages signed by the master key would have one purpose and one purpose only - to revoke the master key.
This allows you to do really interesting things to maintain security without trusting anyone. For example, you can store a copy of your revocation message under your bed, but you can also give a revocation message to a third party that you (a) trust enough not to publicly make a nuisance of revoking your keys but (b) don't fully trust enough to not impersonate you.
If you allow the revocation message to re-associate the keypair, or pull the name away from the master, it is now effectively as powerful the master key (and hence in essence a master key). This is very bad.
I've been trying to think about whether it's possible to pre-define an "escape" or "destination" backup address, so that instead of a revocation message, one could sign a transfer message. However, I don't think this is possible. The reason is, if there is in fact a backup key that you could transfer the message to in case of a breach, then the assumption is that the backup key wasn't compromised but the original master was. But why? If it's the case that it is more securely stored, perhaps in long-term storage, then why wasn't the backup key the master in the first place? And if it's stored with a third party, then it isn't secure since the third party can now execute the transfer and impersonate the user.
The idea behind a revocation message is it's a last resort. Ideally, you'd have your username owned by a master key in a multisig address or an address with a private key that has been sharded with shamir's secret sharing or even threshold signatures. But... if that somehow fails miserably, then it's imperative that you have an escape route to prevent someone from using your key, and a bit of a luxury at this point to get your name back.
And with the case of key loss, a transfer message doesn't make sense because if you can backup a transfer message somewhere, then you could have just backed up the key itself.
I think we should stick with the traditional model, which is a master that can create any number of child keys, and a revocation message that is signed by the master and that can only revoke the master. Quite simple and battle-tested.
from stacks-blockchain.
Also think about this - in the revocation message system, if someone steals your key, they can sign any number of revocation messages and it won't impact your revocation message. You care about broadcasting the revocation. The thief doesn't. Thus this is a case where you have ultimate power over the thief.
In the transfer message system, if someone steals your key, they can sign a transfer message and broadcast it instead of your pre-signed transfer message. This would screw with your ability to recover the name. And since the thief has advanced knowledge of the theft, in this case the thief has ultimate power over you.
from stacks-blockchain.
OK, fair enough. I was thinking that losing a key and having it compromised are two different situations and therefore perhaps different precautions could be taken.
But, I am realized that if you had your key stolen and then someone used it to transfer ownership of your name to some other key, then the ability to override that would actually allow others to con people (i.e. you pay me $ for a name, I transfer it to you, but then have the ability to undo that transfer).
So, I guess you're right, mutually assured destruction seems to be the best option in this situation. :P
from stacks-blockchain.
Closing this as stale. I think this issue belongs in blockstack.js or some other tool library, since it can be implemented by cleverly-constructed Bitcoin scripts without affecting Blockstack Core.
from stacks-blockchain.
Related Issues (20)
- Fix comment on `get-allowance-contract-callers`
- Report error instead of hitting arithmetic underflow in `delegate-stack-increase`
- [Chainstate] Drop `BurnchainDB::get_burnchain_header()`
- stack-extend can not be called with a period > 11 HOT 2
- `ContractName::try_from()` allows invalid `ContractName` to be created
- Look into ways of improving logs for users running a node HOT 5
- [stacks-signer] Add a log message to signer on bootup to warn that signer should only be run with a LOCAL node
- [stacks-signer] Verify messages coming from stackerdb event listener come from expected entities
- [StackerDB] only attempt at most one connection to a remote replica at once
- [p2p] Limit inv syncs with new peers
- [node] Node crash due to DNS failure in the config parser
- Update Nakamoto Testnet to use regtest instead of Bitcoin Testnet HOT 3
- [stacks-signer] Enable support for HTTPS with pinned certificate throughout the Stacks signer HOT 1
- [stacks-signer] DKG related testing scenarios
- Improve emitted events for Clarity post-conditions
- Avoid extraneous CI runs HOT 6
- Add a test case for the signer race condition fixed in #4738
- Incorrect type-checking of principal / callable value
- Deprecate or remove (EDIT(jcnelson): or fix) the `/v2/fees/transfer` endpoint HOT 4
- [stacks-signer] add reward cycle number to all stackerdb messages to prevent new signers reading old data
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from stacks-blockchain.