signing entries in a ledger or dag

[unicomp21]

#469 (comment)

resuming the conversation over here ...

[FrankSzendzielarz]

You are talking about things like blockchain transactions right? Generally I'd say using passkeys to sign transactions means trusting the server and the client loses ctrl over thr signing process. However i have been looking at Algorand accounts baaed on passkeys and there are a couple of issues. One not all authenticators support ed25519 and two not all authenticators support the prf extension for deterministic generation of keypairs.

[unicomp21]

Yeah, blockchain would be the easiest way to explain it, but w/ an emphasis on social media feeds. The android and ios impl's support ed25519? In addition to yubikey, google titan, and trezor? My goal is to have everything work in the browser, using existing webauthn implementations.

I realize webauthn is server centric, but I'm wondering if we could use the ipfs:// origin supported in brave to fulfill the server part? And by doing so, make everything happen on the client? By basically simulating the server side flow?

In a nutshell, could we leverage existing passkey impl's to create a highly secure signature mechanism which runs purely in the client side browser using brave and ipfs:// origin?

[FrankSzendzielarz]

I am not sure which authenticators support ed25519 but it was enough for my experimental use case that Windows Hello did NOT support it. What crypto scheme do you need?

I am not sure if Brave on Android/iOS works with WebAuthn, nor if the domain can be IPFS, but it should be super easy to test. Just modify the client code in the web demo of this repo to replace the challenge with some arbitrary data, and change the credentialcreate options so that only the crypto scheme you want is in the allowed list.