Cryptographic Secret Recovery - Revision history

Tomjones: /* Solutions */

2020-06-04T00:44:34Z

Solutions

← Older revision		Revision as of 00:44, 4 June 2020
Line 21:		Line 21:
	* Recovery mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.		* Recovery mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.
	* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.		* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.
	* In general solutions will take something the user knows and use that to recover control of the identifier, for example by doing a ~~key roll~~-over or reload into a user device.		* In general solutions will take something the user knows and use that to recover control of the identifier, for example by doing a [[Key Roll-over]] or reload into a user device.
	===Decentralized Identifiers Foundation===		===Decentralized Identifiers Foundation===
	The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.		The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.

Tomjones: /* Decentralized Identifiers Foundation */

2020-06-02T03:50:37Z

Decentralized Identifiers Foundation

← Older revision		Revision as of 03:50, 2 June 2020
Line 26:		Line 26:

	Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.		Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.

			===Distributed Identifier Assurance===
			When there is no authority for a user's identifier, the recovery of the user's secrets relies on a back-up of some sort. Here are three considerations:
			# The user has a back-up on a local device, for example a USB key with an encrypted version of the keying material.
			# A Device that can make an encrypted version of the keying material that can only be downloaded to a similarly equied device.
			# A cloud storage of the keying material that the. user can load onto any suitably protected device.

			Any others???

	===Call for full solutions===		===Call for full solutions===

Tomjones: /* Solutions */

2020-06-01T18:09:46Z

Solutions

← Older revision		Revision as of 18:09, 1 June 2020
Line 21:		Line 21:
	* Recovery mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.		* Recovery mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.
	* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.		* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.
	* In general solutions will take something the user knows and use that to ~~recovery access~~, for example by doing a key roll-over or reload into a user device.		* In general solutions will take something the user knows and use that to recover control of the identifier, for example by doing a key roll-over or reload into a user device.
	===Decentralized Identifiers Foundation===		===Decentralized Identifiers Foundation===
	The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.		The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.

Tomjones: /* Solutions */

2020-06-01T18:08:55Z

Solutions

← Older revision		Revision as of 18:08, 1 June 2020
Line 19:		Line 19:

	==Solutions==		==Solutions==
	* ~~Recovry~~ mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.		* Recovery mechanisms can be as simple as creating a backup of a wallet that holds cryptographic keys or writing down a seed number on a piece of paper.
	* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.		* Many key recovery techniques that are popular in the cryptocurrency community can also be applied to decentralized identity. Some of the better-known approaches are mnemonic seed phrases or Shamir’s Secret Sharing algorithm.
			* In general solutions will take something the user knows and use that to recovery access, for example by doing a key roll-over or reload into a user device.
	===Decentralized Identifiers Foundation===		===Decentralized Identifiers Foundation===
	The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.		The DIF Identifiers & Discovery Working Group has announced an open call for contributions and development of new secret recovery schemes, and implementations. To kick off work in this area, Microsoft, a member of the DIF I&D WG, will be contributing a scheme called ‘Fuzzy Vault,’ which incorporates many desirable, human-friendly features into a single recovery scheme. Daniel Buchner of Microsoft will be posting soon to detail their contribution to the ‘Fuzzy Vault’ scheme to this DIF I&D WG initiative. The whitepaper for the ‘Fuzzy Vault’ scheme will be published in this DIF repository: https://github.com/decentralized-identity/fuzzy-vault. The code implementation and any specifications required for ‘Fuzzy Vault’ will be developed within the DIF I&D WG.

Tomjones: /* Context */

2020-06-01T18:06:18Z

Context

← Older revision		Revision as of 18:06, 1 June 2020
Line 10:		Line 10:
	# Microsoft Bit Locker disk drive encryption		# Microsoft Bit Locker disk drive encryption
	# Android Key Vault in version 9 and later.		# Android Key Vault in version 9 and later.
	# Key fobs used since 1980's and extending to USB U2F and Web ~~Authenticaion~~ devices.		# Key fobs used since 1980's and extending to USB U2F and Web Authentication devices.
	# Slack provisioning user with a page of Two-factor authentication backup codes.		# Slack provisioning user with a page of Two-factor authentication backup codes.

Tomjones: /* Context */

2020-06-01T18:05:59Z

Context

← Older revision		Revision as of 18:05, 1 June 2020
Line 7:		Line 7:
	*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.		*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.
	*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.		*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.
	Note that ~~one~~ existing systems that ~~has~~ addressed this problem include:		Note that several existing systems that have addressed this problem include:
	# Microsoft Bit Locker disk drive encryption		# Microsoft Bit Locker disk drive encryption
	# Android Key Vault in version 9 and later.		# Android Key Vault in version 9 and later.

Tomjones: /* Context */

2020-06-01T18:05:13Z

Context

← Older revision		Revision as of 18:05, 1 June 2020
Line 7:		Line 7:
	*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.		*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.
	*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.		*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.
	Note that one existing ~~system~~ that has addressed this problem ~~is the~~		Note that one existing systems that has addressed this problem include:
			# Microsoft Bit Locker disk drive encryption
			# Android Key Vault in version 9 and later.
			# Key fobs used since 1980's and extending to USB U2F and Web Authenticaion devices.
			# Slack provisioning user with a page of Two-factor authentication backup codes.

	==Problems==		==Problems==

Tomjones: /* Context */

2020-06-01T17:58:30Z

Context

← Older revision		Revision as of 17:58, 1 June 2020
Line 7:		Line 7:
	*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.		*In a decentralized [[Identity Management]] architecture individuals, organizations, and things create and manage their own cryptographic keys without reliance on a central authority or intermediary other than a pointer to the method used for resolving identifiers into public keys that can be used for authentication purposes.
	*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.		*In a distributed [[Identity Management]] architecture the identifiers do not come with any built in resolution to any kind of resolver and so have full responsibility for any recovery of loss of access to identifiers.
			Note that one existing system that has addressed this problem is the

	==Problems==		==Problems==

Tomjones: /* =Call for full solutions */

2020-06-01T17:55:22Z

=Call for full solutions

← Older revision		Revision as of 17:55, 1 June 2020
Line 21:		Line 21:
	Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.		Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.

	===Call for full solutions==		===Call for full solutions===
	These two efforts are just the beginning of DIF’s work in the area of secret retention and recovery. Any interested party is encouraged to contribute their ideas, code, and insights to this vital work. For more information about participating in this new initiative, and the DIF I&D WG in general, view its Meeting Page, read the group’s Charter, and join DIF!		These two efforts are just the beginning of DIF’s work in the area of secret retention and recovery. Any interested party is encouraged to contribute their ideas, code, and insights to this vital work. For more information about participating in this new initiative, and the DIF I&D WG in general, view its Meeting Page, read the group’s Charter, and join DIF!

Tomjones at 17:55, 1 June 2020

2020-06-01T17:55:07Z

← Older revision		Revision as of 17:55, 1 June 2020
Line 21:		Line 21:
	Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.		Another approach DIF participants have worked on is a mnemonic scheme encoded as a 3D experience, called Seed Quest. This scheme uses geo-temporal-spatial inputs, which are more human-friendly than traditional word inputs. The scheme provides 128 bits of entropy for seed recovery with a mnemonic sequence that requires minimal rehearsal: https://github.com/reputage/seedQuest. DIF members have recently discussed ways to combine these schemes to maximize UX and recoverability.

	These two efforts are just the beginning of DIF’s work in the area of secret retention and recovery. ~~We encourage everyone~~ to contribute their ideas, code, and insights to this vital work. For more information about participating in this new initiative, and the DIF I&D WG in general, view its Meeting Page, read the group’s Charter, and join DIF!		===Call for full solutions==
			These two efforts are just the beginning of DIF’s work in the area of secret retention and recovery. Any interested party is encouraged to contribute their ideas, code, and insights to this vital work. For more information about participating in this new initiative, and the DIF I&D WG in general, view its Meeting Page, read the group’s Charter, and join DIF!

	==References==		==References==