[morpheusvm/tokenvm/indexvm] Change the auth on one of these to better showcase how to provide your own crypto

[patrick-ogrady]

We should use BLS for this...we'll need to generalize crypto.PublicKey and crypto.Signature, which are hardcoded to 32 and 64 bytes, respectively. BLS has 48 and 96.

Potential Changes

• We should consider a "SmallBytes" codec which uses uint8 to encode length, rather than int.
• We may want to send to an address/arbitrary bytes instead of sending to a public key (will be needed for WASM anyways). Addresses/Programs should be "indistinguishable".

[0xJohnnyGault]

We are hacking on an Auth that uses secp256r1 (P256) which is what WebAuthn uses, and have a POC where the browser can sign transactions using biometrically protected private keys. The P256 curve basically turns every browser into a overpowered crypto wallet. The WebAuthn plumbing even includes scannable QR codes to sign from your mobile while using a desktop browser. Anyway, it seems like the ed25519.PublicKey type is pretty deeply baked throughout the HyperSDK code. It would be very useful to see some sketches of how to best incorporate a generic Auth pattern.

[patrick-ogrady]

We are hacking on an Auth that uses secp256r1 (P256) which is what WebAuthn uses, and have a POC where the browser can sign transactions using biometrically protected private keys. The P256 curve basically turns every browser into a overpowered crypto wallet. The WebAuthn plumbing even includes scannable QR codes to sign from your mobile while using a desktop browser. Anyway, it seems like the ed25519.PublicKey type is pretty deeply baked throughout the HyperSDK code. It would be very useful to see some sketches of how to best incorporate a generic Auth pattern.

Exactly why I want to fix this 😓. Thanks for sharing your use case!

I am planning to work on this right after the first public Devnet is launched. It'll be a pretty easy integration (Address will basically become a byte slice instead of a fixed-size ed25519 public key byte array). It will then be up to the VM user to specify an address scheme that makes sense for them (will also make adding abstract accounts/interacting with WASM programs MUCH easier).

[patrick-ogrady]

Great blog on this topic: https://gogo-webauthn.fly.dev/blog

And associated code: https://github.com/multisig-labs/webauthn-demo