(v0.6) Biscuits, DIDs, and MPC

[prnk28]

Original Video

The Problems with Centralized Identity

From the speaker's presentation, several key issues emerge with traditional PKI and centralized identity:

1. Compromise in PKI implementation - "huge compromise and what we got instead was public key infrastructure"
2. Over-reliance on trusted parties - "we're gonna have one guy that knows how to assign identities"
3. Scalability issues with certificate authorities - "instead of just one guy that's very careful we have about four hundred guys"
4. Limited flexibility in authorization models
5. Cookie/token theft vulnerabilities
6. Lack of contextual authorization controls

Proposed Solution Architecture

Let's build a solution combining:

• Biscuits for authorization
• Cosmos SDK for the blockchain layer
• DID module for decentralized identity
• MPC for secure key management

Core Components

// did/module.go
type Module struct {
    keeper        Keeper
    accountKeeper auth.AccountKeeper
    bankKeeper    bank.Keeper
}

// Smart account interface implementing auth.Account
type DIDAccount struct {
    auth.BaseAccount
    Controller string
    DIDDoc     DIDDocument  
}

// DID Document structure
type DIDDocument struct {
    ID              string
    VerificationMethods []VerificationMethod
    Services       []Service
    Authentication []string
}

Key Management with MPC

We'll use the onsonr/crypto library for MPC operations:

// did/crypto/mpc.go
import "github.com/onsonr/crypto/mpc"

type MPCKeeper struct {
    threshold int
    parties   []mpc.Party
}

func (k MPCKeeper) GenerateKey(ctx context.Context) (*mpc.Key, error) {
    // Generate distributed key shares
    keyGen := mpc.NewDKG(k.threshold, len(k.parties))
    shares, err := keyGen.GenerateShares()
    if err != nil {
        return nil, err
    }
    
    // Combine shares to create master key
    masterKey, err := mpc.CombineShares(shares)
    return masterKey, err
}

Authorization with Biscuits

// did/auth/biscuit.go
type BiscuitAuthorizer struct {
    verifier *biscuit.Verifier
}

func (a *BiscuitAuthorizer) Verify(token []byte, caveats []Caveat) error {
    // Parse token
    b, err := biscuit.Parse(token)
    if err != nil {
        return err
    }

    // Add caveats
    for _, c := range caveats {
        a.verifier.AddCaveat(c)
    }

    // Verify
    return a.verifier.Verify(b)
}

DID Operations

// did/keeper.go
func (k Keeper) CreateDID(ctx sdk.Context, creator sdk.AccAddress) error {
    // Generate key via MPC
    key, err := k.mpc.GenerateKey(ctx)
    if err != nil {
        return err
    }

    // Create DID Document
    didDoc := DIDDocument{
        ID: fmt.Sprintf("did:sonr:%s", hex.EncodeToString(key.Public())),
        VerificationMethods: []VerificationMethod{
            {
                ID: "#key-1",
                Type: "Ed25519VerificationKey2020",
                Controller: creator.String(),
                PublicKeyMultibase: key.Public(),
            },
        },
    }

    // Create account
    acc := NewDIDAccount(creator, didDoc)
    k.accountKeeper.SetAccount(ctx, acc)

    return nil
}

Authorization Flow

1. Client requests operation with DID
2. System generates Biscuit token with caveats:
   • Time restrictions
   • Network context
   • Operation scope
3. Token is verified using MPC-based signature
4. Operation executes if all caveats are satisfied

Example usage:

// Create authorization token
token := biscuit.NewBuilder().
    AddCaveat("time < 2024-10-26").
    AddCaveat("network = 'testnet'").
    AddCaveat("operation = 'transfer'").
    Build()

// Verify token
auth := NewBiscuitAuthorizer()
if err := auth.Verify(token, []Caveat{
    TimeCaveat{MaxTime: time.Now().Add(1 * time.Hour)},
    NetworkCaveat{Network: "testnet"},
}); err != nil {
    // Handle error
}

Benefits

1. Decentralized Trust: No single authority controls identity
2. Flexible Authorization: Granular control through Biscuit caveats
3. Secure Key Management: MPC prevents single points of failure
4. Standards Compliance: Built on Cosmos SDK and DID specifications
5. Scalability: Leverages Cosmos blockchain performance

Future Improvements

1. Add support for verifiable credentials
2. Implement cross-chain identity resolution
3. Zero Knowledge Caveats for Biscuit Authorization #1151
4. Expand caveat types for more complex authorization scenarios

This solution addresses the core problems highlighted in the talk while providing a robust foundation for decentralized identity management. The combination of Biscuits for authorization and MPC for key management provides both flexibility and security.

For implementation details, refer to the [onsonr/sonr](https://github.com/onsonr/sonr) repository and keep up with the latest Cosmos SDK developments.

Note: This is a high-level design - actual implementation would require careful consideration of security implications and thorough testing.