ipfs-shipyard / ipfs-shipyard/pm-idm

Investigate how Applications requesting IDM Wallet credentials prove they are legitimate

Open
#41 0 comments 0 reactions 0 assignees View on GitHub
discussion task
Dominant language
No language data
Stars
64
Forks
7
PR merge metrics
No merged PRs in 30d

Description

## Description

In the IDM Concept paper, we mention this:

> Applications may start an authentication process, issuing an authentication request to an IDM Wallet, containing the application DID and Verifiable Credentials with its details, such as the application name, and the credentials it wants to receive from an identity. The IDM Wallet will perform DID-Auth to ensure that the application is in control of the DID it presented. If successful, the user is then prompted to select an identity and to accept what the application is asking for.

Implicitly we are relying on something like DNS here in order for DID-Auth to ask questions about whether a given application has control over a particular DID. This implies that IDM's authentication mechanisms will not work nicely with locally run software which is not optimal.

Since the difficulty in this problem lies in the fact that it is hard for a locally run application GoodApp to prove it can control a DID in a way that a similar application BadApp cannot copy, finding a way to leverage the application's version/hash might be useful.

## Acceptance Criteria

- [ ] Investigate if signed application hashes, or other approaches make it possible to use DID-Auth (or a similar mechanism) for locally run applications.
- [ ] Investigate if the above approach works with both local and non-local web browser requests. Check out mechanisms such as [Subresource Integrity](https://www.w3.org/TR/SRI/) (Mozilla documentation [here](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity))
- [ ] If an approach is found (or it is found that no current approach is feasible), update the IDM Concept paper

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the IDM Concept paper passage describing application DIDs, Verifiable Credentials, and DID-Auth. Investigate signed application hashes and related approaches such as Subresource Integrity for both local and non-local browser requests. Done means documenting whether a feasible approach exists and updating the IDM Concept paper accordingly.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, documentation, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.