DFFML Rolling Alice: Engineering Logs: Volume 0: Architecting Alice, 12 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Architecting Alice: Volume 0: Context: Part 29: Fighting Dinosaurs with Lazer Guns in Hazmat

Description

https://github.com/intel/dffml/discussions/1369#discussioncomment-2739704

A

All right, let's go, let's go, let's go, let's go, um we are back in cryptography and we are figuring this out. So what do we got? What do we got? um We have our signing key which we're going to uh rename from jwt to key signing um just messing around right now.

A

And then we will pass it down here. So, let's just see, where else are we using that value? So key is signing keys, encryption right, so we're going to pass the encryption key to the uh we're going to pass the encryption key to the uh encryption stuff and we're going to get it by.

A

We're going to get that key by doing some, you know fun stuff in cryptography, hazmat, all right, let's see where we're at here. Okay, so.

A

Let's make this full screen.

A

Okay need a little bit more room there.

A

All right, what do we got so private key generate? We don't want that.

A

Public key generate: we don't want that private key exchange, pure public key, shared key okay that might be relevant for us. No, probably won't actually.

A

Because we don't care about the public proportion right now, because we're only using for encryption so derived key derive shared key private key dot exchange pure public key okay generate private key, generate private key exchange, pure public key okay: let's pull up philippo's go, go cold, go go, go code again, um let's take a look at them side by side.

A

Okay. What do we got here um and let's make sure that we attribute appropriately.

A

Bsd3 clause, fantastic.

A

References I like to put references here so um we'll say.

A

A

This is where we got it from.

A

A

What are we doing here.

A

About but so recipient, what do we got here? Ssh key public key, their public key okay. So we are encrypting for someone else's public key in this case.

A

A

This is the case, we're encrypting for someone else's public key.

B

A

A

Yeah, this is dangerous.

A

This is dangerous stuff.

A

All right: well, we will flag this for hello review.

A

Boom to do security, hello review done.

A

Okay, so generate a private key piece exchange. So what do we have? What we have are.

A

Where are we choking here, export private.

A

No private key available, okay yeah, so okay import from pam, so it can only import the public portion here. So why is that so? Import from pem host key so.

A

Let's look at jw, crypto, okay, so excellent, x, key exchange, okay.

C

A

Okay, let's maybe look at the private key interface itself. Public key private bytes allow serialization of the key to bytes.

A

A

From private bytes loaded as raw we're encoding class method for loading included as raw.

A

Raw, a raw format used by x448 key exchange is a binary format and invalid for other key types.

A

X44 key exchange, this looks very similar.

A

A

Danger: yeah, okay,.

A

First, we need to understand the difference. Okay,.

A

Where is his comment within? I know he had a comment within this code that references his blog post. Let's find that.

A

A

A

That's montgomery.

A

Okay, so ed public curve.

A

Where is this used.

A

References new ed recipient.

A

Okay, mkp their public key okay,.

A

It's not an ed, so we have an ed key and we're trying to take it to curve two five: five, one nine mpk. So this recipient, where is it used? Okay,.

A

Age, recipient, okay, what is this same thing?

A

Okay, recipient and recipient- is where we're calling rap okay. So, okay, I see so basically we come in here we create this new recipient object.

A

A

Ssh key okay, so we have a ssh ed25519 key correct. That's what we have as well.

A

We're looking for pk does not implement ssh crypto public key.

A

Or are we just encrypting it?

A

We need the private portion public key to curve one nine okay. But what can we do ed? Two, five, five, one: nine! I have that key to x, two five, five, one: nine.

A

Okay, yeah, okay, there's a blog post again.

A

A

This is use case example, code, hey.

A

They know what the hell they're doing, we're in the right place.

A

We do not recommend you do. This should never be reusing keys.

A

Potentially bad practices.

A

This is written in rust, okay,.

A

Okay, yeah yeah. Well, we don't want to well. We want to reuse a key only because this is all we've got right now um and we need to let's see.

A

How could we do this, otherwise,.

A

Okay, so we have a key, so we created the id the id says I own public key x.

A

Maybe we could just have the key sign. The id.

A

And then verify it in another document, I.

B

Really want to do it this way.

A

Do not recommend you do this should know if we were using keys for both asset indication and encryption.

A

A

They want us to use two different keys.

A

So what if we just used.

A

A

A

A

So what if we just generate all json web key? Well, it will do it for us.

A

Okay, generate.

A

Let's try this.

A

Well, I know we should listen to that.

A

I know we should listen.

A

You don't go around not listening to isis, she knows what she's doing.

A

They know what they're doing um yeah, I'm pretty sure they work on all of the krypto stuff yeah. We don't want to go against the recommendation.

C

ah Damn it: okay, fine.

A

All right, you know what let's just go this other word.

A

Let's make sure we document where we landed.

A

Okay, so this is basically you know, it's fine.

A

I want to go: do it now, but we'll leave it to somebody else who wants to make bad decisions.

C

It seems like a really fun thing to do, though. um Okay,.

A

All right, we're using keys, is not fun. We're using keys is bad.

B

As fun as it sounds.

A

Yeah and so why don't we reuse keys? I'm sorry, I should have explained that, um so why don't we reuse keys um and what what are we being told to do here so we're being told to generate some new keys and then basically, you know, uh you know, figure out a way to link them back to the old keys, so why?

A

Why was I so hell bent on on using the same key um because the it could just be like this, because we could have had um parody with the did key like we could have had the same key like if we could have used the same key. So basically, I could look up on github without being told.

A

Well, I guess I have to be told to go to github anyways, so.

A

You know I just I feel like there's something there, but I guess there's not so whatever.

C

We'll give up now.

A

Let's make sure this goes cleanly did not go cleanly.

A

A

To do these keys are not quantum safe, see.

A

What was that spec called.

A

It was called curie okay.

A

Jw crypto dot, jwk, okay, keys, encryption.

A

A

Okay, there we go so keys encryption.

A

Let's see what happens.

A

I still spelled it wrong.

A

I don't like that key.

A

So I don't like that key create multi-base, no malgo 2 as suspected.

A

Six, four, seven: okay, so that must be here.

A

Six four seven here: okay,.

A

Cannot concatenate stir not jwk to stir, so maybe we need to do um maybe if we did json or dot export.

A

Invalid jwk key type key agreement expected.

A

Okay, let's go check it out.

A

Key agreement expected.

A

Let's maybe just try this see what happens didn't like that.

A

Let's try this see what happens didn't like that, either all right x, key agreement expected. So I I have a feeling json webkey is the right kind of thing. If we pass a json web key verification, material format, period format, so jwk value.

A

Okay, but it likes taking the other one, just fine, so.

A

Okay, so let's dive.

A

Okay verification agreement curve does not equal x, 5.

A

Ec curve, okay, so yeah duh.

A

X25519, okay, so jwk has no attribute name.

A

hmm Okay, we do need to do export.

B

C

A

Turn for a key, it's not happy when generating now.

A

All right, we lost the fight against the dragons.

B

A

Let's go to jwk, let's check out the generate.

A

See what kind of docs that has generate.

A

Okay, otp okp stir one of okay. That's what we've got.

B

A

A

Why is generate not linked.

A

Grab r and generate.

A

All right, let's look for generate.

A

Okay, here it is so kty. So what do we have? We have kty ec tty, oct k2y rsa ec.

A

Generate kty rsa.

A

Generate ec okp okp okp one of okay, so it looks like this is a okp, so kty should be okp and there's our curve boom all right. Finally, okay, so what would we do if we wanted to link these to the ssh keys? How would we do that so.

A

We could say.

A

I have an ssh key thing. Is we want the ssh keys to sign so that we know it's the same key, so the whole point of that is using the same key hmm okay. So this works.

A

All right, so it works with us generating key.

A

A

So if we take that, okay, so what, if okay- but I want to do it- I still want to do it- I still want to do it. I still want to do it.

C

I can't help myself.

A

I can't help myself we're doing it.

A

A

So what do we have here so.

A

A

I want okay, how can we do this? Without doing this? You could have the ssh key sign some blob.

A

And then a did method and then a did. You can have an ssh key.

A

Yeah, I'm sure you can do it.

A

ah This is just so much easier.

A

Creates from any public, oh from a private key, that's the one we want.

A

Sample ed shut up signatures, signature scheme new key pair, none rap, okay version, key to key exchange, sign key to keep change key to keep exchange.

A

I guess normally, we only need the secret in the first half that's kind of sketchy.

A

Or I guess the secret is copy from slice.

A

A

B

C

We're gonna do it.

A

A

Sign key to exchange.

A

Verify key to exchange verify key to exchange.

A

Okay to montgomery as bites to vac all right, so we read it, and so we do what from bytes verified it's valid public key compressed, edwards.

B

A

Verify key choose key exchange; okay, but sign key to key exchange. Private key result: private key, okay, private key secret, two bytes, two vac okay, looks like some kind of macro.

A

A

Expand any key pair from the input q used to arrive at complete key pair expand key pair.

A

Signature scheme.

A

Feature x x, x, create new keys load keys, verify sign okay, whatever whatever, whatever ooh wait.

A

B

A

What is this ursa.

A

C

A

So if we could use this code, we could decode public key, so python cryptography uses the rest code, so there must be a good way to do this, probably through the new wheel packaging sent to key exchange yeah.

A

You look like a very nice function to call so we want to call you, let's see where is public key defined.

A

Private key public key so basically ensure that this public key is what we think it.

B

A

And sure the private key is what we think it is.

A

Private key okay, so basically this is saying.

A

How is this thing encoded.

A

So if we can encode the same way, then we can pull out, we can. We can we'll end up with this. We can end up with this. If we start with something that's in this format, we can end up with something in this format and then we need to figure out how to decode.

A

So what format is this hex encode.

A

A

Private key public key, okay, private key public key okay. What other methods do you have or functions whatever, whatever? Okay private key sksk exchange unwrap? What are your center key exchange? Result? Private key.

A

A

A

Private key private key private key per key. I guess this is some kind of interface. Isn't it I don't know rust um private keys, keys public is private. Key public key uses, keys, private key public key users. Keys is probably an encryption.

A

A

Keys keys, okay, private key implementations, byte array, okay,.

A

So back to my other question about how do I get this thing out of a byte array and what is it, what do what? How do we know what format this thing is in.

A

A

News forever from a pretty german secret: okay.

A

A

I'm obsessed with this, because we have no way to root trust without this right now, that's the fastest way, I think.

A

So these are just bite arrays, so these are the raw key type, whatever raw key type is.

A

So if we can get that into the raw key type, so where was the json web token.

C

I'm far from bam.

A

A

Okay, so these are some kind of it's bites, don't understand what the format is, but some kind of bites. So maybe- but this is a hyperledger thing, so maybe there's some kind of to json web token.

A

Or json webkey.

A

A

All right, json representation of master secret.

B

A

A

Let's see what this is.

B

A

C

A

Control primary public key.

A

Okay, these are key material.

A

A

Okay, all right now we're going to abandon this. We're just gonna start creating lists and we can verify identity later.

C

Okay, um fine, that's fine!.

A

Okay, so create peer to know I'll go to.

A

C

A

All right, this was okay.

A

So let's go to the pewdiepie display. Let's look at the rest of these demos.

A

Oh, that's it. Okay,.

A

Two resolve periodic number: two: okay,.

A

Resolve the id dock.

A

Okay, so how do we have one sign, the other one.

A

Multiple inception, key without doc,.

A

Your ability to specify additional keys in the generated dit document that is necessary when both an encryption, key and assigning key are required. Okay,.

A

Serve some coding.

A

Okay example: multi-key beauty, id okay,.

A

How do we, okay.

A

Give a story variant.

A

Okay out of playing protocol, one.

A

The id exchange protocol.

B

A

Is the user with the browser getting a point where connections need to return to websites? Enterprise agent, qr petition, display scan and if protocol is established? Life is good. However, the current invitation process, the same user returns to the same page. The process is executed. New connection is created between the two agent there's no way the users they just say. Hey. I've already got a connection with you. We need the ability to reuse a connection existing connection. Some did invitation handling. The inviter dictates the connection establishment, okay, so handling about a band.

A

A

A

How do I just make a message happen.

A

All I want to do is link one to the other.

B

A

Sender, receiver, states.

B

Receiver messages.

A

Invitation, okay,.

A

Okay request attach.

A

Did you account message to your id okay? So maybe we just need to go into did com now.

A

Pdid on the application levels- okay, so maybe we should go run this.

A

Python dylan script.

A

Okay, maybe we just need to do this demo.

A

All right: okay, let's check this out.

A

We may have gone too deep.

A

Okay to come, demo create qtids, okay,.

A

Okay, oh- and here was the stuff that we were just trying to figure out. Okay, all right, that was a red herring on that um github keys, okay, so resolve pdid.

B

Pack: okay, I'm.

A

Gonna stop diving through too much code.

A

Okay, now we're into did com.

A

A

Said I'm confused if did d-I-d-com uses pure d-I-d's underneath yeah d-I-d-com uses purity ids, but pdid's use d-I-d-com.

A

I'm confused, I think we want d-I-d-com, okay, so secrets resolver, resolver, config.

A

Jd com service, purity, id writing keys, accept create okay. Here we go.

A

A

A

Okay, so we should be looking at this stable branch.

A

This is too ahead of me: okay,.

A

A

Or to use a library secrets, resolver and dod resolver interfaces must be implemented.

A

A

Anonymous encryption example with non-repeat building critical.

A

A

A

Okay, this is perfect. This is what we want.

C

A

Okay, so we wanted, we just want to do this, we'll just save it to this format, and then we should have.

A

Wow, how many oh geez.

A

Okay, now we know how to.

A

A

A

Certain coded manifest.

A

So, instead of encoded manifest what if we did.

A

All right so manifest equals blank thing for now and then.

A

And then we'll go down here and we'll try to put the manifest in the body of this message.

A

A

A

Okay, yeah and so we'll use.

A

B

Opener 0.1 0.1.

A

Okay from alice's did to bob's did.

A

Okay, so d8d doc, okay,.

A

I'll go to to bob the id so bob the id will be elgo 1, because we just need to sign him.

A

Can you join f strings like this.

A

Message all right: what is this did calm.

A

C

Come on come on come on.

A

Backsigned where's pax signed.

A

We'll assume it's in the id compact side.

A

Hack signed ah yeah, that's right: small resolvers, config.

A

Missing one required argument.

B

Resolvers config, okay,.

A

A

This is clean: okay, nice well their apis. This is not clean. Okay, so.

A

Very very happy if we can make this work pack signed missing. Resolvers config come on.

B

A

Did yours over.

A

Okay, that's coming from this!

A

Okay! Do yourself.

B

A

A

Okay, where's the id resolver.

A

A

Okay, these are async, that's good, so this is where we're going to throw in our data flow- or maybe we'll just say,.

A

Wait stop.source.record.

A

C

ah I have to go, I think, we're close.