search

bitpay / bitauth

Authenticate with web services utilizing the same strategy as Bitcoin.
MIT License
497 stars 171 forks source link

Add encryption #38

Open levino opened 9 years ago

levino commented 9 years ago

Is there any middleware that adds encryption to this? Signature is nice but I would love all data to be encrypted on the client with the server public key and decrypted on the server with the server private key and vice versa. Would be nice to have another piece of middleware for this. Any plans for this?

xcthulhu commented 9 years ago

A plausible way to achieve this would be to use AES and ECDH for shared secrets.

This approach has a nice feature, thanks to the mathematics of Public-Private key crypto: the sender can securely specify multiple recipients. This would allow for multicast rather than just simple server-client interaction. Also, a particular client could use a server for securely chatting with other clients, with the server simply acting as a mediator, which might be a stopgap protocol until things like whisper and telehash get widespread adoption.