search

stellar / stellar-protocol

Developer discussion about possible changes to the protocol.
517 stars 303 forks source link

SEP-0010 v2.0 #331

Closed theaeolianmachine closed 4 years ago

theaeolianmachine commented 5 years ago

To be further summarized, but the idea is to list all of the improvements and pre-discussion regarding SEP-0010 2.0.

Last comment from @nebolsin:

Unfortunately I don't have the complete proposal for now, but for authorization part I currently look at OAuth 2.0 Assertion Framework (RFC7521) with JWT Profile (RFC7523), Ed25519 Signing (RFC8037) and probably JWT Proof-of-posession (RFC7800). Stellar apps for hardware wallets will need to implement another type of signing for authn/authz requests, which clearly shows to the user which authorization scopes are requested and issue signed JWT assertion after confirmation. There's also a new Webauthn standard which looks promising, but I didn't yet figured out if it would be possible for wallets (including hardware) to act as Webauthn Authenticators.

nebolsin commented 5 years ago

It might also be a good idea to adapt Decentralized Identities spec (https://w3c-ccg.github.io/did-spec/) for authentication/authorization on Stellar, particularly implement generic Linked Data Signatures in the wallets according to the standard Ed25519 suite (https://w3c-dvcg.github.io/lds-ed25519-2018/).

theaeolianmachine commented 4 years ago

Closing this out to clean up my created issues across Github open source repos that are no longer relevant to me. If this is still an issue, please make a new issue to represent it.

leighmcculloch commented 4 years ago

For anyone who was following this issue I'm continuing this effort, at least as it pertains to accounts with single-signer-not-master-key or multi-sig, over at #489.