Hacker News Reader

Comment by tocf | Hacker News Reader

One of the issues with PKI is ensuring that the public key you're using to communicate with the person is actually the right public key, and that someone hasn't replaced it with their own.

I'm curious if you used something like the blockchain (but not bitcoin necessarily) to have a public ledger of published public keys (identities) would that problem be essentially solved? (IE if the keys and any signing for a web of trust be on a distributed public ledger, then you could be reasonably sure that you're dealing with the person really behind that public key?)

View on HN

There are a lot of ideas in this direction and some of them will probably eventually pan out.

A few things to look at (not exhaustive):

https://okturtles.com/

http://www.coniks.org/

http://www.certificate-transparency.org/

An important early formulation of this possibility was Aaron Swartz's, in "Squaring Zooko's Triangle":

http://www.aaronsw.com/weblog/squarezooko

Everyone has different ideas about how most efficiently and safely to make public records append-only and achieve distributed consensus, and also what kind of records to put in to the system and what rules to use for validating updates. One way in which proposals have diverged is whether to use blockchain-like distributed consensus for storing and distributing keys, or just for adding transparency to trusted authorities' behavior.

No mention of keybase?

I didn't see it as parallel to the other approaches, unless they've added a new verification technique that I don't know about.

Blockchains, to put it mildly, do not even resemble a viable solution in this space.

It would be helpful if you could explain why not, and whether your criticism applies just to proof-of-work mechanisms or to other approaches to consensus as well.

Consensus is not a suitable mechanism for authority. Consensus has many uses, but for use-cases where authority is a hard requirement - such as this one - consensus is simply not suitable. Authority needs to remain authority even if a bunch of other people would like it to be otherwise.

If the NSA can throw enough computing power at it and seize control of consensus to determine which keys are authoritative, then your whole PKI is useless.

I repeat: consensus is not a suitable mechanism for authority. Consensus has many other uses. Would you use a watermelon to lock a door?

Check out https://github.com/ssbc/ssb-docs. It' should have a beta release this summer.

Reply on news.ycombinator.com