[MINUTES] W3C CCG Credentials CG Call - 2024-01-30

Thanks to Our Robot Overlords and Our Robot Overlords for scribing this week!

The transcript for the call is now available here:

https://w3c-ccg.github.io/meetings/2024-01-30/

Full text of the discussion follows for W3C archival purposes.
Audio of the meeting is available at the following location:

https://w3c-ccg.github.io/meetings/2024-01-30/audio.ogg

A video recording is also available at:

https://meet.w3c-ccg.org/archives/w3c-ccg-weekly-2024-01-30.mp4

----------------------------------------------------------------
W3C CCG Weekly Teleconference Transcript for 2024-01-30

Agenda:
  https://www.w3.org/Search/Mail/Public/advanced_search?hdr-1-name=subject&hdr-1-query=%5BAGENDA&period_month=Jan&period_year=2024&index-grp=Public__FULL&index-type=t&type-index=public-credentials&resultsperpage=20&sortby=date
Organizer:
  Mike Prorock, Kimberly Linson, Harrison Tang
Scribe:
  Our Robot Overlords and Our Robot Overlords
Present:
  Harrison Tang, gabe, Bob Wyman, Rashmi Siravara, Jeff O / 
  HumanOS, Jing Chao, Nis Jespersen , Brandi Delancey, Erica 
  Connell, GregB, pauld gs1, Vriti, Geun-Hyung, TallTed // Ted 
  Thibodeau (he/him) (OpenLinkSw.com), James Chartrand, Gerald 
  Glickman, Kaliya Young, pchampin, Will, Andres Uribe, Leo, Jay, 
  Sharon Leu, Nick B (Block, TBD), Phil (T3), Joe Andrieu, Wendy 
  Seltzer, Tim Bloomfield, Daniel Buchner, Nate Otto

Our Robot Overlords are scribing.
Our Robot Overlords are scribing.
Harrison_Tang: Welcome everyone to this week's w3g meeting so 
  today we have uh Gabe uh Gabe Hogan Ken from TVD to actually talk 
  about the ID DHT uh there was a very interesting conversation 
  Thread about a month ago and uh I think uh some people some 
  people actually pay me and said hey can we bring Gabe on to have 
  this discussion and uh very excited to have him here and thanks 
  him again for taking the time uh to actually drop by and talk 
  about the idea BHT.
Harrison_Tang: Before we we uh start I just want to uh go over 
  the code of ethics and professional conduct reminder I just want 
  to make sure that we have a friendly and uh productive respectful 
  conversation I think we've been doing that for years but still uh 
  doesn't hurt to have that quick reminder at the beginning of 
  every meeting.
Harrison_Tang: Next uh a quick intellectual property note anyone 
  can participate in these calls however all substantive uh 
  contributions to any ccg work items must be member of the ccg 
  with full IPR agreement signed so if you have any questions in 
  regards to the w3c account or the w3c come near the contributor 
  license agreement uh please just uh ping any of the culture here 
  whether it's uh uh Kimberly uh will or myself.
Harrison_Tang: Try a quick call note uh these meetings are being 
  automatically recorded and transcribed and we uh try to uh 
  publish it in the next few days I think we have been quite timely 
  recently but uh if you have encounter any issues with that uh 
  feel free to obtain us as well.
Harrison_Tang: We use a GT chat to 2 speakers during the call uh 
  you can type in Q Plus to add yourself to the queue or cue minus 
  2 to remove and you can type in Q question mark uh to see who is 
  in the queue.
Harrison_Tang: All right um is customary just want to give a give 
  a quick moment uh for introductions and reintroductions uh if 
  you're new to the community where you haven't been.
Harrison_Tang: Deduce yourself uh please just feel free to 
  unmute.
Harrison_Tang: Actually I see a lot of new faces but uh.
Harrison_Tang: I won't call names.
Gerald_Glickman: Okay I'm happy.
Nis Jespersen :  So hey yeah I've uh been on meetings before but 
  it's been a while Frank hick from uh the TBD Team part of block.
Vriti: Hi I'm Rudy Seraph also have been to meetings in the past 
  but it's been a while uh I am the founder of ed3 Dao we're a 
  community of Educators looking at blockchain and uh other 
  credentialing Technologies to move education forward.
Gerald_Glickman: Hi this is Gerald Glickman uh first time 
  attending a meeting here thank you all I work in fraud and 
  identity risk management at MVB Bank.
Harrison_Tang: Any anyone else want to uh introduce or 
  reintroduce themselves.
Pierre-Antoine_Champin_(W3C): Uh hi children chopper from w3c um 
  I'm team contact of the did working group uh but not so much 
  attending this uh this CG on a regular basis um.
Pierre-Antoine_Champin_(W3C): Yeah I've been here a few times 
  before and I'm looking forward to today's presentation.
Harrison_Tang: Welcome and no problem uh feels you know even if 
  you can join us once in a while we always welcome you.
Harrison_Tang: Right uh announcements and reminders are there any 
  news that or announcements that people want to share uh if so uh 
  feel free to just unmute or type in Q Plus.
Harrison_Tang: All right uh any updates or questions on the work 
  items.
Harrison_Tang: All right last calls for introductions 
  reintroductions announcements or work items related topics.
Harrison_Tang: All right uh so let's get to the main agenda um.
Harrison_Tang: Again uh very glad to have Gabe here to talk about 
  uh did D DHT which stands for decentralized identifiers 
  distributed hash table actually most recently uh we have uh more 
  topics on selected disclosures and cryptography so I think uh 
  having a session on the decentralized identifiers uh is actually 
  a good call and a very good glad to see all these uh new faces 
  here so uh thank you gate for giving us opportunity uh to draw 
  new members and new audiences but without further Ado uh okay the 
  floor is yours thank you.
Gabe: Thank you thank you Harrison for inviting me and hello 
  everyone brief intro my name is scape Cohen I'm a.
Gabe:  head of.
https://www.tbd.website/ https://developer.tbd.website/
Gabe: Director of Open Standards at TBD and focused on taking 
  things from the standards world to implementations and I've been 
  in the space for a number of years now maybe just over 5 years 
  and TBD for those who don't know I'll drop some links um is a 
  business unit inside block similar to how Google became alphabet 
  block became Square sorry Square became block and uh there are a 
  number of business units under it you might have heard of square 
  or cash app or title and we're a new 1 called CBD that's focused 
  on decentralized financial um products making the the centralized 
  Financial World accessible for everyone.
Gabe: And in this um project we make every use of dids and 
  verifiable credentials and decentralized data storage.
Gabe: So we are looking for a few sets a few did methods that 
  make sense for for our usages and historically I can go into what 
  we've used they'll share my screen in a second but we've we've 
  recently come to think that uh did DHT is what we like and are 
  going to use from now on so I'll go into a bit more detail but 
  please put your questions in the chat I'm interested to hear any 
  and all feedback.
Gabe:  let me.
Gabe: Share my screen I also want.
Gabe: To note that there are.
Gabe: Um please feel free to interject if you think I've missed 
  an important detail.
Gabe: So I won't tell you what did methods are I'm going to 
  assume that most people know what they are um so at the start of 
  TBD we supported a number of methods our primary method was ion 
  which is a side tree based in method from the decentralized 
  identity Foundation we also supported web and digit okay they all 
  have their steps of trade-offs.
Gabe: But we liked eye on the most because it was the most robust 
  feature wise it was permissionless you didn't really have to 
  trust anyone uh it had strong ordering so you could rotate in 
  store keys of many different types and sizes and you could have 
  uh different properties it did have some downsides uh the ux was 
  kind of tough there's this concept of long form identifiers.
Gabe: In short form identifiers and you had to wait for a Bitcoin 
  transaction to make it to the blockchain to have certainty in 
  your did State and waiting 10 minutes wasn't a great ux for some 
  of the real-time use cases we're looking at.
Gabe: Um also it was it's pretty complex architecturally to 
  deploy and maintain and there weren't that many nodes out there 
  so in theory decentralized what I like to call decentralized but 
  in practice not that decentralized if 1 or 2 people are really 
  the only ones supporting the network.
Gabe: So we're trying to think of a method that could actually be 
  decentralized and meet our business use cases.
Gabe: Did web of course is is useful and interesting but not 
  decentralized because it relies on traditional web 
  infrastructure.
Gabe: Methods like did he or did jbu K are are useful for some 
  use cases but not that robust and functionality and that you 
  can't rotate keys or add additional properties like service 
  endpoints so we're less interested in that.
Gabe: And looking at the did methods.
Gabe: Uh we're out there.
Gabe: We couldn't really find any of that gave us the guarantees 
  we wanted without buying into a blockchain or certain Ledger 
  technology that we saw as uh not a great business decision.
Gabe: So there are research started.
Gabe: So did the HT came up with after a number of months of 
  research last year.
Gabe: Stands for decentralized hash table more specifically a DHT 
  for those who are unaware you could think of it as a map of keys 
  to values um that is distributed so it doesn't just live in 1 
  server or 1 Network it lives across a number of servers and 
  networks um.
Gabe: You might be familiar with ipfs ipfs has a DHD.
Gabe: Um there are others as well and we're using a DHT that has 
  a very good track record.
Gabe: More specifically it's the bid torrent THD you might think 
  bit torrent oh.
Gabe: Why um and you you'd be right but something interesting 
  about bit toin is that it's been around for over 20 years makes 
  up a ton of internet traffic and is actually widely adopted by 
  many Fortune 500 companies like Google Facebook um Ubuntu many 
  other uh companies use it for Distributing software and updates 
  Microsoft does this for example.
Gabe: So there are less controversial uses of it it's a neutral 
  Network and it has a really good track record.
Gabe: The DHT for a bit torn is called Mainline and it's been 
  around for about 15 of these 22 years.
Gabe: Millions of nodes over 15 million on average every day it 
  varies.
Gabe: And um yeah my research over a thousand organizations using 
  it.
Gabe:  so we.
Gabe: Wondering if we.
Gabe: And the network is already decentralized which is really 
  attractive to us.
Gabe: Because we don't have to bootstrap a new network and 
  there's no blockchain involved we don't have to sell anyone coin.
Gabe: So what is the DHC.
Gabe: It is built on an open source Community project called the 
  car I will drop the link in the chat in a second and the car's 
  goal is.
https://github.com/nuhvi/pkarr
Gabe: To create a thin network uh overlay between the domain name 
  system.
Gabe: And um peer-to-peer overlay networks so.
Gabe: Real goal is to reimagine what a DNS server could look like 
  and ask what would a DNS server be if.
Gabe: Joe your unmuted.
Gabe: So par stands for public key addressable resource records 
  and the goal here is to.
<joe_andrieu> sorry. my microphone is crazy
Gabe: Uh create a linkage between the DNS system and verifiable 
  Records.
Gabe: Using the bit torrent DHD.
Gabe: And we thought this was a pretty interesting project 
  because all the records are signed and independently verifiable 
  there are some restrictions uh namely you have to have records 
  under a thousand bytes and you have to be republishing the 
  records aren't guaranteed to stay around forever uh on average.
Gabe:  we found.
Gabe: Testing they could.
Gabe: Set up for.
Gabe: Day or so but the.
Gabe: Only strong guarantees are a couple hours.
Gabe: So with these constraints we wondered if it would work but 
  so far it's proven to be pretty good and we've put in a number of 
  um.
Gabe: Interesting specific considerations in our design to 
  account and work around these.
Gabe: So most notably it has all features you need from did um 
  you could.
Gabe: As long as you're within that a thousand bite limit you 
  could add any property you want to did document you could have 
  different key types you can have different services.
Gabe: There are some built-in empty spam measures um.
Gabe: Daniel came up with a neat idea to do.
Gabe: Um an empty spam.
Gabe: Mechanism called a retention proof.
Gabe: Essentially means that you calculate a hash.
Gabe: And depending on the amount of work you put into this hash 
  it's a signal to the node you submit it to to retain it for 
  longer it's an optional feature um.
Gabe:  there's an.
Gabe: Be a Bitcoin and some other um mechanisms we're exploring 
  so we wanted to never require you use Bitcoin or any Ledger but 
  we wanted to make it an optional mechanism that you could 
  discover nodes that are going to um retain and republish your 
  data.
Gabe: It's worth noting that you could use any of the 15 million 
  nodes that are out there today um you would have to handle the 
  republishing yourself.
Gabe: So we make a distinction between pekar nodes.
Gabe: Our nodes and the bit torque nodes and our nodes are kind 
  of a added layer with a bunch of nice utilities and guarantees 
  and apis that manage your did I republish it for you and help you 
  discover um.
Gabe: Interestingly we we've Daniel had a neat idea to upgrade 
  and place did he dig jwk methods we think this could be really 
  promising.
Gabe: Um in the sense that.
Gabe: You treat both methods as they are today uh garant if they 
  have.
Gabe: Um any 25519 key uh which is required by uh bit torrent 
  DHD.
Gabe: So assuming that they did your digit wek or did key have an 
  ed25519 key you could resolve and use the dids as they are today 
  but do an optional resolution step to check the DHT for more 
  information and the records are all signed so you're always going 
  to be able to trust that it came from the controller of those 
  keys.
Gabe: So far we've talked to the spec authors for both methods uh 
  he and jwk and they're amenable to accepting an extension for an 
  optional resolution step to the DHD so it's kind of uh.
Gabe: These did methods superpowers.
Gabe: Um so I mentioned the Thousand bite maximum payload size 1 
  thing we had to do to um go around this was Define a mapping to 
  uh compress format and because pekar uses or aims to be a 
  replacement for DNS servers they use the DNS resource records.
Gabe: We had to define a mapping of did documents to DNS resource 
  records.
Gabe: Um hopefully this could be an independent spec if anyone in 
  the group is interested in that please let me know.
Gabe: So far it's a part of our spec but we're thinking a mapping 
  of did cdns records could be more broadly useful.
Gabe: So there's this translation that happens between I did 
  document a DNS record and then it's transformed to a packet.
Gabe: Encoded and compressed and then sent to um a DHT server.
Gabe: Is independently verifiable.
Gabe: And we've been running a free Gateway today uh to show how 
  committed we are we want to implemented the speck in a number of 
  different languages and have been running a free server for the 
  past few months uh without failure and have a few thousand DS 
  already.
Gabe: So our main goal over the next few months is to harden our 
  implementation uh we've been accepting a lot of feedback onto the 
  spec itself which would be great to have the groups feedback on 
  I'll put a link in the chat for that.
https://did-dht.com/
Gabe: We hope to uh move it to a different organization right now 
  it's just under the TBD name but we hope to put it in the ITF w3c 
  maybe diff or somewhere else we're open wherever folks are 
  interested.
Gabe: We aim to fully transition to DHT for our default did 
  method at dbd which is.
Gabe:  pretty much true.
Gabe: As of today.
<daniel> I am here
Gabe: Um there is a 1 last thing but before I get to it um anyone 
  from TBD.
Gabe: On the call have anything to add that I missed Daniel or 
  anyone else.
Gabe: I did I did yeah.
Daniel Buchner:  Did you go through the uh the did JWT and uh key 
  um what do you call it um you did okay where people just really 
  excited I was the.
Daniel Buchner:  Was the reception warm.
Gabe: I have not heard a reception yet.
Daniel Buchner:  Okay we'll ask them.
Gabe: Okay so the 1 more thing.
Gabe: Um there there is a it did working group that's being 
  rechartered currently and 1 of the thoughts or asks was to have 
  uh did methods that.
Gabe:  rise to.
Gabe: Standardization or a formalization that probe out 
  interoperability.
Gabe: And in the past did have gotten a lot of flack for many 
  reasons.
Gabe: Um but the 2 that send out to me are that they use the 
  blockchain or bad for the environment or we're actually 
  decentralized or fully featured according to the dcore spec and 
  we think this did method while it does have some limitations is 
  is pretty damn good in that it is truly decentralized.
Gabe: Can be fully featured and could have pretty broad adoption.
Gabe: An existing and the new method.
Gabe:  so we're.
Gabe: This could be a dead method that creates a path towards 
  adoption and browsers or um yeah industry-wide adoption Daniel go 
  ahead.
Daniel Buchner:  Yeah I think the thing to underscore here is you 
  know everyone you know how this all started years and years ago 
  everyone had their own did method uh they all had their own fun 
  blockchain it was all tokens everywhere and of course there was 
  this like incentive to um you know push your own thing right 
  let's let's be honest um and I think the 1 cool thing about this 
  is there's there's 2 things to be mindful of 1 there are a lot of 
  companies in w3c that do not like anything attached to a 
  blockchain um while some other people like even myself like 
  Bitcoin I don't believe in Bitcoin um.
Daniel Buchner:  They may not receive that the same right um and 
  we want this to be a viable thing I think the 1.
Daniel Buchner:  Would be a meth.
Daniel Buchner:  Bypasses both the blockchain you know dislike.
Daniel Buchner:  Do our own thing is that it really it's using 
  Mainline DHT for bit Torrance Network which is just been around 
  for so long and it's sort of just this thing that everyone's come 
  to accept even large companies like those and so that's why I 
  think it's got the best shot not because it's like is the best 
  method we could ever construct does it have every single crazy 
  feature you could ever imagine no but it has most of them and it 
  doesn't have any really contested points I think that's the 
  biggest thing right it's even compatible with other small you 
  know like more contained in methods like did jbk and key and I 
  think those things together kind of are a little bit of magic 
  that we might be able to work um if people are you know want to 
  jump on board.
Gabe: Yeah I thanks Daniel 1 thing to note is we we're pretty 
  reflective of the shortcomings and opportunities that we saw and 
  I would encourage you to read through the spec the both 
  implementation considerations and security and privacy 
  considerations where we go over all the different possible attack 
  vectors and our current mitigations are thinking around 
  mitigations.
Gabe: That is all I had prepared I would love to take questions 
  and comments um.
Gabe: If it's possible Harrison um but thank you.
Harrison_Tang: If anyone has questions please type in Q Plus 
  into.
Harrison_Tang:  uh chat.
Harrison_Tang: I got 1 question um so earlier you talked about 
  like uh.
Harrison_Tang: For the main line because bit to is a main line 
  like you have to republish it like every few hours or so so can 
  you clarify how do you actually address the Persistence of the 
  identifiers if you have to keep republishing.
Harrison_Tang: Republishing it to the main line.
Gabe: Yeah it's a good question so there's this fun diagram at 
  the top that shows how we think of the system at the bottom 
  everything's built on Mainline it's what provides the guarantees 
  then there's this open source project called the car which we're 
  leveraging and then there's the DHT.
Gabe: And each of them have their own servers so you could use a 
  standard uh Mainline DHT node you could use a car node.
Gabe:  or you could.
Gabe: Ght you know.
Gabe: Each of them.
Gabe: We're actually building our our own server that handles 
  your publishing for you.
Gabe: So you could not trust us that's fine you could go directly 
  to Mainline DHC or pekar node.
Gabe:  and handle.
Gabe: But if you submit it to our node um we'll handle 
  republishing on your behalf.
Gabe: Along with offering you um some nice things around 
  Discovery or um indexing.
Daniel Buchner:  Yeah and that's to underscore that um you know 
  while Mainline forgets you know things at a faster rate that's 
  why you do this to our republishing and we handle that for you um 
  did DHT nodes will be indexable by certain uh Registries so that 
  you can go to those nodes and they'll you know sort of the 
  guarantee they provide is not just that they're going to 
  republish but they'll keep them for longer um based on you doing 
  some work you know some other little um me mechanics that are 
  involved and so you can go to them and you could like you know 
  ask for just did and they're very special interested in this 
  right they like we're not just interested in any Mainline record 
  just anything we're interested in did base Mainline records so 
  they they uh they keep them you know longer if you specify that 
  and that's a good place to go to query if you want some like 
  features on top of what Mainline would give you in terms of 
  fetching.
Harrison_Tang: Any questions for anyone.
Gabe: I'm curious um anyone who is implementing or using dids in 
  their stack would you be interested in using the DHT or if not 
  what would hold you back.
Harrison_Tang: I don't see any comments here but uh.
Harrison_Tang: Question like can you kind of give us a a I guess 
  for the potential implementers like can you kind of give us a 
  quick rundown of the pros and cons of of uh you know DHT uh 
  compared to other more common well earlier we talked about the 
  DHT versus ion but uh can you actually provide pros and cons of 
  other methods yeah.
Gabe: Yeah it would be easier if there was a specific method uh 
  to go through but generally independent verifiability is a 
  shining feature you don't have to trust our nodes or a DHT node 
  all records are signed by uh the key used in the the document 
  which we're calling an identity key.
Gabe: Um so you don't have to trust us or anyone all records are 
  independently verified uh you could have.
Gabe: Different properties multiple different key types.
Gabe: And your we have a a small registry where you can add 
  extensions should you wish to.
Gabe: Others are able to encode into code your your did method uh 
  did documents.
Gabe: I would also say.
Gabe: It's actually decentralized it propagates to 1 of these 15 
  million nodes almost instantly and we've done tests where I'm in 
  California and my colleagues in Australia and they could resolve 
  it within a few seconds so almost instantly you have really 
  strong centralization and resolution guarantees.
Gabe: Other thing that.
Gabe: We didn't like about some existing did methods is they 
  didn't provide historical resolution which means after you change 
  your did State you're not able to see.
Gabe: Which could be really risky like if you rotate off a key 
  and use a lot of uh you signed a lot of data with that key you 
  rotate it off there's now no way for anyone to verify um the data 
  that you signed.
Gabe: So we see like historical resolution has a really key 
  feature and using our our Gateway nodes we were able to order 
  events um with a sequence number provided by the DHT.
Gabe: And provide historical resolution.
Gabe: Of did documents.
Gabe:  those are.
Gabe: Some of the.
Gabe: To go into.
Harrison_Tang: Brandy you're on the queue.
https://github.com/TBD54566975/did-dht-method
Gabe: We're hopeful that most people end up using gateways 
  whether it's ours or their own and we've made all of our code 
  open source to that end so we we really want to encourage people 
  to be able to to run their own gateways and handle their own 
  republishing should they want to and there's no need to rely on 
  us or another server and I just put a link in the chat to that.
Daniel Buchner:  And something something to um be mindful of is 
  that.
Daniel Buchner:  Because all you need to do in re rebroadcasting 
  these events to Mainline dhts have UDP ability so while browsers 
  can't do it extensions can native apps can on every platform 
  access UDP so all you really need to do to be completely 
  self-publishing to that network is have your device you know an 
  app on your device like a wall a d Wallet app or BC app or 
  something that understands the IDS wake up at intervals right 
  maybe every hour maybe every 2 hours whatever it is um and those 
  are typically allowed right just doing a single UDP push out is 
  something that um you can actually do and a lot of native 
  platforms uh just on a contrast and so that allows you to have no 
  you know you don't have to trust anyone right you can just have 
  your device and some device of yours is on even if you didn't 
  republish with a Gateway and didn't do the the things that do 
  perpetually keep it going um you yourself with just your own 
  devices could pretty easily um make sure that it's always 
  resolvable.
Harrison_Tang: I got a follow-up business question so what's the 
  cost involved uh for did DHT because earlier in your slide I see 
  the word free but most of the did methods like you have to pay 
  some um.
Harrison_Tang: Like some kind of fee right maybe not in US 
  dollars but in some kind of cryptocurrency uh to actually anchor 
  it uh to to I mean I'm talking about different uh.
Harrison_Tang: Did you realize your uh based of the ideas you 
  have to pay some kind of uh fees uh to to Anchor it on top of 
  those ledgers so like what are the costs involved is it truly 
  free.
Gabe: Yeah the only real cost is running a server um there's 
  another cost which I talked briefly about earlier around a 
  retention proof and that's our entity spam measure.
Gabe: Certainly someone could send a million uh registration or 
  query requests to our server and that wouldn't be great.
Gabe: We have a feature called the retention proof which is 
  similar to.
Gabe: Coin called proof of work.
Gabe: We don't require Bitcoin we don't require this retention 
  proof it's an optional feature that nodes could employ as an 
  anti-spam measure.
Gabe: Um so if you want your did retained you're going to do this 
  half.
Gabe: And the more hashing you've done it's a stronger signal to 
  the node to retain your did for longer.
Gabe: So nodes that are experiencing spam could enable this 
  feature and or or want to prevent it in the first place they can 
  enable this feature require that people submitting new did 
  operations Hash a bit and that will give you guarantees around 
  how long your data is retained.
Daniel Buchner:  Yeah effectively the 2 costs are um the biggest 
  cost on running 1 of these nodes there's there's storage um 
  actually the biggest 1 is Ayo right doing those those uh UDP 
  pushes um is is a cost and you can straight up you know if you 
  run that at scale uh on your own machine at home or whatever you 
  can do the electricity and the you know IO you know stuff on your 
  own machine um and and see what that would be for personal set of 
  DS and then obviously a larger Gateway provider can can just you 
  know make their hosting in the cloud or their you know some 
  infrastructure you can see what it costs for per call for Io 
  write a lot if you're doing it on a cloud they actually publish 
  like this is how much a million requests is right so you can you 
  can do the math pretty easily the other thing he was talking 
  about were retention proof is effectively um if you're going to 
  talk to a gateway gateway is that follow the the DHT spec um 
  basically just sort the um cache list of dids that they're 
  republishing based on the proof of.
Daniel Buchner:   The work that you provide.
Daniel Buchner:  So the more work.
Daniel Buchner:  Um the longer your did will be retained because 
  it's going to be farther up the stack right it's not going to 
  fall off the stack and so that's you know that's the the work 
  that you have to put in and that's just CPU Cycles so.
Daniel Buchner:  That makes sense.
Nis Jespersen :  Yeah another thing to add to some organizations 
  we've talked about um using this as a basis for their 
  applications.
Nis Jespersen :  Know consider I guess the the proof of work 
  approach is is kind of a fully decentralized approach where you 
  put the work on the client that's requesting to register and keep 
  you know retained and did that keeps getting published every 
  couple hours but the alternative also if an organization as a 
  reason to maintain these is just simply to gate the registration 
  process right so it can be even simpler than that we're the only 
  ones who can add to our set of nodes we maintain the nodes and 
  then you know ultimately because resolution can come directly 
  from any of the 15 million lines they really only have to 
  maintain a very small bit of infrastructure that just keeps that 
  republishing going every client regardless of which 
  implementation they use can always resolve and so in some sense 
  you know the maintenance overhead can be as decentralized and 
  open as you'd like or as controlled if it's for a specific 
  application that wants to ensure that the associated dids are 
  being continually refreshed.
Gabe: Yeah and the approach we have taken doesn't exclude paid 
  models like certainly someone could if you think it's a good 
  business idea set up a paid Gateway and I don't know pay 5 
  dollars to retain your did for a year or or something like that.
Harrison_Tang: So I'm curious like what about the historical 
  resolution it's like who's storing those histories is this 
  gateways uh responsibility to store that.
Gabe: That's right yeah that's right um so the Assumption there 
  is that you're talking to the same Gateway and if you're always 
  using the same gateway then they're going to become aware of um.
Gabe: All the different states of your did we have some ideas to 
  improve that and communicate between gateways but we haven't 
  gotten to that quite yet.
Harrison_Tang: Well I'm sorry.
Nis Jespersen :  Yeah by by default the main line DHD nodes 
  basically just keep the most recent High sequence number so 
  they're going to only keep the the last 1 um I guess worth noting 
  too there's nothing that stops you from going offline and then 
  coming back you know 20 days later and Publishing your data again 
  it's not like the the state clearly won't be resolvable but.
Nis Jespersen :  Mainline DHT has built-in.
Nis Jespersen :   You know this.
Nis Jespersen :  Whatever the last.
Nis Jespersen :  Whoever holds the private key material can 
  always republish.
Nis Jespersen :  Probably want to keep them around all the time 
  but there may be application use cases where it's it's not 
  necessary.
Harrison_Tang: Well I think you're on Q yeah.
Gabe: Yeah that's true um similar to did key and did jwk if you 
  lose your root key you're in trouble.
Gabe: That is an unavoidable constraint of this method it relies 
  on that.
Daniel Buchner:  I don't think it has to be it's it's a choice of 
  what you want to use you did for right like people it's kind of 
  like saying well you do people rotate Bitcoin address is 
  constantly probably not right they they we've shown that that 
  network has been around 15 years and people are holding keys with 
  12 words and you know that's working so I think the 1s trade-off 
  and it is it is a trade-off um but at the time that you know Ed 
  25519 is broken you know every the whole world's going to be 
  using new TLS things like switching over and at that point you 
  might switch your did over but we're talking about catastrophic 
  loss and a lot of the other blockchain based methods they don't 
  have it's it's not like they there's no way to lose it because if 
  there was no way to lose it it's kind of this truism test in the 
  world right if someone tells you there's no way that you can lose 
  your dead then it's not a decentralized.
Daniel Buchner:  Um there's a lot.
Daniel Buchner:  Of other things.
Daniel Buchner:  Stop gaps and like helpers but there's always a 
  way to to lose your did right even with ion they had a recovery 
  key but that's a recovery key if you lose that or the multisig 
  behind it yeah you're you're you're done so.
Nis Jespersen :  I mean I think another thing operationally too 
  is especially for high security High Assurance scenarios you know 
  likely that that root key the SoCal identity key is something you 
  would not maintained in memory you know hot right and so because 
  the did method allows you to have additional verification methods 
  you would likely use those for things like credential issuance or 
  other you know use cases where you're you're using the public 
  cryptography and keep that identity keep protected.
Nis Jespersen :  That's right yeah do you only need it for an 
  update or deactivate.
Nis Jespersen :   And there's.
Nis Jespersen :  At this stage but.
Nis Jespersen :  Um you know Ed keys do support the concept of a 
  threshold signatures and so you could have you know a backup to 
  the backup that is really a cold storage key that you only bring 
  out in the event your your key your identity key was let's say 
  lost and so.
Nis Jespersen :  To do that um but still under research.
Gabe: Yeah 1 more thing to add is we probably could expand the 
  section there on rotating to a new did and how you signal that um 
  which would help here as well for folks that do want to rotate.
Nis Jespersen :  Yeah I imagine you do that deactivate the old 1 
  and you put pointers to a new dead things like that techniques to 
  to indicate that there's a redirect to a new did know just 
  similar to every other dead method but.
Harrison_Tang: Any other questions.
<daniel> They really love to share files
Harrison_Tang: By the way this is just a curiosity curiosity 
  question I'm not very familiar with Mainline but what's the 
  incentive for people to kind of host the notes I mean earlier you 
  mentioned there's 15 million notes what's the incentive because 
  this is obviously most of us knows how distributed Ledger uh kind 
  of uh work right what's the incentive Behind These blockchain 
  networks but what's the incentive behind Mainline.
Gabe: Yeah as Daniel put in chat people really love to share 
  files whether it's for legal or not purposes um people share 
  content all the time and as long as.
Gabe: Torn is the best and most convenient way to do that then 
  the network will live on and for the past 20 plus years that's 
  been true um.
Daniel Buchner:  It's basically like this like if I had to be 
  crass about it and usually I am um.
Daniel Buchner:  How how long do you believe that porn and piracy 
  are going to exist and if you believe that that's going to be.
Daniel Buchner:  You know outside the realm of all our lifetimes 
  then you have pretty good layer of trust that Mainline is going 
  to be wrong.
Daniel Buchner:  So there you go.
Harrison_Tang: All right any other.
Gabe: Yeah so that would be a state where you're conflicting with 
  yourself intentionally and nodes have a way to handle this they 
  could notice that you're doing it and say we're not going to 
  support you.
Gabe: Or they could sort your data Alexa graphically and choose 
  the higher Alexa graphically sorted uh packet to be the true 
  source and that is in the spec as a conflict resolution step.
Nis Jespersen :  And yeah go and like all the way to the main 
  line level nodes will not accept a new publish with the same 
  sequence number.
Nis Jespersen :  So here to gauge point if you're doing this 
  yourself you can basically create.
Nis Jespersen :  This scenario but only you can do that if you 
  have the private key so it's a bit of an odd attack.
Harrison_Tang: Are any other questions from other.
Harrison_Tang: So earlier Daniel said that it's kind of hard to 
  tell whether people like this uh the ID DHT or not so if you like 
  uh the ID DHT or if you like today's presentation uh you can just 
  do the virtual Applause in the middle in the middle of this 
  button there's a little hand icon so you can do that in GT and 
  Nick please oh sorry I think he misclicked so anyway so I uh I 
  just want to say thank you again uh to Gabe Daniel Frank and uh 
  TBD team uh for jumping on board uh to actually answer questions 
  and hosted this uh discussion around the IDE DHT definitely a a 
  very very interesting um.
Harrison_Tang: Remains to be seen this is the the ID that ends 
  all the IDS but that's that is it is definitely a very very uh 
  interesting uh new date methods that I think uh most of us should 
  uh consider.
Gabe: Thank you for having us I I just want to quickly say um 
  please give us feedback uh they did method is.
Gabe: Be driven by the community and if you have ideas to make it 
  better we want to hear that but thanks for having me Sarah.
https://did-dht.com/
Harrison_Tang: Cool thank you and gate if you don't mind can you 
  send me the link uh to the the ID DHT spec and then I can send it 
  to the public list later so that people if people want to 
  contribute to the spec or have comments they can do so.
Gabe: Sure just put in the chat.
Harrison_Tang: Right so uh last call for announcements reminders 
  or work items.
Harrison_Tang: Great so I I think this concludes uh this week's 
  w3c she G meeting uh so next week uh we will have uh modular open 
  source identity platform uh you know coming next Tuesday and the 
  week after that we'll have updates on Social Web uh community 
  group uh so uh things like activity pop and fevers.
Harrison_Tang: Right thank you thanks a lot have a good 1 bye.

Received on Wednesday, 31 January 2024 07:52:09 UTC