Connecting IPFS users and permissions to DIDs with UCAN

Hugo Dias

@hugomrdias

Software Engineer at Protocol Labs
Team DAG House
Working on nft.storage and web3.storage
Previously js-ipfs, js-libp2p, js-multiformats

DID

Identity

Authentication/proof of control
Decentralized/self issued
Guaranteed unique identifier
No call home
Associated cryptographic material

DID 1.0 just got the 👍🏼 to advance to W3C Recommendation after years of effort from many contributing organizations.

The Director concludes that the balance lies in favor of the DID developer community, encouraging it to continue its work and search for consensus on standard DID methods.
The objections are overruled.
– Tim Berners-Lee

https://www.w3.org/2022/06/DIDRecommendationDecision.html

The did:key Method

A DID Method for Static Cryptographic Keys

did:key:MULTIBASE(base58-btc, MULTICODEC(public-key-type, raw-public-key-bytes))

https://w3c-ccg.github.io/did-method-key/

UCAN

User Controlled Authorization Networks

Transfer authority without transferring keys

https://github.com/ucan-wg
https://ucan.xyz/

	UCAN
Trustless	Verifiable
Secure	Delegable
Local-First	Expressive
Attenuation	Extensible
Revocation	Capabilities

Permission delegation is something traditional centralized services can’t easily offer.
But UCAN !

DID + UCAN
💞

sequenceDiagram

  Note over Service,Marketplace: Service needs to know Marketplace
  Marketplace->>Service: Request UCAN for did:market
  Service->>Service: Signs UCAN for did:market
  Service->>Marketplace: UCAN upload/*
  loop Every time UCAN expires
    Alice->>Marketplace: Request UCAN for did:alice
    Marketplace->>Marketplace: Signs UCAN for did:alice
    Marketplace->>Alice: Short lived UCAN upload/IMPORT
  end
  Alice->>Alice: Signs UCAN for did:service
  Alice->>Service: UCAN+Car

dag-ucan

An implementation of UCANs in IPLD via Advanced Data Layout (ADL), designed for use with multiformats.
– Irakli Gozalishvili @gozala

https://github.com/ipld/js-dag-ucan

IPLD schema encoded as DAG-CBOR

type UCAN struct {
  version String

  issuer SigningKey
  audience SigningKey
  signature Signature

  capabilities [Capability]
  proofs [&UCAN]
  expiration Int

  facts [Fact]
  nonce optional String
  notBefore optional Int
} representation map {
  field facts default []
  field proofs default []
}

ucanto - framework for UCAN based RPC
(you can too)

oh yeah we can 💪🏼

A declarative system for defining capabilities.
Capability invocations routing and execution.
UCAN validation system.
A pluggable transport layer.
Client supporting batched invocations and full type inference.

DIDs + DAG-UCAN + UCANTO
=
Identity + Permissions + Operations
Packaged as CAR files

w3name with UCAN

Delegated "IPNS" mutation

What if IPFS could talk UCAN 🫶🏼

Delegated IPNS mutation
Delegate IPFS operations to remote nodes
Writable Gateways
Gateway routed operations
bitswap ?

What else ?

Future Work

Key Management
More tooling
UCAN transport specs