Connecting IPFS users and permissions to DIDs with UCAN
Learn More →
Hugo Dias
@hugomrdias
- Software Engineer at Protocol Labs
- Team DAG House
- Working on nft.storage and web3.storage
- Previously js-ipfs, js-libp2p, js-multiformats
DID
Identity
- Authentication/proof of control
- Decentralized/self issued
- Guaranteed unique identifier
- No call home
- Associated cryptographic material
DID 1.0 just got the 👍🏼 to advance to W3C Recommendation after years of effort from many contributing organizations.
The Director concludes that the balance lies in favor of the DID developer community, encouraging it to continue its work and search for consensus on standard DID methods.
The objections are overruled.
– Tim Berners-Lee
The did:key Method
A DID Method for Static Cryptographic Keys
did:key:MULTIBASE(base58-btc, MULTICODEC(public-key-type, raw-public-key-bytes))
UCAN
User Controlled Authorization Networks
Transfer authority without transferring keyshttps://github.com/ucan-wg
https://ucan.xyz/
 |
UCAN |
|---|---|
| Trustless | Verifiable |
| Secure | Delegable |
| Local-First | Expressive |
| Attenuation | Extensible |
| Revocation | Capabilities |
Permission delegation is something traditional centralized services can’t easily offer.
But UCAN !
DID + UCAN
💞
sequenceDiagram
Note over Service,Marketplace: Service needs to know Marketplace
Marketplace->>Service: Request UCAN for did:market
Service->>Service: Signs UCAN for did:market
Service->>Marketplace: UCAN upload/*
loop Every time UCAN expires
Alice->>Marketplace: Request UCAN for did:alice
Marketplace->>Marketplace: Signs UCAN for did:alice
Marketplace->>Alice: Short lived UCAN upload/IMPORT
end
Alice->>Alice: Signs UCAN for did:service
Alice->>Service: UCAN+Car
dag-ucan
An implementation of UCANs in IPLD via Advanced Data Layout (ADL), designed for use with multiformats.
– Irakli Gozalishvili @gozala
IPLD schema encoded as DAG-CBOR
type UCAN struct {
version String
issuer SigningKey
audience SigningKey
signature Signature
capabilities [Capability]
proofs [&UCAN]
expiration Int
facts [Fact]
nonce optional String
notBefore optional Int
} representation map {
field facts default []
field proofs default []
}
ucanto - framework for UCAN based RPC
(you can too)
oh yeah we can 💪🏼
- A declarative system for defining capabilities.
- Capability invocations routing and execution.
- UCAN validation system.
- A pluggable transport layer.
- Client supporting batched invocations and full type inference.
DIDs + DAG-UCAN + UCANTO
=
Identity + Permissions + Operations
Packaged as CAR files
w3name with UCAN
Delegated "IPNS" mutation
What if IPFS could talk UCAN 🫶🏼
- Delegated IPNS mutation
- Delegate IPFS operations to remote nodes
- Writable Gateways
- Gateway routed operations
- bitswap ?
What else ?
Future Work
- Key Management
- More tooling
- UCAN transport specs
