Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow management of private key and/or identity #84

Open
LBerlin opened this issue Jan 30, 2022 · 3 comments
Open

Allow management of private key and/or identity #84

LBerlin opened this issue Jan 30, 2022 · 3 comments
Assignees

Comments

@LBerlin
Copy link

LBerlin commented Jan 30, 2022

Right now it's difficult to demonstrate ownership of a key and the associated signed files. One can take new pictures and show that those are signed with the same key as any photo requiring proof of ownership, but if the app has to be reinstalled or a phone is lost then there is no backup of the secret and it is essentially impossible to prove who produced the evidence.

A simple improvement is to give the user the option to set or modify the keyId string to something unique and identifiable.

https://github.com/guardianproject/proofmode/blob/39b6a9e5c7b2ddd627f39b25548c24b73cecdd21/android-libproofmode/src/main/java/org/witness/proofmode/crypto/PgpUtils.java#L78

This probably also requires allowing the user to generate and swap between multiple keys if there is a need to generate both anonymous and attributable evidence.

A more robust approach is to allow users to manage the private key. Being able to import an existing key as in #40 would be ideal. Exporting the private key or an encrypted backup would also be minimal solutions to the problem.

@n8fr8
Copy link
Member

n8fr8 commented Jan 31, 2022

Fantastic request and very much inline with the new work we are kicking off.

@n8fr8 n8fr8 modified the milestones: Future Work, Spring 2022 Feb 3, 2022
@LBerlin
Copy link
Author

LBerlin commented Feb 5, 2022

That's awesome to hear. 😉

Is there a possible workaround in the meantime for backing up the keyring? I'm assuming the keyring file can't simply be copied from the filesystem since it's saved to a path generated by context.getFilesDir()?

@n8fr8
Copy link
Member

n8fr8 commented Feb 8, 2022

Releasing coming often now, so standby...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants