Social key recovery

[samuk]

I'm still a complete Newb to this project so apologies if this is unhelpful. My understanding is that

• Sideband/other clients auto-generate keys as the account is created?
• These keys are effectively an identity on the network.
• If the keys are lost the identity is lost

If these three are in fact the case, could https://darkcrystal.pw/ be an interesting model for backing up those keys.

[trosel]

Yeah Reticulum could be used for a shamir secret sharing system for any key-based network.

For example, Nunchuck bitcoin wallet uses Matrix to coordinate this I think. They could use Reticulum instead.

[markqvist]

@samuk, yes, your understanding is correct:

• Client programs generate a random identity, which is essentially a set of cryptographic keys.
• These can then be used to create specific addresses on the network, for example for LXMF, the protocol that Sideband and others use to send and receive messages.
• If the keys are lost, the identity and associated addresses are lost. Both Sideband and Nomad Network allows you to back up your identity keys.
• The keys could perfectly well be backed up using Shamir Secret Sharing, as @trosel mentions.
• Nobody has made such a system yet, but if anyone feels up for it, it would be very cool :)

[markqvist]

The only implementation currently available is the reference implementation in Python. Bindings for other languages, and a complete C++ implementation is coming in the not too distant future. I am probably also going to add a complete JS implementation, but it will be after the C implementations are ready.

But until then, nothing is stopping you from writing a simple wrapper in python that exposes the functions you want over an API that a JS client can speak to. If you are only interested in sending and receiving LXMF messages, it is a pretty simple task: You basically just need a wrapper for sending a message, and checking if any new messages have been received, or use a websocket that can notify your JS client when messages come in.

The wrapper would just be a small python program running somewhere, either directly on the device of the user, on a computer on some network, or on a remote server even, depending on what you want to do.

So to answer your question: Yes, you could write a javascript client / wrapper that could connect to any generic Reticulum node and send and receive messages. If you don't want to implement all the necessary layers of Reticulum yourself in JS, use the existing python implementation, and expose an API that is accessible to your JS client.

If you do want to take on a full JS implementation, I will definitely give you all the support I can, and make sure to implement a WebSocket Interface in the Python reference implementation that it can easily talk to ;)

[samuk]

Is the reticulum identity compatible with the Bluesky way of doing it? https://atproto.com/guides/overview

[markqvist]

That's a good question :) I'm having a hard time finding any info there on how exactly they are doing it, but honestly I didn't look too much through everything.

Reticulum Identities are an X25519/Ed25519 dual keypair, with the X25519 keypair used for generating ephemeral session keys for links and such, and the Ed25519 pair used for signing and authentication purposes.

[trosel]

Bindings for other languages, and a complete C++ implementation is coming in the not too distant future

I wonder if it would be better to try to compile the python code to wasm. then we could include the wasm module in the browser app

[samuk]

That's a good question :) I'm having a hard time finding any info there on how exactly they are doing it, but honestly I didn't look too much through everything.

"We use two interrelated forms of identifiers: the handle and the DID. Handles are DNS names while DIDs are an emerging W3C standard"

Looks like if you had the time/energy you could join that:
https://identity.foundation/join/#individual
https://identity.foundation/interop/

[samuk]

A bluesky dev expanded on this a little in response to my question: bluesky-social/atproto#363 (reply in thread)

I asked a similar question here: decentralized-identity/interoperability#65 to find out what would be involved in making a reticulum identity DID compatible.

[markqvist]

Adoption aside, they will never solve encryption nor portable accounts because censorship is a feature for them. The benefit is that the server admin is a tiny dictator. If they take that away, they lose their core audience.

While I wish this wasn't true, I agree with this view on the matter.

At this point, I am also not really concerced with attracting millions of users. I mean, sure, it would be nice to have a larger base of users for donations, which might make my existence a lot more comfortable than it is currently ;) But I really don't care too much about that, I'd rather have Reticulum reach it's goals in the long run, and I think too much adoption too quickly can actually damage that. I've worked on Reticulum for almost ten years now. It's pretty crazy to think the first draft of the protocol was made in 2013, and how much has happened since then. I really try to focus on the long-term viability and building proper foundations, rather than just getting massive adoption as fast as possible.

One of my goals for the next three months is to create much more visibility into where Reticulum is coming from, and where it is going, both from a technical and philosophical perspective. This is not something I have spent a lot of time on so far, but I think the time is about right at this point. Some early efforts in this regard is the publicly visible Development Roadmap, but much more is obviously needed, which I am currently working on.

Some people may also be wondering why I'm always very hesitant to connect Reticulum with "Web Standards", RFCs, or any kind of attachment to the giga-ton freight train of momentum that is the W3C. I should probably expand a bit more on this, but the short story is that anyone who wants to integrate Reticulum into existing systems, protocols, environments, applications, standards, or whatever really, should of course just go ahead and do so in any way, shape or form that they choose. That is part of the point with the openness of the protocol and implementation. Go crazy! Do something cool and unexpected that I did not think of.

But on that account, there is also a very important facet to consider. Having to work within the domain of the totality of the established digital communications environment is exactly one of the things I am trying to transcend with Reticulum. It is very much the point to enable something new, something that was not possible before, within the context of "we all stand on Ethernet and IP, and that is all we stand on".

Reticulum can genuinely do more than that platform, and simplify a whole lot of things in the process. As an example, take the whole popular fury around "distributed digital identities" currently. Why does it seem to be such a complex problem to solve in a good way? Because it has to be built on top of an old foundation, perhaps, but probably also more because a lot of entities have very real interests in keeping it very complex. It does not have to be that way. A distributed identity system build on Reticulum is simple and elegant. In fact, it is mostly already build in. A few more API functions added to the core of Reticulum, and you have it already.

This is the kind of "foundation-work" I will try to direct most of my work and attention towards. While it is not always very clear why I decide to work on particular areas or features, this is most often the driving logic behind the decisions I make in regards to Reticulum. Apart from those times where I just want a bit of fun, of course, and implement something like the LXMF Paper Messaging system :)

[samuk]

Thanks. I do appreciate the long-term view.

I am drawn to the digital identity challenge. It seems like that could be a bridge between the old web and something more interesting. If Reticulum/ Sideband could be a convenient and secure identity provider I imagine many app developers would lean on it.

Once you have a few hundred thousand people with an identity on Reticulum it becomes more compelling for third parties to develop for it.

[samuk]

Spotted this Android app that implements Webuthn https://github.com/duo-labs/android-webauthn-authenticator

[markqvist]

That's funny, I stumbled upon it the other day as well. But "unfortunately" it seems to be only a library. For now, there is no actual app build up around it?

Btw, I am really curious to hear your thoughts about how an ideal distributed identity system would look, if you don't mind sharing some opinions and thoughts on the area?

[samuk]

I'm no expert in this at all, but this seems interesting as an Android/ iOS app, Sideband+

• Reticulum key used as the basis for:
• DID similar to Scuttlebut DID
• Fido2 / Webauthn
• Key backed up with an implementation of Darkcrystal.pw

Assuming thatFido2/ Webauthn becomes widespread, I could get my mum to install the app, mainly for use with Webauthn.

It could additionally provide an identity for Atproto, Websites or of course Reticulum