Login with a Public Ed25519 Key

Re:Login with a Public Ed25519 Key by jazzyjackson on Saturday February 26, 2022 @08:06PM (#30484191)

right, would be better for the site to encrypt a one-time-use password with the public key you've, then all you have to do is decrypt it and log in, proving you possess the private key

does this have a name? always seemed like the obvious way to do it but I've never implemented auth

edit: I guess this is similar to a challenge/sign/verify signature scheme like webauthen, but is it inferior in some way?

[ Parent | on HN ]

Re:Login with a Public Ed25519 Key by woodruffw on Saturday February 26, 2022 @08:49PM (#30484515)

Yep, what you've described is pretty close to the scheme in WebAuthn. The main additions in WebAuthn are for protocol level security: there's an attestation nonce, a shared counter, and some other fiddly bits to make it harder/impossible to misuse.

[ Parent | on HN ]

Re:Login with a Public Ed25519 Key by Lurkars on Sunday February 27, 2022 @01:25AM (#30485916)

This is exactly what I use for an emailless password reset. Instead of sending a reset token via email, it's just encrypted with public key and user can decrypt token for reset password. There for I don't require to collect email address for account. Of course this could also be used as login method. On the downside, for UX purposes decryption can run in browser by passing private key. I have mixed feelings about pasting PKs into browser.

[ Parent | on HN ]

Re:Login with a Public Ed25519 Key by staticassertion on Saturday February 26, 2022 @10:19PM (#30485046)

SRP, PAKE, and OPAQUE. More generally, zero knowledge proofs (ZKP).

[ Parent | on HN ]

Re:Login with a Public Ed25519 Key by jazzyjackson on Saturday February 26, 2022 @11:18PM (#30485372)

thanks !

[ Parent | on HN ]

Re:Login with a Public Ed25519 Key by Zamicol on Monday February 28, 2022 @11:25AM (#30501645)

PoP, Proof-of-Possession.

[ Parent | on HN ]