eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Separate bearer ids from private tokens

Browse source
This commit is contained in:
Eric Wendland 2026-05-20 13:10:34 +02:00
commit 460acab67b
9 changed files with 198 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/architecture.md
View file

@ -270,14 +270,15 @@ key envelopes, bearer secrets, and rotation. Revocation for private data is
modeled initially as secret epoch rotation. The daemon persists resource secret
epoch metadata through `secret create/rotate/status`. Bearer access is recorded
as resource-scoped auth operations and rejects trust-mutation capabilities such
as `auth.delegate`, `auth.revoke`, and `node.enroll`. Bearer challenge/proof
commands derive deterministic BLAKE3 keyed responses from the bearer secret,
resource, nonce, and requested capabilities, then verify them against active
resource-scoped bearer grants. Remote resource operations can carry optional
bearer proofs over the protected Iroh control path; a valid proof authorizes
only the requested resource capability and does not create node trust. The daemon
does not yet store payload key material, encrypt resource data, distribute key
envelopes, or separate public bearer ids from private bearer tokens.
as `auth.delegate`, `auth.revoke`, and `node.enroll`. Bearer creation returns a
private bearer token once and stores a separate public bearer id plus token
verifier in the auth log. Bearer challenge/proof commands derive deterministic
BLAKE3 keyed responses from the private token, resource, nonce, and requested
capabilities, then verify them against active resource-scoped bearer grants.
Remote resource operations can carry optional bearer proofs over the protected
Iroh control path; a valid proof authorizes only the requested resource
capability and does not create node trust. The daemon does not yet store payload
key material, encrypt resource data, or distribute key envelopes.
## Multi-User Direction

8
docs/roadmap.md
View file

@ -227,8 +227,12 @@ resource-scoped capability decisions.
the requested resource capability without granting node identity.
- `[x]` Tests verify remote CAS fetch succeeds through a bearer proof before
the caller has a node grant.
- `[ ]` Future completion avoids sending bearer secret identifiers as proof
material by separating public bearer ids from private bearer tokens.
- `[x]` Bearer creation separates the persisted public bearer id from the
private bearer token returned to the caller.
- `[x]` Bearer list/revoke operate on public bearer ids while proof and remote
authorization use the private token.
- `[x]` Tests verify the public bearer id differs from the private token and
remote bearer auth uses the token.
- `[~]` SSH certificate and revocation lifecycle.
Acceptance criteria: