eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Authorize remote modules with bearer proofs

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 19:16:30 +02:00
commit 7e39a19c18
8 changed files with 572 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/architecture.md
View file

@ -271,8 +271,11 @@ as resource-scoped auth operations and rejects trust-mutation capabilities such
as `auth.delegate`, `auth.revoke`, and `node.enroll`. Bearer challenge/proof
commands derive deterministic BLAKE3 keyed responses from the bearer secret,
resource, nonce, and requested capabilities, then verify them against active
resource-scoped bearer grants. The daemon does not yet store payload key
material, encrypt resource data, or distribute key envelopes.
resource-scoped bearer grants. Remote resource operations can carry optional
bearer proofs over the protected Iroh control path; a valid proof authorizes
only the requested resource capability and does not create node trust. The daemon
does not yet store payload key material, encrypt resource data, distribute key
envelopes, or separate public bearer ids from private bearer tokens.
## Multi-User Direction