uPort – Usable key management & identity - Rouven Heck and Dr. Christian Lundkvist

[Music] hello my name is Ruben I'm here with Christian and we both work at consensus and we want to give you an update on you port usually I start this talks telling about identity in general and how important it is but I think for for this crowd I skipped that part and obviously identity in all the kind of forms like for people for tools for everything it's super important today I want to focus on the challenges I think the community here is dealing with mostly obviously key management we spoke about user experience for the average show and mobile and I think we had already in the last three days quite some interesting projects with meta mask with mists and others light lines I think there's a lot of things happening and I think we have something which is a little bit different and very complementarity those things which already people are working on so it's pretty exciting identity and data ownership is a obviously huge topic and we will touch on this to certain extent but will not completely cover this because ten minutes is a bit short for some other stuff so again want to go first to explain a little bit about the design principles from you party class and the core things we we believe self seven identity is the solution we need to we need to achieve it's really important that it's used like easy to use so we have we spend a lot of time on thinking about usability and ultimately if you want to do anything in the in the digital world reputation and Trust is really important so we spend a lot of time thinking about attestations and how we we built a platform which can establish this trust so the three main element is how do we recover keys what's an easy way to do this without relying on a company or someone else to do this and we have some interesting ideas on this we need a new persistent identifier so I think that's something at the moment people to use public keys that's kind of your identifier and that's what people use but what happens if you use your key or you it's kids gets compromised and then you start from scratch so I think we have now given to Piper our our key and let's see what happens if things get lost so I think it's really important that we find a way and I think we found at least a good idea how we can tackle this problem and attestations and attributes there's a key element to this so once you have an identifier can now claim certain attributes and go and get data stations from institutions from I know whether it's a bank whether your employer your landlord whatever this and over time you build and connect it to your identity more and more elements which you can then share selectively to relevant parties and you build up a like really strong reputation and therefore the trust you need to interact with digital services and Christian will I'll tell you how we solved it exactly so the way we deal with key management first is that you know in order to interact with aetherium you need to have a system for managing keys so normally what this has been is you have a key maybe encrypted in a file and then you need to make sure you don't lose that file or maybe you have a 12 word seed or mnemonic then you need to write it down but you need to write it down securely etc so we're taking a slightly different view so mobile devices today especially those with secure enclaves can provide a very safe environment for a private key so what we're doing is we have a private key it's in the secure Enclave and it's never supposed to leave the device so in order for this you have a problem what happens if you lose your device the idea there is to have a key recovery system where you can tell your friends or other delegates that they can go in and actually have authority to restore your identity if if you need to and so in order to do this we use a what we call a proxy contract as your core identity construct so the address of the proxy contract is your identifier whenever you want to interact with an app Asian contract what you do is you send a transaction from your phone you sign it with your key but you send it through a controller contract through the proxy contract and to the application the application uses the message dots under construct in solidity and it sees the proxy country the address as the as the sender so what this means is that we can extract the the access control logic in a controller contract that is accessed by the device key but it also has a multi-sig recovery feature so this allows you to if you lose your phone you get a new phone you can regenerate a key but your recovery friends can can recover you so that's the background and now we're going to show a demo if it works so this is integration with the gnosis platform that Martin just talked about here we go so basically what you see here on the on the phone it's very simple my phone up and you download it and it is very like it's generates automatically the private key it automatically generates the smart contracts Kristin just mentioned and what we're going to show you now is an interaction like what's the usability for for you if you if you use this so let me see whether it works so what you see is this is just the profile app you scan the QR code on the app so there's nothing installed on this on this browser you just go to the app to the gnosis page in this case you see the identifier it's the same you you have here you should see your balance it's a little bit small maybe which is the same address and you see your your past transaction so the login process is very simple we just hand over the identifier well now we're going to show you signing a transaction so we go and purchase some chairs and doing so we just enter the amount and whatever we want to do and after we confirm this it will generate a QR code again that's not let's at the moment as MEP said we have some other ideas how we can make this more user friendly but we do now we scan the theorem and call and you will see now automatic we recognize it's a buy shares activity and now to use it and sign it needs to private key so it asks for the for the biometrics and what it does now it sends it to in Fuhrer to relay the message and we sent back this transaction hash to the application so it can immediately react so it's not like waiting for fifteen seconds you see the hash here as that hey something has happened but it's still processing it so because it needs to mine and for the next block and once the once the block is mind which hasn't been watched so that's kind of what we think is in like much nicer interaction with with this mark on tech we use already the four byte directory and ERC 67 so this Laura already happening so don't you see what I can go back so thanks to Piper Miriam [Applause] so we have not enough time today so we just briefly this is how it looks if you do is on a mobile so it works already today's you can open it like our test app in the moment you say connect it opens up instead of a QR code it just says it's jumps to the app you say authorize and it comes back to the application and you are identified with with your address it's pretty simple same works with signing a contract so it's kind of a neat our social recovery which Christie mentioned so the controller and what we have built for now is just to start and the idea is here you have a contact list of your friends and you just pick in this case three individuals you say this is my recovery key it will set up basically like a multi-sig but the user doesn't even know that he that is involved we keep it really really simple the flow how it looks like and I need to jump down a little bit faster you click instead of creating a new you port at entity you say recover you will generate a new key it would show this this is now your new one it will use this connecting to other to your friends they need to scan this and say oh this is this person they send a transaction to the controller to enable and I'll unlock you and reconnect you back to the identity F perform that's the position identify which we I think is really important I think we need to skip out okay so just briefly and running out of time so we have a lot of Martius like how we can use different keys of different levels to indicate Hardware wallets to make this much work I think we have a robust foundation but there's a lot of things we want to target come find us later we can talk about some of the vision elements a Christian needs to tell you know how you can use it yeah so this is the as a developer how do you integrate with you port so we have open source libraries they you write your app using a standard web 3 paradigm as fabian talked about we have a you port web 3 provider that you can just drop in the when you do the get accounts it will trigger the you port connect feature the scanning a QR code the same transaction or doing a contract call will will trigger the transaction signing flow it will by default it will take care of generating all the QR codes and stuff like that but you can also customize it if you want more specific integration so thanks you can find our libraries open source libraries on github we have a wave white paper on our website you pour toute me and if you want to have a taste of the app you can go to you port open a slash def beta for the iOS app or Android app is coming soon you can email us at Android at you port of me to hear more news about that great thank you very much Christian and Reuben [Applause] [Music] you