Passkeys as Read Only Wallets

[GENERAL] Name and Surname of Main Applicant

Quirin Schlegel

[GENERAL] Email address of Main Applicant

mail@quirinschlegel.com

Additional Applicants

-

[GENERAL] Please specify how many months you expect your project to last (from 2-12 months)

7

[GENERAL] Please indicate if your proposal has been auto-translated into English from another language.

No

[GENERAL] Does your project have any dependencies on other organizations, technical or otherwise?

Yes

[GENERAL] If YES, please describe what the dependency is and why you believe it is essential for your project’s delivery. If NO, please write “No dependencies.” in this field.

1. Keycloak -> OSS Identity Provider
2. I will extend the functionality of Keycloak to use Blockchain assets to define Access Scopes in an OIDC Auth flow.
3. Apache 2.0 License
4. Kong -> OSS API Gateway
5. Apache 2.0 License
6. Open Policy Agent -> OSS Policy-based control for cloud native environments

[GENERAL] Will your project outputs be fully Open Source?

Yes

[GENERAL] If NO, please describe which outputs are not going to be open source. If YES, please write “Project will be fully open source.” in this field.

Project will be fully open source.

[METADATA] Category of Proposal

Dev Tools, API or Library

[METADATA] SDG rating

-

[IMPACT] Please describe your proposed solution.

Problem

The problem is user experience and security. Current wallets require a lot of know how to be used properly.

I see this a blocker for mainstream adoption.

Approach

This approach uses passkeys, which are native in every ecosystem, to derive a BECH32 address from the passkeys public key. Now the passkey owner can prove ownership of all assets stored at the derived address. In the next step the policy id and asset name as well as specific metadata is passed to an API gateway and gets evaluated with an access policy. Lastly if the users assets authorize the access for the requested resources, the access is granted.

Example Use Case:

This approach can be used to securely exchange information between untrusted parties, while ensuring Confidentiality, Integrity and Authenticity.

• C: Information access is restricted by asset ownership.
• I: Integrity can be ensured by a hash of the information in the asset's metadata.
• A: The Authenticity can be ensured by SSI assets in the sender's Wallet.

Engagement

This project engages other projects and businesses, who need a simple yet safe way to utilize a subset of blockchain functionalities.

Impact

The project has impact if it enables others to connect conventional services to the blockchain.

[IMPACT] How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?

My Solution makes it a lot easier and safer to on board new user groups.

Thus it will likely draw new developers to the Cardano ecosystem.

My reasoning for this conclusion is that my solution offers a radically different approach to the usage of the blockchain. Most notably it splits users in active and passive users. Active users can send and receive transactions, while passive users can only receive transactions.

[IMPACT] How do you intend to measure the success of your project?

The immediate success would be interest, with the intention to build on the solution.

While the long term effect would be a new use case for the Blockchain.

Because this is a novel approach success measurement, would primarily be qualitative.

[IMPACT] Please describe your plans to share the outputs and results of your project?

The process and every result, will be documented and made public in the form of a GitHub Repository and a web portal.

If there will be sufficient interest in the produced solution, I would built out a SaaS to offer a hosted version of the IDP.

Also it will become possible to built a custom platform authenticator, this is like a password manager for passkeys. So I am looking at working with or building a new wallet, that uses BIP-32 Ed25519 to use hierarchically derived keys as Passkeys. This would directly connect wallets with current high security authentication systems and would create Read Write Passkey wallets.

[CAPABILITY/ FEASIBILITY] What is your capability to deliver your project with high levels of trust and accountability?

In 2021 I was funded by Catalyst Fund3 and I delivered that Project.

https://cardano.ideascale.com/c/idea/56644

https://github.com/QSchlegel/Decentralized-Accounting

https://youtu.be/_nS0enY1wCw

Also I run a non profit OSS Blockchain Explorer.

https://www.script-explorer.com/

https://youtu.be/Cv7FvPRRES0

Thus I have provable technical depth and a trustable track record.

Furthermore I am studying CS and Economics at Technische Universität Berlin.

So I have coding skills in Haskell, Java, Typescript, Python, C++, C#.

Also I have a comprehensive understanding of web application architecture.

For this Project mostly Java is required, because Keycloak (OSS IDP) is written in Java.

[CAPABILITY/ FEASIBILITY] What are the main goals for the project and how will you validate if your approach is feasible?

The main goal of this project is to create a new perspective for the blockchain.

Thus proving feasibility is the goal.

[CAPABILITY/ FEASIBILITY] Please provide a detailed breakdown of your project’s milestones and each of the main tasks or activities to reach the milestone plus the expected timeline for the delivery.

• White-paper describing the approach and concepts

• Implementation of the Identity Provider extension

1. Authentication SPI
2. User Storage SPI (map Storage API)

• Reference implementation for an application using the approach

1. IDP configuration and basic deployment
2. Front-End, which integrates the IDP
3. Backend-End, which uses OIDC with crypto asset authorization scope
4. Video documentation of the process

• Web portal

1. Showcase the reference implementation
2. On-Board new developers
3. Educational materials

[CAPABILITY/ FEASIBILITY] Please describe the deliverables, outputs and intended outcomes of each milestone.

I will produce:

1. White-paper
2. Keycloak Extension
3. Reference Implementation
4. Web portal to show case results

[RESOURCES & VALUE FOR MONEY] Please provide a detailed budget breakdown of the proposed work and resources.

1. White-paper
2. 1 Month
3. Keycloak Extension
4. 3 Months
5. Reference Implementation
6. 2 Months
7. Web portal to show case results
8. 1 Month

I will mostly need time and a server to offer the web portal.

My salary is 60 € per Hour and I will work 7 hours per week on this project.

Thus after 7 Months my salary will be 11.760 €.

At the current Ada price of 0,25€ this comes out to be 47.040 ₳.

I round that up to 50.000 ₳, because I will have on going cost for maintaining the server.

[RESOURCES & VALUE FOR MONEY] How does the cost of the project represent value for money for the Cardano ecosystem?

I would say the cost for this project is very low because it only covers my labour.

Thus the risk is limited to me as a proposer being honest.

However I have already proven that I deliver on my promises.

[IMPORTANT NOTE] The Applicant agreed to Fund10 rules and also that data in the Submission Form and other data provided by the project team during the course of the project will be publicly available.

I Accept