Ethereum as DID

#didcon #idcon

Presented Distributed ID related ERC/EIPs

Transcript

1. ERC/EIP as DID EthereumとDID
2. Intro • @ken5scal ◦ 本職: セキュリティエンジニア ◦ SP800-63リリース時からDigital Identityに興味を持ち出す • 所属: 金融機関 ◦ FATFと犯罪収益移転防止法がホットな業界 • その流れでBlockchainにおけるeKYCをみてた時期あった • 今回はその過程で読んだERC in DIDの話をします @ken5scal
3. What will NOT be covered • ブロックチェーン • スマートコントラクト • DID • Ethereumの詳細 • 儲かるの？ • ブロックチェーンでなくてもよくない？
4. What will BE COVERED • 次の概要 ◦ ERC: 725 ◦ EIP: 734, 735, 780, 1056, 1812, 1484 https://github.com/OriginProtocol/origin-playground
5. (?) この表記がでたときは、発表者がよくわかってないことを示しています
6. ERC/EIPとは • Ethereum Request for Comments • Ethereum Improvement Proposal
7. DIDに関係しそうなERC • EIP-725: A standard interface for a simple proxy account (identity account) • EIP-734: A contract for key management of a blockchain proxy account • EIP-735: A standard for adding, removing and updating on-chain claims • EIP-780: Ethereum Claims Registry to provide a central point of reference • EIP-1056: A registry for key and attribute management of lightweight blockchain identities • EIP-1812: Reusable Verifiable Claims using EIP 712 Signed Typed Data • EIP-1484: An identity management and aggregation framework on the Ethereum blockchain. https://github.com/w3c-ccg/community/issues/21
8. ERC725
9. ERC725: An Interface for Proxy Account • エンティティ（人・組織・グループ・端末など）のユニークなProxy(?) Accountのイン ターフェースを定義 ◦ Proxy: エンティティとコントラクトオーナーの Proxy…? ◦ どうもスマートコントラクトには Proxyという概念があるらしいが ... • エンティティが任意のコントラクト(?)を呼べるようにするための仕組み • ERC735やERC780等を通してProxy Accountにクレームを付与することが可能 https://github.com/w3c-ccg/community/issues/21
10. ERC725 Interface interface ERC725 { // address public owner; function changeOwner(address _owner) external; function getData(bytes32 _key) external view returns (bytes32 _value); function setData(bytes32 _key, bytes32 _value) external; function execute(uint256 _operationType, address _to, uint256 _value, bytes calldata _data) external; // 上記のメソッドの呼び出しによりトリガーされるイベント event DataChanged(bytes32 indexed key, bytes32 indexed value); event OwnerChanged(address indexed ownerAddress); event ContractCreated(address indexed contractAddress); }
11. EIP734
12. EIP734: Key Manager • ERC725で使われる鍵の管理用Contract(?) • 誰の鍵？ ◦ 外部の鍵（例: Claim Issuer) ◦ Contractのアドレス • 鍵ができること ◦ 各種ドキュメントへの署名とアクション (ログイン・アクセス・承認など） ◦ Proxy Accountとしての処理の実行
13. EIP734 Object contract ERC734 { uint256 constant MANAGEMENT_KEY = 1; uint256 constant EXECUTION_KEY = 2; struct Key { uint256 purpose; //e.g., MANAGEMENT_KEY = 1, EXECUTION_KEY = 2, uint256 keyType; // e.g. 1 = ECDSA, 2 = RSA, etc. bytes32 key; } event KeyAdded(bytes32 indexed key, uint256 indexed purpose, uint256 indexed keyType); event KeyRemoved(bytes32 indexed key, uint256 indexed purpose, uint256 indexed keyType); event ExecutionRequested(uint256 indexed executionId, address indexed to, uint256 indexed value, bytes data); event Executed(uint256 indexed executionId, address indexed to, uint256 indexed value, bytes data); event Approved(uint256 indexed executionId, bool approved); event KeysRequiredChanged(uint256 purpose, uint256 number); }
14. EIP734 Methods contract ERC734 { function getKey(bytes32 _key) public constant returns(uint256[] purposes, uint256 keyType, bytes32 key); function keyHasPurpose(bytes32 _key, uint256 _purpose) public constant returns (bool exists); function getKeysByPurpose(uint256 _purpose) public constant returns (bytes32[] keys); function addKey(bytes32 _key, uint256 _purpose, uint256 _keyType) public returns (bool success); function removeKey(bytes32 _key, uint256 _purpose) public returns (bool success); function changeKeysRequired(uint256 purpose, uint256 number) external; function getKeysRequired(uint256 purpose) external view returns(uint256); function execute(address _to, uint256 _value, bytes _data) public returns (uint256 executionId); function approve(uint256 _id, bool _approve) public returns (bool success); }
15. EIP735
16. EIP735: Claim Holder • Proxy Account(Claim Holder)のClaimを管理するインターフェース • 署名付なので、3rdパーティ(アプリ/スマートコントラクト)がClaimの検証可能 ◦ Claim IssuerによるAttestation ◦ あるいはSelf-Attestすることも可能 • Claim Issuer: Claim発行者。 ◦ 外部アカウントやSmart Contract ◦ Identity Contractそのものであってもいい • FIDO2のAuthenticatorをつかったﾅﾆｶができそう...? ◦ とはいえ、EthereumでいうAttestが何を指すかは不明
17. EIP735 Object contract ERC735 { struct Claim { uint256 topic; uint256 scheme; address issuer; // msg.sender bytes signature; // this.address + topic + data bytes data; string uri; } event ClaimRequested(uint256 indexed claimRequestId, uint256 indexed topic, uint256 scheme, address indexed issuer, bytes signature, bytes data, string uri); event ClaimAdded(bytes32 indexed claimId, uint256 indexed topic, uint256 scheme, address indexed issuer, bytes signature, bytes data, string uri); event ClaimRemoved(bytes32 indexed claimId, uint256 indexed topic, uint256 scheme, address indexed issuer, bytes signature, bytes data, string uri); event ClaimChanged(bytes32 indexed claimId, uint256 indexed topic, uint256 scheme, address indexed issuer, bytes signature, bytes data, string uri); }
18. EIP735 Methods contract ERC735 { function getClaim(bytes32 _claimId) public constant returns(uint256 topic, uint256 scheme, address issuer, bytes signature, bytes data, string uri); function getClaimIdsByTopic(uint256 _ topic) public constant returns(bytes32[] claimIds); function addClaim(uint256 _topic, uint256 _scheme, address _issuer, bytes _signature, bytes _data, string _uri) public returns (uint256 claimRequestId); Function changeClaim(bytes32 _claimId, uint256 _topic, uint256 _scheme, address _issuer, bytes _signature, bytes _data, string _uri) returns (bool success); function removeClaim(bytes32 _claimId) public returns (bool success); }
19. EIP780
20. EIP780: Claim Registry • On-Chain Claimsの中央リポジトリ • ここにあるClaimを見ることで、シグネチャチェックの実装や署名用鍵の実装を開発 者がしなくてよくなる • Docker images in Docker Registryみたいなもん（だと思う） • といいつつ、UportからはRemoveされたかわいそうな子
21. EIP780 Object contract EthereumClaimsRegistry { mapping(address => mapping(address => mapping(bytes32 => bytes32))) public registry; event ClaimSet( address indexed issuer, address indexed subject, bytes32 indexed key, bytes32 value, uint updatedAt); event ClaimRemoved( address indexed issuer, address indexed subject, <- Claim Hodlerのこと bytes32 indexed key, uint removedAt); }
22. EIP780 Methods contract EthereumClaimsRegistry { // create or update clams function setClaim(address subject, bytes32 key, bytes32 value) public { registry[msg.sender][subject][key] = value; emit ClaimSet(msg.sender, subject, key, value, now); } function setSelfClaim(bytes32 key, bytes32 value) public { setClaim(msg.sender, key, value); } function getClaim(address issuer, address subject, bytes32 key) public view returns(bytes32) { return registry[issuer][subject][key]; } function removeClaim(address issuer, address subject, bytes32 key) public { require(msg.sender == issuer); delete registry[issuer][subject][key]; emit ClaimRemoved(msg.sender, subject, key, now); } }
23. EIP1056
24. EIP1056: Lightweight Identity • リソースが限定された環境下におけるIdentity Contractの作成・更新をする ◦ 環境例：難民の環境など ◦ Self Sovereign系 • 背景 ◦ Identity Creationのコスト削減が目的（ No GAS) ◦ Ethereumチェーン外部の鍵による署名がされた Transactionが増えてきた ◦ EthereumのSmart Contractで使えない • 鍵ペアがもつ機能を、別の鍵ペアにDelegateして、オフラインやOff-Chainであっても Id作成をできるようにする機能
25. EIP1056 Object contract LightweightIdentity { event DIDOwnerChanged( address indexed identity, address owner, uint previousChange); event DIDDelegateChanged( address indexed identity, bytes32 delegateType, address delegate, uint validTo, uint previousChange); event DIDAttributeChanged( address indexed identity, bytes32 name, bytes value, uint validTo, uint previousChange); }
26. EIP1056 Methods contract LightweightIdentity { # Manage Identity Ownership function identityOwner(address identity) public view returns(address); function changeOwner(address identity, address newOwner) public; function changeOwnerSigned(address identity, uint8 sigV, bytes32 sigR, bytes32 sigS, address newOwner) public; # Manage Delegation function validDelegate(address identity, bytes32 delegateType, address delegate) public view returns(bool); function addDelegate(address identity, bytes32 delegateType, address delegate, uint validity) public function addDelegateSigned(address identity, uint8 sigV, bytes32 sigR, bytes32 sigS, bytes32 delegateType, address delegate, uint validity) public; function revokeDelegate(address identity, bytes32 delegateType, address delegate) public; function revokeDelegateSigned(address identity, uint8 sigV, bytes32 sigR, bytes32 sigS, bytes32 delegateType, address delegate) public; # Manage Attribute (略
27. EIP1812
28. EIP1812: Verifiable Claim • ブラウザとかで作れるOff-ChainなClaim ◦ w3cと協力してるっぽい • ERC735, 780はOn-Chain Claimだけど、Identity ClaimsはPIIだからパブリックブロッ クチェーンであるEtherumに乗っかるのはまずいケースもある • 構造体は「EIP712: Ethereum typed structured data hashing and signing」
29. EIP1484
30. EIP1484: Digital Identity Aggregator • DIDをするにあたって、他の分散台帳と後方互換性をもたそうという動き ◦ EthereumのIdentityにはEINというグローバルにユニークな数字がつく • 全ブロックチェーンIdentityと、そのハブになるIdentity Registryがコア ◦ EIP780はこいつに乗っ取られた？ Identity Registry (Hub)
31. EIP1484 Object 割愛
32. EIP1484 Methods 割愛
33. Putting Them Together Identity Registry (Hub)
34. Putting Them Together (Ethereum On-Chain) Identity Registry (Hub) EIP 734 Key Management EIP 735 Claim Holder EIP 780 Claim Registry EIP 1056 Lightweight Identity EIP 725 Key Management
35. Putting Them Together (Ethereum Off-Chain) Identity Registry (Hub) EIP 1484 Identity Aggregator EIP 1812 Verifiable Claim
36. Thanks! Twitter: @ken5scal