Nostr Web Client

I am thinking about creating the concept of a “cpub” or child public key of a root npub. The idea is that the cpub can be provably traced back to a npub. I can have as many cpubs as I want, that map back to the same ‘identity’. If a cpub keypair gets compromised, I can publish an event that invalidates that cpub.

As for clients, when they see what is a cpub, they can resolve back to the root npub and present that identity instead.

The driving requirement is to have a protected root npub that corresponds to my identity; it is high-value so I only want to sign with it when absolutely necessary - keeping it on a hardware signer device.

Any comments on this approach?

Sebastix 2mo ago 💬 1

I had a look into https://github.com/Sebastix/mimoty/tree/mimoty.kubo.watch previous week (fork by nostr:npub1gzuushllat7pet0ccv9yuhygvc8ldeyhrgxuwg744dn5khnpk3gs3ea5ds)

Reply to this note

Please Login to reply.

Discussion

Gzuuus 2mo ago 💬 1

Yes, that was the way I came up with it last time I was thinking about key rotation, derivation, subkeys, etc. Instead of making it a standard (which is difficult and hard to agree on), just play by your own rules and create your own signing schemes, derive any amount of keys, etc. No one needs to know anything because, in the end, everything gets signed with your "canonical" keys, so there aren't any new features that client devs needs to take care about. On the other side, the only standard that I think might be valuable for this case of key rotation is social proofs, as other keys attesting/signaling that you rotated. It's the same principle as the wot in PGP, and in Nostr, it could be achieved out of the box. I really want to put together a prototype about this. Maybe I'll have some time soon...

Sebastix 2mo ago

I think we have a perfect use-case in nostr:npub1kdstrkmhv0yx8pdqcf9ed8l26752gqprx68twg7qp5nsd7qtegnsr3nsze where a parent (root key) can create a subkey for his/her child. I've already build the logic + code for managing childs within the app including generating a keypair when you add a child.