Bitcoin's Decentralized PKI (Public Key Infrastructure)

[allten]

Update: 8/09/2012

Looking into the more technical aspect of how to store data on the block chain; so far, I've found these two methods:

1) Uses multiple outputs to send a message (store data). Each output address is data; therefore, the coins are destroyed.
https://en.bitcoin.it/wiki/Block_chain_message_service

2) Transaction with a message inside the script
https://en.bitcoin.it/wiki/Script#Transaction_with_a_message

Mike Hearn makes some good points about the first method that I believe also applies to second.
https://bitcointalk.org/index.php?topic=47283.msg607667#msg607667

Also, if I understand correctly, there are other ways to embed messages(data) into the transaction that are less likely to be (pruned) and deleted, but I'm still leaning towards #1.
Here's my reasoning:

* It requires more bitcoin to add data into the block chain when using the addresses in the outputs. Because of all the costs, it should satisfy any naysayer because the creator of the transaction "paid for it". Even if someone doesn't agree with the blockchain being utilized this way; well, who cares, those users burning their coins are making the rest of us more wealthy.

*When the question is asked "What uses does bitcoin have beyond just financial transactions?", you will now have an additional reason to give: pay miners to add data in the most distributed, secure, and accessible database in the world.

*Also, it would still be friendly to those that only want to manage a pruned/trimmed blockchain. As Michael Hearn pointed out, transaction outputs that will clearly never be spent can be deleted with no worry of anyone spending them.

I've also been thinking about adding in the technical document that all the coins used on undependable outputs for "Bitcoin's Distributed PKI" will be available for miner rewards once all the block rewards are finished. A new type of generation transaction could be created that would allow miners to collect those coins based on certain rules. This would give incentive to maintain all the unspendable outputs used in the PKI in the block chain database.

Update: 7/24/2012
 
Still Playing around with the title. Now, the name is just right IMO in describing where I hope this thread and project will go. I had debated about using the word "decentralized" since the name Bitcoin already implies this; however, the implementation of this PKI compared to the majority out there is decentralized in so many ways that I decided it had to be there.

Here's some good material of the technology already out there.
http://highsecu.free.fr/db/outils_de_securite/cryptographie/pki/publickey.pdf
http://en.wikipedia.org/wiki/Public_key_infrastructure
http://en.wikipedia.org/wiki/Digital_signature

Update: 7/19/2012

Updated the Title
Old Title: Decentralized Identity Management using the Block Chain

Thanks to all for the responses and resources. When I originally had this idea, I had no experience or knowledge of what already existed on the net.
Wasn't even sure what to call it. The Web of Trust was by far the closest to what I had envisioned.
(see http://privwiki.dreamhosters.com/wiki/Distributed_Web_of_Trust_Proposal_2)

My idea isn't new at all and there's are many similar applications and projects online.

I came across an article today that was a gold mine of information and the first part lay's the foundation to web of trust, decentralized ID system, and others.

Beyond “web of trust”: Enabling P2P E-commerce
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=5&ved=0CFwQFjAE&url=http%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fdownload%3Fdoi%3D10.1.1.15.82%26rep%3Drep1%26type%3Dpdf&ei=lU4IUMPQGsXI2wWqyL3SBA&usg=AFQjCNEPBsAnoUQrgcd1Uj76DUbbVLLriw

I'm considering starting a github repository where the technical aspects of this PKI using the blockchain can start to be formed.

If this is conflicting with anyone's efforts, please let me know. Also, PM me if you would like to be part of the project.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I know the idea has been tossed around alot, but has anyone taken it seriously.
Is there any project out there.
I'm been toying with the idea to start something along this line, but do not want to re-invent the wheel if there's already progress.

Just like money, Identification is too important to leave to a central entity.
What are the possibilities with Decentralized ID?
       Digital notary.
       Open ID login pulled from the block chain
       The ground works for a new voting system.

What are your thoughts? Anyone working on a protocol write-up?

Update:
   Here's a link with some great information. it describes the problem and the limitations of the solution currently at hand.
Could bitcoin overcome these limitations?
http://dig.csail.mit.edu/2007/06/ieee-ic-decentralized-identity-weitzner.html

Update 2:
   Very relevant link provided by Stephen Gornick below:
http://privwiki.dreamhosters.com/wiki/Distributed_Web_of_Trust_Proposal_2

Update 3:
Another great find:
http://www.fastcompany.com/blog/kaliya-hamlin/identity-matters/why-identity-matters-0
So, the goal, as I see it, is to create a competing ID system that serves more than the agenda of government and large corporations.
Also, it would limit the mischief that could be done having power and monopoly over ID systems.

Update 4:
     Mt.Gox Trusted Vendor Program
https://bitcointalk.org/index.php?topic=92334.0
Now, if they used the block chain and allowed others to be a trusted vendor or person.

Update 5:
      A big thanks to bitcoin.me for referencing me to http://bitcoin-otc.com/
It's a great working example of what could be done. The main difference between what they started and this proposal is they manage the information instead of it being decentralized and located on the block chain. Check out the full graph: http://corrupt.jails.se/~magnetron/
And you can also look at the graph between two users: http://serajewelks.bitcoin-otc.com/trustgraph.php
Here's an example: http://serajewelks.bitcoin-otc.com/trustgraph.php?source=Cusipzzz&dest=noitev

[1715135833]

1715135833

[Xenland]

Im actually working with another member on getting a blokchain openid system going that also is a 4chan board for every adress and you have to claim your adress by bitcoin message signing to mamage your board.

[allten]

Im actually working with another member on getting a blokchain openid system going that also is a 4chan board for every adress and you have to claim your adress by bitcoin message signing to mamage your board.

that's great news! How's the progress going? Any links?
I would like to be a part of it if that's ok.

[Xenland]

Im actually working with another member on getting a blokchain openid system going that also is a 4chan board for every adress and you have to claim your adress by bitcoin message signing to mamage your board.

that's great news! How's the progress going? Any links?
I would like to be a part of it if that's ok.

Sure ill pm you shortly, out of respect i need to ask the members' permission that came up with the original idea first.

[Stephen Gornick]

If you aren't aware of this, it may be related to some degree:

 - http://privwiki.dreamhosters.com/wiki/Distributed_Web_of_Trust_Proposal_2

[allten]

If you aren't aware of this, it may be related to some degree:

 - http://privwiki.dreamhosters.com/wiki/Distributed_Web_of_Trust_Proposal_2

That's very relevant. Thanks!

The Introduction sums up the foundation of the decentralized ID technology very nicely.

"Introduction

The core components of any trust system are (a) data storage for nodes and links between them and (b) interpretation of the data into useful trust metrics. Once a publicly accessible distributed storage framework is developed and populated, there can be any number of competing trust metrics building upon it. Thus, the development of an open framework for distributed store of trust links will serve to create an ecosystem of trust services around it.

Ideally, the node identifiers used in the trust network would be easily exportable and usable in any arbitrary alternative location, so that a person can prove he owns a particular identity in many different contexts. Further, the trust links should be cryptographically signed, so that the validity thereof can be independently verified by any third party.

The present proposal suggests a robust, flexible, and distributed framework for a web of trust, using PGP keys as node identifiers and for cryptographic signatures. "

Ideas like this can finally be realized with Bitcoin block chain technology!!!!

[Bitcoin Oz]

All the tools to do this already exist in bitcoin its just that no one thought of putting the pieces together in this way.

[hazek]

Actually I don't understand why you'd want a decentralized ID system, what's the point? Why allow just anyone to have an ID? Why not limit it to only those who are going to follow certain rules, on a voluntary basis of course.. this way the ID doesn't only identify a person but it also portrays a degree of trustworthiness of that person. And if the business offering this service ever misbehaves customers can simply take their business elsewhere.

[austonst]

Couldn't this be done with Namecoin? Namecoin is decentralized, cryptographically secure, and can be easily extended to have an ID or voting system.

[allten]

Actually I don't understand why you'd want a decentralized ID system, what's the point? Why allow just anyone to have an ID? Why not limit it to only those who are going to follow certain rules, on a voluntary basis of course.. this way the ID doesn't only identify a person but it also portrays a degree of trustworthiness of that person. And if the business offering this service ever misbehaves customers can simply take their business elsewhere.

ID is very useful. "Why allow just anyone to have an ID? Why not limit it to only those who are going to follow certain rules" - This would contradict the whole idea of a decentralized ID system. Anyone can create an ID, the question is what does it take for your ID to matter? The whole idea it to put the power of an ID in the hands of its creator.

What can be done to give an ID value?
      A trustworthy source(i.e. another ID of a person or business) vouching for your ID.
      Using your ID to link to others you know have accurate IDs and them to you.
      Use your ID to rate the "trustworthiness" of other IDs you know and them to you.
      put your reputation in the hands of another ID before doing business and start adding value to your ID with each success.
      I'm sure there's more.

It boils down to using non-standard transactions to create nodes and vectors in a graph.
Here's a visual of the idea. (Pulled from http://blog.cloudlychen.net/the-social-network-of-economists/)


Here's the problems I feel need solved before Bitcoin is ready for this technology to develop on top of it:
  1) Some developers have mixed feelings about non-standard transactions because it puts "garbage' in the block chain.
  2) The TX fee methodology is based on donations and any tweaking of this is still somewhat centralized.

[hazek]

Anyone can create an ID, the question is what does it take for your ID to matter? The whole idea is to put the power of an ID in the hands of its creator.

No, I disagree. The who idea is to put the power in the hands of those who want to know who they're dealing with. Right now anyone can have an unlimited amount of digital IDs and there are zero repercussions for bad behavior, you burn one ID and you create a new one. The idea is to stop that, meaning that once you burn your unique ID, that's it you're done, not able to scam anyone ever again.

[allten]

Anyone can create an ID, the question is what does it take for your ID to matter? The whole idea is to put the power of an ID in the hands of its creator.

No, I disagree. The who idea is to put the power in the hands of those who want to know who they're dealing with. Right now anyone can have an unlimited amount of digital IDs and there are zero repercussions for bad behavior, you burn one ID and you create a new one. The idea is to stop that, meaning that once you burn your unique ID, that's it you're done, not able to scam anyone ever again.

edit: complete re-write of my post

I feel like my post just got "cherry picked" - oh well. Too many posts here are contentions; so, let's find some common ground.
First, the basis of the proposal is that the amount of work that is required to establish one's ID is worth far more than what would be achieved in a scam.
However, let's say that still doesn't give you the comfort you want? That's where 3rd party ID businesses could come into play. It could vouch for people's IDs. As long as the 3rd party your trust and has validated an ID to be legitimate to a known person and that person is trustworthy then you could decide if you have the comfort/confidence to do business or whatever. Again, this would all be done using non-standard bitcoin transactions to create nodes and vectors in a graph that could be analyzed with software.

[Bitcoin Oz]

Actually I don't understand why you'd want a decentralized ID system, what's the point? Why allow just anyone to have an ID? Why not limit it to only those who are going to follow certain rules, on a voluntary basis of course.. this way the ID doesn't only identify a person but it also portrays a degree of trustworthiness of that person. And if the business offering this service ever misbehaves customers can simply take their business elsewhere.

Bitcoin-otc is pretty effective so we can get lots of sites like that who interconnect and share trust metrics. Like how you can upload your gpg key to many different keyservers.

[allten]

Actually I don't understand why you'd want a decentralized ID system, what's the point? Why allow just anyone to have an ID? Why not limit it to only those who are going to follow certain rules, on a voluntary basis of course.. this way the ID doesn't only identify a person but it also portrays a degree of trustworthiness of that person. And if the business offering this service ever misbehaves customers can simply take their business elsewhere.

Bitcoin-otc is pretty effective so we can get lots of sites like that who interconnect and share trust metrics. Like how you can upload your gpg key to many different keyservers.

Man! I feel like I'm late to the game in everything. Thanks for the reference. I will add it in the OP.

[Stephen Gornick]

Also, identity management is part of PeerPoint:

PeerPoint
An Open P2P Requirements Definition and Design Specification Proposal
 - https://docs.google.com/a/digicoast.com/document/pub?id=1TkAUpUxdfKGr_5Qio2SlZcnBu_sgnZWdoVTZuD_Regs

Identity Management and Complementary Currency (specifically referencing Bitcoin) are both "first tier" services and applications of PeerPoint.

On Google Groups:
 - https://groups.google.com/forum/#!topic/building-a-distributed-decentralized-internet/CQBhaEcqGUc/

[EhVedadoOAnonimato]

  1) Some developers have mixed feelings about non-standard transactions because it puts "garbage' in the block chain.

Oh but you should definitely not add this to the bitcoin chain. You should create an alternative chain, with merged mining if you will.


The idea of a decentralized ID system is interesting. OpenID itself is interesting. But I have a question.

The main technological advance Satoshi provided, IMHO, is the means to order events in time in a decentralized database, without having to trust anyone to say "this is the correct order".
Why is such a feature important for a decentralized ID system? I mean, why do you need to order events in time? Isn't just a decentralized database enough?

[EhVedadoOAnonimato]

No, I disagree. The who idea is to put the power in the hands of those who want to know who they're dealing with. Right now anyone can have an unlimited amount of digital IDs and there are zero repercussions for bad behavior, you burn one ID and you create a new one. The idea is to stop that, meaning that once you burn your unique ID, that's it you're done, not able to scam anyone ever again.

The system may allow the addition of arbitrary data to an ID. Ideally, this data would be encrypted and only the owner would have the ability to provide unencrypted copies of it to somebody requesting them.
You could add, for example, your fingerprint or a picture of you, data that could be checked against your meatspace self.
Parties scammed by you could (with proper contracts foreseeing it) share such personal data with others, in anti-scam effort.
To create a new ID you'd have to do it like Tom Cruise in Minority Report and change pieces of your body.... not so simple!


Now, I wonder what would motivate big players to ever use such system, since they can already use government provided IDs when they need, for free. For instance, in Brazil companies use your CPF (national taxvictim number) to "taint" you in case of debt default. There are big shared databases. Once your CPF gets in there, it becomes nearly impossible to contract more debt. The system works fairly well right now. Why would they ever want to switch to a new system?
Perhaps the international reach of such system would be a strong incentive. You have to be a Brazilian resident to have a CPF, what wouldn't be the case of the proposed system of course.

[EhVedadoOAnonimato]

The idea of a decentralized ID system is interesting. OpenID itself is interesting. But I have a question.

The main technological advance Satoshi provided, IMHO, is the means to order events in time in a decentralized database, without having to trust anyone to say "this is the correct order".
Why is such a feature important for a decentralized ID system? I mean, why do you need to order events in time? Isn't just a decentralized database enough?

Actually, expanding a little bit on this question: what are the advantages of a fully decentralized ID database over a federated model like OpenID?
I guess one could answer "not having to trust an ID provider to store my data, nor having to rely on its uptime etc". But then, couldn't such problems be avoided by (1) having an OpenID provider which only stores encrypted data about yourself and (2) having the possibility of mirroring it for free?
EDIT: Derp, rereading OP I realize that the wish here is precisely to implement a decentralized OpenID provider. I guess the main motivation is not trusting your data to a centralized ID provider.
The question of "why a blockchain?" remains open though.

[allten]

  1) Some developers have mixed feelings about non-standard transactions because it puts "garbage' in the block chain.

Oh but you should definitely not add this to the bitcoin chain. You should create an alternative chain, with merged mining if you will.


The idea of a decentralized ID system is interesting. OpenID itself is interesting. But I have a question.

The main technological advance Satoshi provided, IMHO, is the means to order events in time in a decentralized database, without having to trust anyone to say "this is the correct order".
Why is such a feature important for a decentralized ID system? I mean, why do you need to order events in time? Isn't just a decentralized database enough?

I understand your sentiment about bloating the bitcoin chain with non-financial data, but if the person creating the transaction was willing to pay for it (via tx fee) then why not?
Bitcoin is the first ever decentralized secure database that has potentially huge applications beyond just financial transaction (Decentralized ID being one of them).
If the core developers and community can expand the bitcoin technology to determine fair TX fee for non-standard transaction and size then it would benefit everyone.
If the proper fee can be managed in a decentralized way then we've really improved bitcoin; however, without this advancement essentially free non-standard transactions that are relatively big will not be favored at all. I have hopes that something will work out.
Remember: every additional use bitcoin has besides financials will ultimately add value to the entire system.

The time stamp would be useful for an ID system as it could describe how someones ID evolved over time; however, the real appeal for using the blockchain is that it is a database that cannot be altered or controlled by anyone.

 

[allten]

Also, identity management is part of PeerPoint:

PeerPoint
An Open P2P Requirements Definition and Design Specification Proposal
 - https://docs.google.com/a/digicoast.com/document/pub?id=1TkAUpUxdfKGr_5Qio2SlZcnBu_sgnZWdoVTZuD_Regs

Identity Management and Complementary Currency (specifically referencing Bitcoin) are both "first tier" services and applications of PeerPoint.

On Google Groups:
 - https://groups.google.com/forum/#!topic/building-a-distributed-decentralized-internet/CQBhaEcqGUc/

Wow! Again, very great resource. I'm reading it right now. Thanks