INVESTIGATION: crypto-request with x-callback to onion address (optionally did:onion)

[ChristopherA]

I'd like to investigate the ability of a UR crypto-request to offer an x-callback-like option to return a response via the internet in a non-correlatable and private form. (For what an x-callback UR is see: BlockchainCommons/GordianSeedTool-iOS#132 )

Use case:

• I want to initiate the use of a service offered by a third-party that I have established some level of trust, out-of-band, even if minimal (maybe only F2F).
• I may not be in a private place, possibly at a cafe or other public site.
• I either get UR QR from that party in person, or via an NFC, or I receive a UR text through a private channel.
• This UR is a crypto-request that requests either a public key from me to secure our connections in the future or initiates some yet-to-be written crypt-request flow.
• The service may be a proxy agent for the party located at a remote hosting facility.
• As you can't connect to the onion site unless the onion site has possession of the private key for that onion address, the initial UR crypto request doesn't need to be signed.
• As the service is using Tor, no one at the cafe or ISP can know I'm requesting the service.
• The third-parties proxy server doesn't know who I am, but now has a public key for me so that it can at least have TOFU for future discovery, and can initiate additional crypto-requests to increase trust until allowed to use the service.
• As I have the third-party services public key (it is in the onion address), I can also use it for TOFU on my end to also initiate further discovery.
• Some services offered by third-parties proxy may only require a "knock" and they give you access to the service immediately.
• If we use did:onion, the third-party can also present a signed list of other public keys. For instance, Tor uses 25519, but we maybe want to use secp256k1 or ristretto.

We have interns that prototyped the the issues of converting keys from the onion serve for use for signingr:

• https://github.com/BlockchainCommons/torgap-sig
• https://github.com/BlockchainCommons/torgap-sig-cli-rust
• https://github.com/BlockchainCommons/torgap-demo

We have a draft did:onion spec:

• https://github.com/BlockchainCommons/did-method-onion

We have an example of a timestamping service that could be a good example of "knock" service.

• https://github.com/BlockchainCommons/torgap-opentimestamps

And of course, our current private spotbit and esplora services over tor could be adapted for use if they become too busy and we have to limit useage.

Our summer internship program starts in May — anyone want to be a mentor for this experimentation?

Any other thoughts?

-- Christopher Allen