Talk a bit about interop and namespacing

[divarvel]

https://twitter.com/schmichael/status/1534259856588255232

[apollo13]

This looks great, thank you! May I ask what "third party blocks" are?

[divarvel]

Third-party blocks are a development of the biscuit spec, not completely specified yet (even though there is a working implementation based on the haskell library): biscuit-auth/biscuit#103

In a nutshell, while regular biscuits are based on the premise that only the authority block can be trusted (because it's signed by a well-known key), third party blocks are extra blocks that are also signed by well-known keys (that can be different from the authority key). Through a datalog syntax extension, it becomes possible to say "consider only facts coming from blocks have valid signatures for this specific public keys". That provides cryptographic segregation between facts.

[divarvel]

I have written down two example use cases for third-party blocks: #47 and #48

If you are familiar with macaroons, third-party blocks are an extension of third-party caveats: they make it possible to have a macaroons that's only valid if a third party validates a specific claim it carries. Third party blocks extend that by not only enabling third party checks, but also letting third parties embed facts as well.

[apollo13]

Thanks, that looks interesting (and a lot to process :)).

…

On Thu, Jun 23, 2022, at 17:02, Clément Delafargue wrote: I have written down two example use cases for third-party blocks: #47 <#47> and #48 <#48> If you are familiar with macaroons, third-party blocks are an extension of third-party caveats: they make it possible to have a macaroons that's only valid if a third party validates a specific claim it carries. Third party blocks extend that by not only enabling third party checks, but also letting third parties embed facts as well. — Reply to this email directly, view it on GitHub <#49 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAT5C4FQNUXNBWBNRVP43LVQR36VANCNFSM5ZTU5FHQ>. You are receiving this because you commented.Message ID: ***@***.***>