<p dir="ltr"><br>
Den 8 mar 2015 02:36 skrev "Pavol Rusnak" <<a href="mailto:stick@gk2.sk">stick@gk2.sk</a>>:<br>
><br>
> On 07/03/15 16:53, Mem Wallet wrote:<br>
[...] <br>
> I am currently in process of implementing a SignIdentity message for<br>
> TREZOR, which will be used for HTTPS/SSH/etc. logins.<br>
><br>
> See PoC here:<br>
> <a href="https://github.com/trezor/trezor-emu/commit/9f612c286cc7b8268ebaec4a36757e1c19548717">https://github.com/trezor/trezor-emu/commit/9f612c286cc7b8268ebaec4a36757e1c19548717</a><br>
><br>
> The idea is to derive the BIP32 path from HTTPS/SSH URI (by hashing it<br>
> and use m/46'/a'/b'/c'/d' where a,b,c,d are first 4*32 bits of the hash)<br>
> and use that to derive the private key. This scheme might work for GPG<br>
> keys (just use gpg://<a href="mailto:user@host.com">user@host.com</a> for the URI) as well.</p>
<p dir="ltr">Reminds me of FIDO's U2F protocol. </p>
<p dir="ltr"><a href="http://fidoalliance.org/specifications">http://fidoalliance.org/specifications</a><br>
<a href="https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/">https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/</a></p>
<p dir="ltr">It ties into the browser SSL session to make sure only the correct server can get the correct response for the challenge-response protocol, so that credentials phishing is blocked and worthless. A unique keypair is generated for each service for privacy, so that you can't easily be identified across services from the usage of the device alone (thus safe for people with multiple pseudonyms). </p>