This is a demo of the Delegation-oriented FedCM Devtrials.

Step 0) Download and open chrome canaries

Step 1) Enable necessary development flags. Type chrome://flags in the url bar and enable the following flags

• #fedcm-without-well-known-enforcement
• #fedcm-delegation (in devtrials)

Step 2) Use my own test issuer or enter yours:

Step 3) Click on this button Sign-in

Step 4) See the resulted token in this textarea:

Step 5) Split the token between the SDJWT and the KB by "~" and base64 decode:

Step 6) Parse the disclosures:

Step 7) Parse the KB:

Step 8) Check for signatures and hashes and so on (left as an exercise).

This is a demo page for https://github.com/fedidcg/login-element

Click on the following element:

This is an interactive explanation of the protocol described here.

Alice wants to prove that it knows x = such that g ^ x mod p = y without revealing to Bob the value of x, having agreed ahead of time on a large prime number p = , a primitive root g = and an integer y = .

The way they accomplish that is by:

1. Alice generates a random number r = and commits to it by computing C = g ^ r mod p = ^ mod = = C and sending it to Bob.
2. Bob asks for w = (x + r) mod (p - 1) with the same r that was committed to C
3. Alice computes w = (x + r) mod (p - 1) = ( + ) mod ( - 1)= = w and sends it to Bob.
4. Bob knows that:
   1. a ^ x * a ^ y = a ^ (x + y) (arithmetic),
   2. a ^ x mod p = a ^ (x mod (p - 1)) mod p (fermat's little theorem)
   3. y = g ^ x mod p (definition)
5. So y * C mod p = g ^ x * g ^ r mod p = g ^ (x + r) mod p = g ^ ((x + r) mod (p - 1)) = g ^ w mod p.
6. Bob computes
   1. y * C mod p = * mod = and
   2. g ^ w mod p = ^ mod =
   3. And if these numbers match, Bob knows that Alice knows x unless Alice wasn't cheating.
7. Bob is suspicious that if Alice picks a specific r = z = and responded with
   1. C = g ^ (z / y) mod p = ^ ( / ) mod = = C and
   2. w = z = = w, then
   3. Then Bob would compute = y * C mod p = y * g ^ (z / y) mod p = g ^ z mod p = without Alice knowing what x is.
8. Bob also knows that:
   1. To prove that Alice chose a random r, Bob would have to ask for it, so that it can check if g ^ r mod p = C matches what he got.
   2. But, if Bob asks for both (x + r) mod (p - 1) and r, then that reveals to Bob what x is.
9. So, Bob asks Alice repeatedly until it is confident that Alice isn't cheating
   1. Commit and send me a C and
   2. I'll ask you one of the following requests after you commit to a C:
      1. Send me r (without revealing me x) so that I can check if you didn't cheat at constructing C = g ^ (z / y) mod p but rather used g ^ r mod p = C that I got.
      2. Send me w (without revealing me r), so that I can check if y * C mod p = g ^ w mod p with the C that I got.
10. Every time Bob repeats this process, he gets exponentially confident that Alice (a) isn't cheating and (b) knows the value of x.

This is a compilation of a series of discussions I had with Dirk Balfanz. It is also based on things I learned from Dick Hardt.

TL;DR; Identity Verification is not Authentication. Passkeys are great. Use the former for Sign-Up and the later for Sign-In.

For the last couple of years, I get asked a variation of "Sam, what's your opinion on passkeys?" in relationship to OpenID/SAML and FedCM.

My answer has been consistently "I think it is a wonderful authentication mechanism, but it is not an identity mechanism".

You see, I subscribe to Dick Hardt's definition of identity: identity is who you are.

Who am I?

I am ____:

• Sam
• A husband, a parent and an engineer -- in that order
• A 40yo
• A Brazilian
• An engineer at Google
• etc

Part of who I am is self-asserted (things I say about myself), part of who I am is issued (things that others say about me).

For example, Brazil asserts that I'm brazilian, Google asserts that I'm their employee and my City of birth that I'm 40yo.

The part that of who I am that is issued is also verifiable.

The great thing about who I am is that it is fairly durable: it doesn't change very often.

Because my issued identity is both durable and verifiable, it means that it works really well for me to create (and recover) accounts online, to sign-up.

My issued identity, however, is not very easy to carry around and present.

So, it is often useful to exchange my identity into something that is more portable, so that I don't have to carry my issued identity all of the time with me.

Cookies are the quintessential example of something that is very portable and ephemeral: they get carried on every HTTP request without any extra user gesture, and they expire at some point. Much easier than presenting my issued credentials everytime.

I think there is a similar relationship with passkeys: they are great (dare I say, better) for signing-in, but there is no amount of passkeys that you can throw at the problem of verifying who you are, your identity.

For example:

• Because I am a stanford student I can access a paper on nature.com
• Because I am a google employee I can access corporate directories on figma.com
• Because I am a twitter blue subscriber I can read the nytimes.com

Obviously, your identity is not always necessary to use websites, so there are many occasions where you can and want to sign-up with passkeys alone and operate anonymously on the web.

So, to sum up, I believe that WebAuthn and FedCM (and Cookies, obviously) complement themselves very nicely:

• Use federation for signin-up (and account recovery) rarely and
• Use passkeys for signing-in (and Cookies even more frequently) frequently.

It is the tension between durability with portability and the exchange between affordances at different ends of the spectrum.

Context

Moses Schönfinkel's inspiration came from the recently discovered result that all of the known operators in propositional logic (~a, a && b, a || b, a => b and a <=> b) could be reduced to / derived from a single operator: nand.

Notation

Notation: a tree (xy) can be thought as a function x applied to an argument y. When evaluated, the tree returns a value. The function, argument or values are either combinators or binary trees.

S and K

K

The k combinator is: k[x][y] = x

S

The s and k combinators: s[x][y][z] = x[z][y[z]] and

Example

For example, let's say we start from s[k][s][k]. This evaluates to k[k][s[k]] by applying the s rule with x = k, y = s and z = k. This then evalutes to k as we apply the k rule with x = k and y = s[k]. Since there is no more rule to apply, it halts.

Boolean logic

We pick very specific definitions of true and false, such that we can construct an if-then-else structure: when true follow the then, when false follow the else.

And from that, we define other boolean combinators to perform the task that we want them to perform.

True

We define T[x][y] = T = K, which because K[x][y] = x, and,

False

We define F[x][y] = F[x][y] = S[K][x][y], which is K[y][x[y]] = y. With that, then,

NOT

We define NOT[x] as S[S[I][K[F]]][K[T]][x], which leads to S[I][K[F]][x][K[T][x]] = I[x][K[F][x]][T] = x[F][T].

For example, NOT[T] = T[F][T] = F, NOT[F] = F[F][T] = T:

OR

OR[x][y] = S[I][K[T]][x][y] = I[x][K[T][x]][y] = x[T][y]

For example: OR[T][T] = T[T][T] = T, OR[T][F] = T[T][F] = T, OR[F][T] = F[T][T] = T and OR[F][F] = F[F][F] = F.

AND

AND[x][y] = S[S][K[K[F]]][x][y] = S[x][K[K[F]][x]][y] = x[y][K[K[F]][x][y]] = x[y][K[F][y]] = x[y][F], e.g. AND[T][T] = T[T][F] = T, AND[T][F] = T[F][F] = F, AND[F][T] = F[T][F] = F and AND[F][F] = F[F][F] = F.

NAND

You can combine combinators (duh) to form composite constructions, for example a NAND[x][y] = NOT[AND[x][y]] = AND[x][y][F][T] = x[y][F][F][T].

For example, NAND[T][T] = T[T][F][F][T] = T[F][T] = F, NAND[F][T] = F[T][F][F][T] = F[F][T] = T, NAND[T][F] = T[F][F][F][T] = F[F][T] = T and NAND[F][F] = F[F][F][F][T] = F[F][T] = T.

Control

Identity

I[x]: S[K][x][y] always evaluates to y in two steps (S[K][x][y] = K[y][x[z]] = y). S[K][x][y] and I[y] are functionally equivalent because they always yield the same result when applied to any y.

Second

N[x][y] is defined as N = K[I] and results in y, since N[x][y] = K[i][x][y] = I[y] = y, which complements K (which selects the first parameter, rather than the second).

Functions

Composition

• B[f][g][x] = f[g[x]] performs a composition of functions (i.e. f * g (x) = f(g(x))), and is defined as B[f][g][x] = S[K[S]][K][f][g][x] = K[S][f][K[f]][g][x] = S[K[f]][g][x] = K[f][x][g[x]] = f[g[x]].

Currying

• C[f][g][x] = f[x][g], defined as C[f][g][x] = S[B[B][S]][K[K]][f][g][x] = B[B][S][f][K[K][f]][g][x] = B[S[f]][K[K][f]][g][x] = S[f][K[K][f][g]][x] = f[x][K[K][f][g][x]] = f[x][K[g][x]] = f[x][g]

W

• W[x][f] = f[x] takes the second parameter and applies it to the first, which is constructed as W[x][f] = C[I][x][f] = I[f][x] = f[x].

V

V[x][y][z] = z[x][y] takes the third argument, applies it to the first argument and then to the second. It is is defined as B[C][W][x][y][z] = C[W[x]][y][z] = W[x][z][y] = z[x][y].

Data Structures

Pair

Suppose we want to describe ordered pairs, say (x, y), we can define a combinator Pair[x][y] such that First[Pair[x][y]] = x and Second[Pair[x][y]] = y. If we define Pair[x][y][z] = V[x][y][z] = z[x][y] and First = W[T] and Second = W[F].

For example, First[Pair[x][y]] = W[T][Pair[x][y]] = Pair[x][y][T] = T[x][y] = x and Second[Pair[x][y]] = W[F][Pair[x][y]] = Pair[x][y][F] = F[x][y] = y.

Natural Numbers

Zero

We want to make the function Zero[x] return T when x = 0 and F otherwise, so we define Zero[x] = First[x]. Since we want Zero[0] = First[0] = W[T][0] = 0[T]. If we define 0 = I, then Zero[0] = 0[T] = I[T] = T. So, we define 0 = I.

1, 2, 3, ...

With the representation of 0 in place, we can define 1 as the pair Pair[F][0], 2 = Pair[F][1], 3 = Pair[F][2], and so on.

We can then define Next[n] = Pair[false][n], which can give us our natural numbers 0, Next[0], Next[Next[0]], Next[Next[Next[0]]], etc.

The Previous[n] = Second[n], for example Previous[2] = Second[2] = Second[Pair[F][1]] = 1.

Recursion

Arithmetic

Apply

We'd like to derive a combinator that can compute the application of a function n times, e.g. Apply[0][f][x] = x, Apply[1][f][x] = f(x), Apply[2][f][x] = f[f[x]], and so on.

Add

For example, adding two numbers, m and n is the same as applying the function Next m times to n. That is, Add[m][n] = Apply[m][Next][n] = Next[Next[Next[...[Next[n]]]]] (embeds m times).

We define Apply[n][f][x] as Zero[n][x][f[Apply[Previous[n]][f][x]]], which in practice can read as:

Apply(n, f, x) {
  if (Zero(n) == T) {
    return x;
  } else {
    return f(Apply(Previous(n), f, x));
  }
}

Sub

Much like Add, we can define Sub as Sub[m][n] = Apply[m][Previous][n].

Fib

Fibonacci: 1, 1, 2, 3, 5, 8, 13, 21, 34, 55, ...

NextPair[p] = Pair[Second[p]][Add[First[p]][Second[p]]]. For example, NextPair[Pair[0][1]] = Pair[Second[Pair[0][1]]][Add[First[Pair[0][1]]][Second[Pair[0][1]]]] = Pair[1][Add[0][1]] = Pair[1][1].

Iota

• i[x] = x[S][K]

• I[x] = i[i][x] = i[S][K][x] = S[S][K][K][x] = S[K][K[K]][x] = K[x][K[K][x]] = x.

• K[x][y] = i[i[I]][x][y] = i[i[i[i]]][x][y] = i[i[i[S][K]]][x][y] = i[i[S][S][K][K]]][x][y] = i[S[S][K][S][K][K]][x][y] = S[S][K][S][K][K][S][K][x][y] = S[S][K[S]][K][K][S][K][x][y] = S[K][K[S][K]][S][K][x][y] = S[K][S][S][K][x][y] = K[S][S[S]][K][x][y] = S[K][S[S][K]][x][y] = K[x][S[S][K][y]] = x.

• S[x][y][z] = i[K][x][y][z] = K[S][K][x][y][z] = S[x][y][z] = x[z][y[z]]

• i[x] => x[[a][b][c] => a[c][b[c]]]][[d][e] => d]

• i[i][x] => i[[a][b][c] => a[c][b[c]]]][[d][e] => d][x] = ([a][b][c] => a[c][b[c]])[[a][b][c] => a[c][b[c]]]][[d][e] => d]][[d][e] => d][x] = ([a][b][c] => a[c][b[c]])[[d][e] => d][([d][e] => d)[[d][e] => d]][x] = ([d][e] => d)[x][([d][e] => d)[[d][e] => d][x]] = x.

Alternatively, j would also work:

• j[x] = x[K][S]
• S = j[j][j] = j[K][S][j] = K[K][S][S][j] = K[S][j] = S
• K = j[j[j][j][j][j]] = j[S[j][j]] = S[j][j][K][S] = j[K][j[K]][S] = K[K][S][j[K]][S] = K[j[K]][S] = j[K] = K[K][S] = K;

Another option is W[x] = x[K][S][K] with K = W[W][W] and S = W[W[W]].

• K = W[W][W] = W[K][S][K][W] = K[K][S][K][S][K][W] = K[K][S][K][W] = K[K][W] = K
• S = W[W[W]] = W[W[K][S][K]] = W[K[K][S][K][S][K]] = K[K][S][K][S][K][K][S][K] = K[K][S][K][K][S][K] = K[K][K][S][K] = K[S][K] = S.

If we define m as:

• m[x][y][z] = x[z][y[K[z]]]

• K = m[m[m]][ m[m[m]][m][m] [m][m][m]] = m[m[m]][ m[m][m][m[K[m]]] [m][m][m]] = m[m[m]][ m[m[K[m]]][m[K[m[K[m]]]]] [m][m][m]]

• S = m (m (m m (m m (m m))(m (m (m m (m m)))))) m m

Unused?

Self Application

M[x] (sometimes also called u, e.g. here) is a combinator that takes an argument and applies that argument to itself: M[x] = S[I][I][x] = I[x][I[x]] = x[x]

An interesting property of the M combinator is that its self-application is irreducible: u[u] = s[i][i][s[i][i]] = i[s[i][i]][i[s[i][i]]] = s[i][i][s[i][i]] = u[u].

Reversal

R[x][y] = y[x] can be constructed as R[x][y] = S[K[S[I]]][K][x][y] = K[S[I]][x][K[x]][y] = S[I][K[x]][y] = I[y][K[x][y]] = y[K[x][y]] = y[x].

References

• Combinatory Fibonacci
• TODO: look at Iota and Jot which can derive S and K
• SKI Calculus
• Moses Schönfinkel
• Combinators and the History of Computation
• Combinators: A 100-Year Celebration

Loading and verifying set.mm.

This is a client-side exploration of metamath's set.mm, which is verified here.

This downloads a 40MB file, which takes a while to load and parse. But once it is parsed, you can navigate the database below:

This is an open study of RSA Signatures from here and here.

Signatures

Alice wants to send a m = to Bob and prove that the message came from her

• Alice constructs her public and private keys (how and why?):
  • Alice starts by picking two large prime numbers p = and q =
  • Alice then computes n = n
  • Alice selects an e = .
  • Alice finally d = d.
• Alice has then a public key e = e, n = = n and private key d = d.
• If Alice wants to send a public message m = m
  • Alice computes s with her private key by computing m ^ d % n = m ^ d % n = s
  • Alice sends both m = m and s = s to Bob
• Bob verifies it by:
  • Bob computes r = s ^ e % n = s ^ e % n = r.
  • Correctness: because encryption and decryption on RSA is invertable this is guaranteed to be correct
  • Confidentiality: because only someone that possesses d could create the encryption, its provenance is guaranteed.
  • If check = m == r = m = r = check, then
    • m is guaranteed to have been signed by d.

In practice, m tends to be large, so we typically hash it before signing.

Blind Signatures

Bob wants Alice to sign a message m = m without revealing the it to Alice.

A Blind Signature works as follows (from here):

• Bob computes a random number k = k (must be relatively prime to n = n).
• Bob computes t = m * (k ^ e) % n = m * (k ^ e) % n = t.
• Bob sends t to Alice and asks her to sign it
• Alice computes the signature using her private key d = .
  • Alice calculates b = t ^ d % n = t ^ d % n = b and sends that back to Bob
• Bob gets b and remembers that b = t ^ d % n = (m * (k ^ e) % n) ^ d % n = (m ^ d) * (k ^ e ^ d) % n
• Bob knows that k ^ e ^ d = k because encryption and decryption cancel each other out, so it is equal to 1, so we get (m ^ d) * k % n
• Bob computes s2 = b / k = b / k = s2.
• The blind signature s2 = s2 is exactly the same (check2) of the unblinded signature s1 = s
• Bob can use the traditional non-blinded verification of the signature:
  • Bob computes r2 = s2 ^ e % n = s2 ^ e % n = r2 and checks that it matches m = m.
  • m is guaranteed to have been signed by d.
  • Alice never learns m.