WAVE: A Decentralized Authorization Framework from Transparency Logs
summary
Wave replaces a central access-control server with a cryptographically enforced authorization graph stored on a new ULDM transparency log that adds revocation to Certificate Transparency. The prototype is implemented in Go/C++, runs on over 200 IoT devices, and has operated for two years; graph updates complete in milliseconds, proofs build and verify in tens of milliseconds with an average proof length of four hops. The design uses reverse discoverable encryption to hide unrelated permissions while enabling efficient existence and non‑existence proofs.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:46Outline
- 8:35CT's transparency guarantee
- 16:55The data structure at the log provider
- 17:27Auditing
- 24:14Transparency logs: summary
- 24:35WAVE is a decentralized authorization system
- 25:10Representative authorization example
- 25:42Traditional approach
- 26:51Comparison to authorization systems
- 27:39Challenges to decentralized authorization
- 29:11Graph Based Authorization
- 31:09This forms a single global graph
- 32:34What do we need from the storage layer?
- 34:32How about Certificate Transparency?
- 35:52Log provider's data structure
- 43:36Log server data structure
- 47:39Revocation
related talks
35mSAFE WG Deep Dive
19mCollective Authorities: Transparency & Decentralized Trust...
39mPrivacy-preserving Approaches to Transparency Logs
46mAuth and Distributed Systems: Don't Throw the Baby Out with the Bathwater
17mLiberating Web Data Using Decentralized Oracles for TLS
36mBringing honest computing to the WASM world
21mGhostor: Toward a Secure Data Sharing System from Decentralized Trust
18mVerifying Indistinguishability of Privacy-Preserving Protocols