KeysΒΆ
Resource machine assumes various keys used by the user for different purposes. The table below lists all of these keys.
| Name | Derivation | Description | Lifetime |
|---|---|---|---|
| Identity key pair \((idsk, idpk)\) | \(idsk \xleftarrow{R} \mathbb{F}_p, idpk = [idsk] * G\) | This static key pair serves as the user's identity. It is used to authorise actions. | Forever |
| Nullifier key, nullifier key commitment \((nk, cnk)\) | \(nk \xleftarrow{R} \mathbb{F}_p, cnk = PRF(nk)\) | These keys are used to reflect the right to nullify | Forever, but can be periodically rotated in the identity lifetime |
| Static encryption key pair \((sesk, sepk)\) | \(sesk \xleftarrow{R} \mathbb{F}_p, sepk = [sesk] * G\) | This static key pair is used to produce resource encryption keys | Forever, but should be periodically rotated for forward secrecy |
| Static discovery key pair \((sdsk, sdpk)\) | \(sdsk \xleftarrow{R} \mathbb{F}_p, sdpk = [sdsk] * G\) | This static key pair is used to produce discovery encryption keys | Forever, but should be periodically rotated for forward secrecy |
| Ephemeral encryption key pair \((eesk, eepk)\) | \(eesk \xleftarrow{R} \mathbb{F}_p, eepk = [eesk]*P\) | Ephemeral encryption key pair generated by the sender. Used to derive the resource encryption key | Transaction |
| \(rek\) | \(rek = KDF(DH(sepk, eesk), eepk)\) \(= KDF(DH(sesk, eepk), eepk)\) | Resource symmetric encryption key. Used to encrypt the transmitted resource object | Transaction |
| Ephemeral discovery key pair \((edsk, edpk)\) | \(edsk \xleftarrow{R} \mathbb{F}_p, edpk = [edsk]*P\) | Ephemeral discovery key pair generated by the sender. Used to derive the discovery encryption key | Transaction |
| Discovery encryption key \(dek\) | \(dek = KDF(DH(sdpk, edsk), edpk)\) \(= KDF(DH(sdsk, edpk), edpk)\) | Discovery symmetric encryption key. Used to encrypt the discovery message | Transaction |
Encryption keys are used for in-band distribution of resources. Discovery keys are used for faster discovery of the distributed resources.