Allow import/export of public keys only

[alessio]

Hi,

I'd like go-crypto to allow import/export public keys only, more or less a-la-GPG.
This is because of https://github.com/tendermint/clearchain's requirements:

• Only ClearingHouse admin accounts can create foreign entities admin accounts.
• It'd be quite unsafe if a ClearingHouse admin generated a private-public key pair and handed it to the foreign entity admin. I'd expect the admins wanting to generate a key pair themselves, to then hand only the public key to a ClearingHouse admin.
• Afterwards, the ClearingHouse admin sends a CreateAdminTx to create a new admin account with the given public key for the foreign entity,

@jaekwon @ebuchman @adrianbrink Please give me a shout if need more clarifications, I'm happy to help out with this.

Thanks for considering

[jaekwon]

I'm in favor of a unified keystore system that can also track public keys that works on all Cosmos zones.

[alessio]

Yes @jaekwon, I am happy to help out. In my view, the keys command should feature the following subcommands:

• generate, delete and update - like current create, delete and update, without the name parameter as it's quite useless.
• delete command should support a --public-key-only option.
• import - import full key pairs and public keys only; it should support both binary and ASCI-armored formats.
• export - export full key pairs and public keys only; it should support both binary and ASCI-armored formats.
• list - pretty much like the current list command, with a cli output format [1] that should be something like the following:

Address	Type	Algo
BB6ED743F539D32F82521AADFC800AF7C6D6CC1F	private	Ed25519
CDF7C8C084233059B2F54BC801052698F661F09B	public	Secp256k1
244D8856929BD4AB0F36E02EAE2CED2E0D386780	public	Ed25519

Keys that are listed as public indicates that the store holds the public key only.

[1] An output format, it'd be nice to support machine parseable output (e.g. json, yaml) for all commands.

[ebuchman]

I don't quite understand - what's the use case for having just the public key in the keybase ?

[alessio]

In clearchain there is a use case that needs special handling: UC: New member (i.e. a legal entity) wants to joins the clearing house 1. A representative of the new member creates a private key. 2. It exports the public key only. 3. It hands the public key over a clearing house's admin. 4. The clearing house admin imports the public key, and 5. creates a new admin user for the new legal entity from the imported public key Furthermore, all users of the chain need to be in the position to verify other users' identities (è.g. fingerprint/address comparison check) and transactions signatures. Thanks!

…

On Thu, 5 Apr 2018, 12:19 Ethan Buchman, ***@***.***> wrote: I don't quite understand - what's the use case for having just the public key in the keybase ? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#79 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAN_7HIhn3tj5FaVPBI2whv0GONYwYMMks5tlf2BgaJpZM4TC9Mr> .

[ebuchman]

What about that requires that the public key be added alone to the keybase though ? Sounds like all you need is a way to how the public key for a given key ... we have that already with the --output json flag, though looks like that output needs some cleaning up!

Once you have that pubkey, it just needs to be included in a transaction, but doesn't really seem important important to stick it in the keybase.

I know that GPG keeps pubkeys so you can check signatures based on them but I'm not sure that's what we want the keybase to be used for, since we already have a blockchain for that kind of thing ...

[alessio]

I very much agree to using JSON as portable format, I am happy to amend the PR accordingly. Re: the need of holding pub keys in keybase, when you want to include in a transaction you either [1]: 1. Load it from file: `clearchainctl createAdmin --entityname=NewEntity --entitytype=gcm --pubkey-file=pubkey.json` 2. Pass the name to the CLI tool as a reference to a pubkey stored in keybase: `clearchainctl createAdmin --entityname=NewEntity --entitytype=gcm --pubkey-name=NewEntityAdmin` Furthermore, when sending transactions that require to/recipient address fields, users could retrieve/refer to the recipient address by name of the pubkey stored in keybase. From users perspective, I thought it would be convenient to hold all keys they need in one place to retrieve addresses/pubkey, rather than retrieving them via query or managing key files on disk. [1] Needless to say, in both cases cosmos-sdk/client/keys needs new commands to expose import/export features

…

On Thu, 5 Apr 2018, 12:56 Ethan Buchman, ***@***.***> wrote: What about that requires that the public key be added alone to the keybase though ? Sounds like all you need is a way to how the public key for a given key ... we have that already with the --output json flag, though looks like that output needs some cleaning up! Once you have that pubkey, it just needs to be included in a transaction, but doesn't really seem important important to stick it in the keybase. I know that GPG keeps pubkeys so you can check signatures based on them but I'm not sure that's what we want the keybase to be used for, since we already have a blockchain for that kind of thing ... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#79 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAN_7GYVYiYEY7qVC48K9uCwefK6TTYgks5tlgZBgaJpZM4TC9Mr> .