Md. Arshad Ahmed | WebAuthn Based Ockam Vault In TypeScript

[farFromShallow101]

Hello!
I am Md. Arshad Ahmed, a pre-final year undergraduate pursuing Computer Science and Engineering from National Institute of Technology, Silchar, Assam. As of now, I am highly interested in the fields of Blockchain and Cryptography. I am experienced in Java, JavaScript, C/C++ languages. But I am not so proficient in Rust and TypeScript.
However, I am really interested in this particular project and hence I am applying to this organisation assured that I will become proficient enough with the languages in a short period of time. I went through the provided resources properly and I got to learn a lot. The documentation was quite amazing!
I will continue the discussion in the following order:

1. Introduction (Current Section)
2. Learnings from exploring the given examples.
3. Past project 1 & 2.
4. Past Experience.
5. Proposed Timeline.
6. How I would approach building a WebAuthn based Ockam vault.

[farFromShallow101]

Hello! I am Md. Arshad Ahmed, a pre-final year undergraduate pursuing Computer Science and Engineering from National Institute of Technology, Silchar, Assam. As of now, I am highly interested in the fields of Blockchain and Cryptography. I am experienced in Java, JavaScript, C/C++ languages. But I am not so proficient in Rust and TypeScript. However, I am really interested in this particular project and hence I am applying to this organisation assured that I will become proficient enough with the languages in a short period of time. I went through the provided resources properly and I got to learn a lot. The documentation was quite amazing! I will continue the discussion in the following order:

1. Introduction (Current Section)
2. Learnings from exploring the given examples.
3. Past project 1 & 2.
4. Past Experience.
5. Proposed Timeline.
6. How I would approach building a WebAuthn based Ockam vault.

2.1. MY LEARNINGS FROM OCKAM END TO END ENCRYPTION WITH RUST PROGRAM

Uploaded code to GitHub Repo (link) after analysing and running the code
I coded a similar Echo Client and Echo Server using UDP in C language as a part of one of the course assignments in Computer Networks Lab this semester. But I didn't have to use some concepts. Through this example, I had a better knowledge of:

• Public Key Cryptography in Rust
• Routing and Forwarding using Ockam nodes
• Using a cloud service to build end to end encrypted communication via TCP

2.2. MY LEARNINGS FROM OCKAM : BUILD END-TO-END ENCRYPTED AND SECURE MESSAGING CHANNELS

Uploaded code to GitHub Repo (link) after analysing all the steps and running the code
This example took quite some time to cover and I learnt quite a few important concepts. Notable ones are:

1. In Step-1, I learnt about Ockam Nodes, Ockam Workers and how I can initialize and start an Ockam Node.
2. In Step-2, I learnt about Ockam workers and created an example echo worker and corresponding app.
3. In Step-3, I learnt about how the message flows from the sender to receiver and how routing information is manipulated as the message travels {routing over hops}.
4. In Step-4, I learnt about Ockam transport plugin for routing. In the example, we used TCP involving 2 nodes: Responder Node and Initiator Node.

Responder

->Initializes the TCP transport.
->Creates a TCP listener and waits for incoming connections.
->Creates an echoer worker.
->Runs forever to receive messages.

Initiator

->Initializes the TCP transport.
->Sends a message to the "echoer" worker, on a diff node, over a TCP transport.
->Wait to receive a reply and print it.

In Step-4, I also learnt hopping over 2 transport hops.

5. In Step-5, there was a lot to learn and note.

• Ockam has support for 2 different key agreement protocols based on:

1. Noise Protocol Framework : Used in WhatsApp and lightning network
2. Signal's X3DH design

• [Important learning from Discord AMA] Ockam's secure channels are decoupled from Transport layer connections so we can have end to end channels that are secure over multiple hops of transport layer connections. Each hop may be in different transport layer protocol. So a TLS connection is only as long as one underlying TCP connection.

While an Ockam Secure Channels can be end-to-end over a route that looks like:
TCP - TCP - TCP
or UDP - TCP- WebSocket
or BLE - TCP - TCP
or TCP - Kafka - TCP

• NOTE from the responder node code: In the part where we are creating secure channel listener for bob, we used the trust policy as "TrustEveryonePolicy". But due to this, Bob cannot actually verify that the person on the other end is Alice. It can be Alice or somebody else. Hence, there are other trust policies available viz; TrustIdentifierPolicy, TrustCredentialIssuerPolicy etc. In these, we base the trust in some other pre existing basis for trust - could be that Bob knows Alice's identifier beforehand or he knows the identifier of a credential issuer and Alice proves possession of a credential issued by the issuer.

[farFromShallow101]

3. Relevant Past Projects Explanation

3.1. BLOCK MINING IN PoW SIMULATION:

Link

Language: Java

Concepts involved: Proof of Work, Blockchains, Cryptography, Multithreading, Serialization, Design Patterns

WHAT IT DOES?
This project generates a blockchain of 10 blocks “mining” them after generation using Proof of Work consensus algorithm.

WHAT I LEARNT THROUGH THE PROJECT?

1. I improved my concepts about consensus algorithms in blockchains through this project. I learned how to implement the Proof of Work (PoW) consensus algorithm.
2. I improved my knowledge on different cryptographic concepts in the process. I used SHA-256 hashing algorithm to generate block hashes
3. I learned the concept of multithreading in Java.
4. I studied different design patterns in OOP. In the process, I implemented factory design pattern in my code and thus, I learned their importance in making my solution easy to code, well structured and more readable.
5. I learned the concept of serialization.

(A) How am I implementing PoW?
For each block hash, the code fixes a certain number of prefix zeroes for the hash to have. But no one can tell for certain, that having so and so contents in a block will result in the block hash having n number of prefix zeroes. Hence, we use a magic number variable.
(A.(i)) So, what is this magic number?
The magic number is a variable whose value is set by a random number generator. The random number generator function generates random values and appends these values to the block and checks if the block hash now has the required number of prefix zeroes. If the particular random number generated has the required amount of prefix zeroes, then that particular number is fixed as the magic number for the block. And that hash is fixed as the hash of that block. Thus we have mined the block using Proof of Work algorithm.
So, when I say that I am mining a block, I mean that I have fixed the hash of the block according to the convention set by the consensus algorithm, thus adding the block to the chain.

(B) Why am I using Multithreading?
Generation of this “Magic Number” is quite a computationally expensive process. Using random number generation eases it a bit, but not by much. So, we use multithreading to divide the work of finding the magic number among multiple threads.
Thus the mining time reduces in proportion to the number of available processors during mining.

(C) Why am I using serialization?
We use serialization so that the blockchain once generated remains in our hard drive even after the program executable window is closed.
(D) How am I regulating the mining speed?
I used a function which regulates the value of the number of prefix zeroes expected in the current block according to the time taken to generate the previous block. The value of the prefix zeroes variable is increased/decreased/kept the same if generation of the previous block took less than 10 seconds/more than 60 seconds/between 10 and 60 respectively. Higher the expected number of prefix zeroes, more time required to mine the block.

PLANS TO UPGRADE THE PROJECT:

1. Make a chat based blockchain simulation.
2. Implement digital signature (using asymmetric key cryptography) in the project so that the receiver in the chat has the guarantee that the message was created and sent by the claimed sender.

3.2. IMAGE ENCRYPTOR DECRYPTOR

Link

Language used: JAVA
Concepts involved: XOR cipher, Streams in JAVA, JAVA Swing

WHAT IT DOES?
The program interface takes an input image and a key from the user and encrypts the image. If the same image is given as an input again with the same key, then it decrypts the previously encrypted image.

WHAT I LEARNED THROUGH THE PROJECT?
I made this project in December 2020, after I finished my Discrete Structures course in 3rd semester. The course had quite an emphasis on Cryptography. After doing this project, I had a better understanding of implementation of cryptography.

(A) Why did I use XOR cipher for the program?
Let’s denote a byte by B and cipherkey by K. ^ is the XOR operator.
B^K=R (consider the result to be R)
According to the rules of XOR operator, when we XOR the Result R with the key again, we get back the original byte B.
R^K=B.
So, I used XOR operator since it will involve a common key for encryption as well as decryption.
(B) Why are we using byte streams?
Images contain binary data and hence they can be easily represented using byte streams. The byte streams provide a faster access than character streams in case of multimedia.

SHORTCOMING:

Using large sized images in this program (>200 kb) takes a long time to process and it might also result in overheating issues in the PC. In my opinion, this happens due to processing the entire image byte by byte, idk, bad stream handling.
Initially, I thought that using the XOR cipher might have been the problem. And so, I studied about RSA and AES in the process. Glad I studied these in the process. But then I realised that the problem was with the way I’m handling one byte at a time.

[farFromShallow101]

3. Relevant Past Projects Explanation

3.1. BLOCK MINING IN PoW SIMULATION:

Link

Language: Java

Concepts involved: Proof of Work, Blockchains, Cryptography, Multithreading, Serialization, Design Patterns

WHAT IT DOES? This project generates a blockchain of 10 blocks “mining” them after generation using Proof of Work consensus algorithm.

WHAT I LEARNT THROUGH THE PROJECT?

1. I improved my concepts about consensus algorithms in blockchains through this project. I learned how to implement the Proof of Work (PoW) consensus algorithm.
2. I improved my knowledge on different cryptographic concepts in the process. I used SHA-256 hashing algorithm to generate block hashes
3. I learned the concept of multithreading in Java.
4. I studied different design patterns in OOP. In the process, I implemented factory design pattern in my code and thus, I learned their importance in making my solution easy to code, well structured and more readable.
5. I learned the concept of serialization.

(A) How am I implementing PoW? For each block hash, the code fixes a certain number of prefix zeroes for the hash to have. But no one can tell for certain, that having so and so contents in a block will result in the block hash having n number of prefix zeroes. Hence, we use a magic number variable. (A.(i)) So, what is this magic number? The magic number is a variable whose value is set by a random number generator. The random number generator function generates random values and appends these values to the block and checks if the block hash now has the required number of prefix zeroes. If the particular random number generated has the required amount of prefix zeroes, then that particular number is fixed as the magic number for the block. And that hash is fixed as the hash of that block. Thus we have mined the block using Proof of Work algorithm. So, when I say that I am mining a block, I mean that I have fixed the hash of the block according to the convention set by the consensus algorithm, thus adding the block to the chain.

(B) Why am I using Multithreading? Generation of this “Magic Number” is quite a computationally expensive process. Using random number generation eases it a bit, but not by much. So, we use multithreading to divide the work of finding the magic number among multiple threads. Thus the mining time reduces in proportion to the number of available processors during mining.

(C) Why am I using serialization? We use serialization so that the blockchain once generated remains in our hard drive even after the program executable window is closed. (D) How am I regulating the mining speed? I used a function which regulates the value of the number of prefix zeroes expected in the current block according to the time taken to generate the previous block. The value of the prefix zeroes variable is increased/decreased/kept the same if generation of the previous block took less than 10 seconds/more than 60 seconds/between 10 and 60 respectively. Higher the expected number of prefix zeroes, more time required to mine the block.

PLANS TO UPGRADE THE PROJECT:

1. Make a chat based blockchain simulation.
2. Implement digital signature (using asymmetric key cryptography) in the project so that the receiver in the chat has the guarantee that the message was created and sent by the claimed sender.

3.2. IMAGE ENCRYPTOR DECRYPTOR

Link

Language used: JAVA Concepts involved: XOR cipher, Streams in JAVA, JAVA Swing

WHAT IT DOES? The program interface takes an input image and a key from the user and encrypts the image. If the same image is given as an input again with the same key, then it decrypts the previously encrypted image.

WHAT I LEARNED THROUGH THE PROJECT? I made this project in December 2020, after I finished my Discrete Structures course in 3rd semester. The course had quite an emphasis on Cryptography. After doing this project, I had a better understanding of implementation of cryptography.

(A) Why did I use XOR cipher for the program? Let’s denote a byte by B and cipherkey by K. ^ is the XOR operator. B^K=R (consider the result to be R) According to the rules of XOR operator, when we XOR the Result R with the key again, we get back the original byte B. R^K=B. So, I used XOR operator since it will involve a common key for encryption as well as decryption. (B) Why are we using byte streams? Images contain binary data and hence they can be easily represented using byte streams. The byte streams provide a faster access than character streams in case of multimedia.

SHORTCOMING:

Using large sized images in this program (>200 kb) takes a long time to process and it might also result in overheating issues in the PC. In my opinion, this happens due to processing the entire image byte by byte, idk, bad stream handling. Initially, I thought that using the XOR cipher might have been the problem. And so, I studied about RSA and AES in the process. Glad I studied these in the process. But then I realised that the problem was with the way I’m handling one byte at a time.

4. PAST EXPERIENCE

Zeeve Inc.

• July-Oct 2021

Worked for the project titled, "Development of a universal consensus algorithm flexible enough to support the participation of mobile and IoT devices with most efficient utilization of resources."
During my internship, I completed the following work (summarised briefly in three points):

1. Successfully modified and implemented a custom transaction processor of Hyperledger Sawtooth with a functional client side incorporating new ’transfer’ verb using Node.js
2. Studied and documented the functioning of the existing validator code and consensus code of sawtooth [more than 2000 lines]
3. Researched and implemented a custom consensus engine in Rust.

A part of this internship that is relevant to the project description of Ockam is that I got to study and implement the various cryptographic concepts namely:

1. AES and RSA
2. Private key encryption
3. Public key encryption
4. Digital Signatures
5. Digital Certificates

[farFromShallow101]

5. PROPOSED TIMELINE:

In the first two weeks, I would want to get to know my mentor and fellow interns better. Moreover, I would want to invest this time in solidifying my concepts of Rust and TypeScript by asking my mentor for a mini project maybe to document my understanding of some existing code.

I would be able to visualise and articulate for the upcoming weeks when I learn more specifically about the project.

[farFromShallow101]

6. HOW I WOULD APPROACH BUILDING A WEBAUTHN BASED OCKAM VAULT

At this point of time, I have a vague understanding of WebAuthn and I went over the current Ockam Vault (LINK)
This vault has the support for a set of cryptographic protocols for Secure Channels, Key Management, Authentication, Authorization etc which rely on some basic operations that may be provided by the operating environment of an application - Random Number Generation, Safe Key Storage, Elliptic Curve operations, AES operations etc.
This operating environment may inturn delegate these operations to hardware or third party services.
I have not understood the code of the Ockam vault fully as of now, but if I were to conceptualise building a WebAuthn based Ockam Vault, I would start by adding support for ES256, RS256, PS256, and EdDSA algorithms and adding support for symmetric as well as asymmetric key encryption techniques. I am not entirely sure about the implementation at this point of time, but I hope to learn a lot in the upcoming days.
Thank you for reading my post!