3.5.1 Sighchains
3.5.1 Sighchains
A sighchain is a sequence of statements (called links), where each link includes a collision-resistant hash of the previous link. These links can be thought of as state transitions that modify an object (the sighchain state). For a user sighchain, the sighchain state contains the list of active devices, the list of revoked devices, the trust graph, and the list of email addresses and accounts historically associated with the user.
In order to accept a transition as valid, clients check that it satisfies several conditions, including that:
The link is of a known type.
The link has the correct fields for that type.
The transition is admissible given the current state.
The link correctly includes the hash of the previous link.
Some links require cryptographic signatures by the devices authorizing the transition to be considered valid. In these cases, the signatures are encoded as part of the links to compute link hashes.
Examples of admissibility rules for a user sighchain include that a device can only be revoked if it was active in the previous state, and that signatures over revocation links must be by a device that was active in the previous state.
Since each of the links in a sighchain contains a hash of the previous link, the hash of the last link is a compact commitment to the entire sighchain state. Each sighchain link also contains an incrementing sequence number. We refer to an object consisting of the sighchain type, the last link's sequence number, and the last link's hash as the sighchain tail.
Previous3.5 Consistent Identities With SighchainsNext3.5.2 Overview of Sighchain Types
Last updated 3 months ago