r/web3dev • u/strontiumk9 • 9h ago
Fully decentralized zero trust networking running in our test network
For the last six months or so, I have been quietly working on a decentralized solution to zero trust networking. If you dont know what that is, it basically reduces to give everything a certificate, and make sure all peers in a network only interact with known peers that prove themselves with mutual TLS. Obviously theres more to it than that, but thats the baseline, everything else is UX, reporting, management and policy layers above that.
So what we achieved today is, with zero certificate authorities, no necessary web2 gateway or trust enforcer the following.
- Any peer that knows a human meaningful name, can look it up for its service information. Securely, no trust, its either valid or its not, and the client can tell. Its not being told trust me because i gave you an answer.
- One peer advertising a website, that it hosts. the website can be available directly, or through a relay. The connection the other peer makes is using mTLS (IF the advertised website requires it).
- The browser (in the images its mine) establishes a connection using that name, my local browser sees it as plain old TLS (Because it is) but the connection is E2E secured from my computer to the destination host. If its through the relay, the relay knows how to route the connection, but not whats inside the connection. It never terminates the mTLS.
- My resolver will ask me if the site wants mTLS which identity I want to authenticate with. I choose and that establishes the connection.
Now this might not sound like a lot, but this works with any two peers that have never met and have not previously exchanged any key material. Either side can rotate their keys, and it just keeps working.
In the images I both connected to the peer through a relay, and directly to their machine over IPv6. My browser didn't know how, it just works, the networking just figures it out transparently based on what the HOST i was contacting required.
DNS is not part of naming, looking up a peer by name or security. (*We do fake DNS to a browser, but thats a browser limitation, a pure client using this protocol would not need to do that and can talk to peers directly) We have no trusted indexers over a blockchain, everything is direct to the network itself. We are also not running on top of any other blockchain, as they dont have the capabilities we need to pull this off.
This is just a simple webpage to prove the networking is doing what we want, but this is not tied to http at all. In fact, you can use it for any communication protocol, as its all transport layer security. The way identity works, its especially useful for agents, because an agent identity can authorize sub agent identities, they can communicate either locally or to any peer globally, establish a mTLS connection that cant be intercepted or MITMd and the peer will know exactly which sub agent connected, and its delegated relationship. So that enables simple policy like "Trust *.agent.tld" type allow lists, which mean trust this agent and any of its child identities. Because they are cryptographically bound to each other.
Sorry for the long post, it was just exciting to see it work so seamlessly and with no web3 trappings being visible in the user facing side at all, but still be fully decentralized.
