I built a small service for secure storage and distribution of cryptographic keys in ATProto

Share your project
1

Hello community!

I am juandjara, you might recognize me from the Wafrn project

I have built a small service that you can host yourself that handles storage and distribution of keys for the use cases of limited-audience posts like “followers-only“ or “only-mentioned” users. It is loosely inspired in roomy-keyserver

I’m not sure if this is a current fit with the work currently being done, but I thought it would be easy to do and would solve some of my doubts about this, so I built it.

The project includes a server, a client library for that server, and lexicons for the XRPC methods available.

Authentication is done using ATProto Service Auth Tokens, so a current session can be restricted to use of one or a couple xrpc methods only.

The project has extensive documentation for the encryption protocol used and also for the security considerations taken when building it. Also there are several instructions on how to integrate this service with an appview and with your PDS, providing usage examples and code fragments for it.

Project is available on tangled at @djara.dev/atp-keyserver at main · tangled and on codeberg at https://codeberg.org/juandjara/atp-keyserver

I would love to hear your opinions about it.

Thanks everyone for creating this amazing tech and community.

5 Likes
2

Hello juandjara, welcome, thanks for sharing. This looks super interesting!

1 Like
3

Hey this looks pretty neat!

I’m the one who wrote the roomy keyserver, and I’m glad it could serve as a useful starting point!

Also, feel free to use the code from muni-town/roomy-keyserver even commercially if you want under Apache 2.0 / MIT license. It got Polyform licensed at the time while we were still figuring out what different pieces of our architecture would be licensed under, but the code that was there was almost example-level and almost small enough to memorize so you can use it for whatever you need. :smiley:

1 Like
4

Noted! Thanks a lot, let’s hope we can get somewhere with this

1 Like
5

Here is an example app implementing this

It can do oauth login, handles encryption / decryption, appview caching and writes record to the user PDS

1 Like