when i use IPNS i can publish the file’s hash to my PeerID (which obviously doesn’t change) but how does secutiry work? Can someone publish something under my PeerID?
You publish a IPNSRecord holding the ContendID of the file, signed by your peerID. Security works because the record is signed and other peers know that they should only accept “your” IPNS records if they are actually signed by your peer key. They are also timestamped so you can update your IPNSRecords to point to the hash of a newer version.
Nope, 'coz they don’t have your key.
I sign a IPNSRecord with my peerID but i can also generate another key and sign the records with this. In this case how do other peers verify that this record was actually published by me?
In other words, if i sign a IPNSRecord with another key different from my PeerID, how do other peers verify that this record was actually published by me?
I don’t know the exact structure. In particular, I don’t know if you sign the record directly with your PeerID, or if your generate a key, sign it with your PeerID, and sign your record with that.
In the first case, a new key means a new identity: they can’t know for sure.
In the second case, you can generate a new key signed with your peerID: you’re good, and they can be assured it was sent by you.
I think the second case is the one implemented, but I’m not sure.
IPNS records are signed with a private key and the identifier for the record is the (hash of) the corresponding public key.
While the default key to use for IPNS happens to be the one used to identifier your node (i.e. the one corresponding to your PeerID) any key can be used.
Keys can be generated using ipfs key gen and published with using ipfs name publish -k
In other words, if i sign a IPNSRecord with another key different from my PeerID, how do other peers verify that this record was actually published by me?
How did anyone know that the PeerID corresponds to you as a person? Whatever external method is being used to share “my node’s PeerID is QmXYZ, please follow /ipns/QmXYZ” could be used for the new key as well.
1 Like
Thus if i generate a new key and create a new IPNSRecord, the identifier of this is the new key that i generated and, furthermore, i sign IPNSRecord with my private key so that the other peers can verify the authenticity. It’s correct?