Summary

Add cryptographic identity trust to the decentralized snapshot distribution flow using UCAN (User Controlled Authorization Networks) delegation chains, eliminating the honest-majority assumption without introducing a central runtime dependency.

Background

Statistical trust (step 2) defends against isolated bad actors but not coordinated Sybil attacks. UCAN adds an identity layer: known trusted publishers sign their preverified.toml updates, and nodes verify the delegation chain locally.

Design

UCAN Delegation Model

• Root authority: A key embedded in the binary (similar to how JWT secrets work today). Controls publishing rights for a chain's snapshots.
• Delegation: Root authority issues UCAN tokens to trusted snapshot publishers, granting them the right to publish info-hashes for a specific chain. Delegations are created via a CLI tool.
• Verification: Nodes verify the full delegation chain: root authority → publisher → info-hash. Verification is purely local — no central server needed at runtime.
• Revocation: Initially rely on token expiry. Explicit revocation can be added later.
• Scope: Separate delegations per chain (mainnet, sepolia, etc.)

Node Identity Integration

• UCAN uses DIDs (Decentralized Identifiers). Node secp256k1 keys are compatible via did:key method.
• Publishers sign their preverified.toml info-hash with their node key.
• UCAN token + signature distributed via discv5 TALK protocol (too large for ENR's 300-byte limit).

Flow

Publisher node:
  1. Has UCAN token delegated from root authority
  2. Creates preverified.toml, computes info-hash
  3. Signs info-hash with node key
  4. Publishes ENR entry (FrozenTx + InfoHash) as before
  5. Serves UCAN token + signature via TALK protocol on request

Verifying node:
  1. Discovers peer with higher FrozenTx via ENR
  2. Requests UCAN token via TALK protocol
  3. Verifies delegation chain: root key → publisher DID → info-hash signature
  4. If valid, downloads preverified.toml via BitTorrent
  5. If invalid, ignores peer and continues searching

Libraries

• github.com/ucan-wg/go-ucan — UCAN token creation/verification
• did:key with secp256k1 via existing node identity keys

Key Properties

• No central runtime dependency: Root key is embedded, verification is local
• Trustless: Only nodes with a valid delegation chain can publish
• Defeats Sybil attacks: Publishing rights are cryptographically scoped
• Composable: Works on top of the ENR + BitTorrent infrastructure from step 1

Acceptance Criteria

• UCAN token creation via CLI tool (root key → publisher delegation)
• TALK protocol handler registered for UCAN token exchange
• UCAN verification integrated into discovery flow
• Root authority key embedded in binary per chain
• Invalid/expired delegations rejected
• Existing flow (steps 1-2) continues to work without UCAN configured