CashID is an open protocol that allows secure authentication based on the public key cryptography infrastructure that is currently present in the Bitcoin Cash ecosystem. Each user can prove to a service provider that they controls a specific Bitcoin Cash address by signing a challenge request, as well as provide optional metadata.
Passwords is an inherently flawed concept based on sharing secrets that is increasingly getting hidden away from the users by means of password managers, permanent sessions and single-signon features. Public key cryptography provides a more secure method for authentication where the users secret is never shared.
Secure authentication with optional metadata is useful, for example to...
When a user needs to access a physical or digital restricted area they are given a **Challenge request** by the service provider. The identity manager presents the request to the user and allows them to choose a suitable keypair to represent their identity.
If metadata was requested the identity manager provides the user the option to select which data to use for each metadata field, as well as the option to not supply information for any given field. If the user denies sharing of metadata for a field marked as required, the identity manager aborts the request.
When the user has chosen an identity, the identity manager signs the challenge request, adds the metadata that was approved by the user and sends a **Challenge response** back to the service provider.
The service provider validates the response and returns a **Confirmation status**. If the confirmation contains a status message it is shown to the user.
The **Nonce** parameter acts as a replay-protection mechanism, by making each request challenge and response unique. Each **Nonce** can only be used a single time during its lifespan and should expire if left unused for a significant amount of time.
The service provider should not process requests that it has not issued nonces for, except for **User actions** that have a valid and recent **Timestamp** as their nonce value.
The optional **Action** parameter is used to describe the action that the user authenticates to perform. When a **Data** parameter is present, the **Action** also determines how to interpret it. When omitted, the **Action** is assumed to have the default value of "**auth**" which authenticates with an optional **Data** message.
The **Required** and **Optional** parameters allow the service to request personal information from the user. In order to do this in the least amount of space, the information is shorthanded by a letter and a string of numbers representing various pieces of personal information. For **Optional** metadata, the numbers after a letter can be omitted to request all fields in that category. The field numbers in each category has to be listed in sorted order, starting with the lowest number. If the same information is requested in both required and optional scope, the information is required.
When the identity manager is ready to submit a **Challenge response** it forms a **Response URL** by appending the **Domain** and **Path** components to a **https://** scheme identifier.
The **Address** field should be a valid Bitcoin Cash address in the [CashAddr](https://github.com/bitcoincashorg/bitcoincash.org/blob/master/spec/cashaddr.md) format.
Metadata is stored as a JSON object with property names matching the requested field names. Fields that have multiple values is stored as a JSON object with property names matching their identifier and values matching the field description.
**Service actions** can only be requested by the service provider.
**Action** | **Description** | **Data**
--- | --- | ---
auth | Identifies the user to the service provider | Optional message to display to the user
login | Grants the user access to digital services | Session identification ID used to link the login request with an active anonymous session
sign | Asks the user to cryptographically sign a message | Message text that the identity is requested to sign
register | Registers the user with a service, for example a newsletter or drawing of a lottery. | Description of the service the user signs up to
ticket | Grants an identity future access to a resource, for example a ride in a rollercoaster or a seat at a conference | Description of the resource and ticket validity
claimtx? | Asks the user to prove ownership of any address used in a transaction | Transaction identifier
claimaddr? | Asks the user to prove ownership of a specific address | Address identifier
<br />
**User actions** can be sent unsolicited to the service provider.
**Value** | **Description**
--- | ---
delete | Requests the service provider to delete this identity and related metadata
logout | Requests the service provider to close all active sessions for this identity
revoke | Informs the service provider that this identity has been compromised
update | Informs the service provider about changes to identity, position or contact metadata
The **register** action for the **newsletter** at **bitcoin.com** requires **Name**, **Family**, **Country** and **Email** to work, and will use **Picture**, **Age**, **Gender** and **City** if provided.
The **login** action for session **a7fbb9341ce3ae21** at **democratictools.net** (which as a security measure does not store user profile information) will only work if the user provides a **nickname** and **email**, and will give a better customized user experience if the user provides **Country**, **Age**, **Gender** and a **Postal label**.
The JSON encoded response for a user with address **???** that optionally shares **Country** and **Age** will be sent to **https://democratictools.net/fn/auth**:
In order to reduce implementation costs and increase implementation conformity, this specification supplies extra material that can be helpful to developers.
