Let's say we have a decentralized service S distributed on a network of 1000 nodes/servers. Is it possible to have a registration/sign up scheme using email address as login?

I see two problems:

  • (Ignored for this question) Probable low deliverability rate for emails sent from nodes of a decentralized network to major email providers (Gmail, Yahoo, etc.); this is not a cryptographic problem, let's ignore this problem here.

  • Another real problem described in the following example workflow:

    1. UserA, owner of userA@example.com, signs up to the service S (e.g. with a registration form on one of the website mirrors provided by the network)

    2. A signup token f9x372d2aff0 is stored in PendingRegistrations database of the network by one of the node, and a confirmation email is sent by one of the nodes to userA@example.com

    3. UserA opens his mailbox and sees a new email "Please confirm you want to signup to service S by clicking on"

    4. UserA clicks on the link, the token is compared to the one in the PendingRegistrations database of the network, if it matches, he can finish the registration process since he has proved he's the legit owner of userA@example.com


  • Malicious UserB (who doesn't run a node himself) cannot create an account named userA@example.com, because he will have no access to the token that will be sent to userA@example.com's mailbox

  • Malicious UserC, who runs a node himself, CAN create an account named userA@example.com: he can go on the website, fill the registration form, and then observe the PendingRegistrations database and get the token and register the account himself. Or alternatively: he could observe the outgoing emails of the server, and see the link which will be sent to userA@example.com, and get the confirmation link.

This is close to Zooko's triangle principle, but I don't see how the famous solutions for it (e.g. Swartz's solution) can solve the problem here.

Is it impossible to have a decentralized service using email addresses as login, or can asymmetric encryption (public key / private key) help here?

Note: Any email going out from a node, sent to a user, has to be "cooked" by a node of the network. So I would say: "Any string that will be viewed by an email recipient who will open the email received in his mailbox, can also be viewed by the node owner/email-sending-server owner", thus making the problem difficult. It seems obvious, but maybe is there a clever solution?

  • $\begingroup$ After this setup phase what is the network used for? $\endgroup$ – Elias Jan 31 '18 at 7:35

The core of your question is "Is there an attribute that an 'owner' of userA@example.com can be proven to have, and which no on else can be proven to have?" This heavily depends on the security of the email system, which, in general, is quite poor. Another central question is what "registration" even means. Presumably, it means "proving" one's identity, but proving it to whom, and how do others know that it has been proven? There has to be some process by which the "network" verifies identity, and then there has to be some process by which users verifies that the network has verified identity. Fully answering your question requires a precise formulation of what those processes are.

Ultimately, the only two possible unique attributes that an "owner" could have is the ability to send email, and the ability to receive/read email. Any other attributes, such as the ability to sign with a private key (asymmetric encryption) would mean that you're not basing it solely on email anymore. At that point, it's like asking "Is it possible to open a bottle with a spoon, if you also have a bottle opener?"

If you are confident on being able to detect email spoofing, then you can just have someone choose a private and public key, send their public key from their email to the nodes, and then sign everything with their private key.

If you're not confident that you can detect email spoofing, but you are confident that it is possible to send a message in such a way that only the "owner" of an email address can read it, then it's impossible for any single message to generate any attribute unique to the new user; any information sent in the email, the sending node also has. So you will have to have "the network" in general send multiple messages from multiple nodes, each with their own token.


There are a lot of 'if's involved but your specific problem can be solved by storing a public key instead of a sign-up token in the database. The private key is sent to userA@example.com and registration is completed by the user signing a challenge with this private key.

However, if you want to proceed with this kind of setup where some of the nodes in the network might be malicious you have to define your attacker model in more detail.

  • $\begingroup$ Thank you for your answer. The private key is sent to userA@example.com: then a malicious node owner can observe the emails being prepared on the server and sent to the user email address. (By just adding a logger of the outgoing emails). Then the node owner can get the private keys. $\endgroup$ – Basj Jan 30 '18 at 21:25
  • $\begingroup$ Yes, but this is only true if the user tries to sign up on a malicious node. As I said you need to carefully specify your attacker model. Depending on that there are various ways to fix it. $\endgroup$ – Elias Jan 31 '18 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.