[AIP-81][Discussion] Pepper service for keyless accounts

[thepomeranian]

AIP Discussion

Summary

In keyless accounts an end user needs a private blinding factor (pepper) as an input in the privacy-preserving account address derivation: as long as the pepper is not leaked, the link between the account and the provider/dApp owner behind it remains hidden.

This AIP proposes a solution to manange pepper for the end users without actually storing them by deploying a public service (operated by Aptos Labs) that computes the pepper as a verifiable unpredictable function (VUF) of some session data (namely, the ephemeral public key from the end user and the authorization token (the JWT) from the OIDC provider).

Read more about it here: https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-81.md