How to validate someone delegates to your stakepool, while preserving their privacy?

Question

Say you had a "stake pool paywall" for your website, where you offer your content, but only to those who delegate to your stake pool.

What's the best way to validate someone has delegated to your stake pool, while preserving their privacy?

Ideally this would be some kind of login info they provide (public address paste in?), that automatically checks and unlocks website content access if True.

Ideally, this "proof" would unlock the website "paywall" so they can access your content, knowing they contribute to your pool. You could potentially unlock "levels" of content for duration of staking.

Answer 1

This is not a complete solution but it may possibly work. But, before that some context on cardano addresses and the delegation process is required:

Cardano addresses are of different types as described on the Cardano Ledger Spec :

• Base addresses, Addrbase, containing the hash of a payment credential and the hash of a staking credential. Note that the payment credential hash is the hash of the key (or script)which has contol of the funds at this address, i.e. is able to witness spending them. The staking credential controls the delegation decision for the Ada at this address (i.e. it is used for rewards, staking, etc.). The staking credential must be a (registered) delegation credential.

• Pointer addresses, Addrptr , containing the hash of a payment credential and a pointer to a stake credential registration certificate

When a user delegates to a stake pool, a delegation certificate is posted to the blockchain. It contains:

• The stake key registration certificate hash
• The stake pool id (hash) the use has delegated to.

Assuming a base address is used in the delegation transaction, this means that the address is linked to the stake key hash contained in the certificate.

So a potential login solution would be have the user generate a pointer address in his wallet and paste it in a field on you webapp login page.

On the back-end, you could fetch the original delegation address and the stake key linked to it.Then check if the pointer address submitted is linked to the same stake key as the original address.

If there is a match it can only mean that the private key used to derive the original address is the same private key used to derive the pointer address, therefore the user submitting the pointer address must be the same user who delegated to you pool.

Some useful references related to this:

• CIP-19
• Formal Spec Doc of the Cardano Ledger
• Engineering Design Specification for Delegation and Incentives in Cardano–Shelley

Answer 2

I don't know if this is a great solution to this, but what you could do, is make logins for your users based off of their Staking Address (stake address = username) and then to validate it you could have them send 1 ADA to you from that Address. Then on your website's backend, you will need to look for that new transaction to your wallet to finish the validation. Once validated, they can set their password, thus protecting others from using the same public stake address. Not a perfect solution but it should work for this.

Answer 3

You could have a registration / login system set up in this way:

Registration part

In order to get registrated user must input: Name, Email, Stake address, Password. User will be then asked to send a small amount of ADA from the Address associated to that Stake Address (You can query this endpoint to validate the addresses)

Login part

A normal login system. Nothing special about it.