Re: [Din] WSJ article on Identity and Blockchains

[Brian E Carpenter <[e-mail]>]

On 12/04/2018 02:37, Thomas Hardjono wrote:
> 
> Hi David,
> 
> 
>>>>   2. We need some notion of a "symbolic link", so that I can name not
>>>>        just someone else's key, but someone else's name, as that's very
>>>>        powerful.
> 
> Yes the symbolic link is needed, but more importantly (and more difficult) is the binding to the owners person.  How do I know that the person Alice for pubkey X is the same Alice who owns pub key Y.

Do you need to know? Surely what you need to know is what capabilities to
grant to the holder of pubkey X, and what capabilities to grant to the
holder of pubkey Y. Alice might prefer to have disjoint identities for
different purposes. In some countries that might be essential for
personal safety.

   Brian
>>>> These points of course were ones that many of us were making in the
>>>> 1990s.  See, for instance SPKI/SDSI.
> 
> Agree, that was Car Ellison's proposal.
> 
> 
>>>> The blockchain is useful, but sort of orthogonal to the namespace
>>>> itself.  
> 
> Agree.
> 
> 
>>>> What it provides, that we couldn't do before, is the ability to
>>>> voluntarily restrict what you do with your own namespace.  E.g., maybe
>>>> you want to delegate a name and then restrict yourself from revoking it
>>>> without seven days notice.
> 
> Could we use DNSSEC for this? 
> 
> 
> -- thomas -- 
> 
> 
> ________________________________________
> From: David Mazieres [[e-mail]]
> Sent: Tuesday, April 10, 2018 8:04 PM
> To: Thomas Hardjono; Brian E Carpenter; [e-mail]
> Subject: Re: [Din] WSJ article on Identity and Blockchains
> 
> Thomas Hardjono <[e-mail]> writes:
> 
>> Just like there is "autonomous systems" (AS) concept in routing and
>> connected via backbone routing, in the area of identity there needs to
>> be the equivalent of an AS.
> 
> Yes, but obviously AS numbers are centrally allocated and a flat
> namespace.  If we are going to have various identity providers, I would
> argue we need two things unlike AS numbers:
> 
>   1. The identifiers should be self-authenticating (public keys, not
>      integers), so allocation is "self-server," and
> 
>   2. We need some notion of a "symbolic link", so that I can name not
>      just someone else's key, but someone else's name, as that's very
>      powerful.
> 
> These points of course were ones that many of us were making in the
> 1990s.  See, for instance SPKI/SDSI.
> 
>> So anytime I hear about a global blockchain to rule them all, I cringe
>> :-)
> 
> The blockchain is useful, but sort of orthogonal to the namespace
> itself.  What it provides, that we couldn't do before, is the ability to
> voluntarily restrict what you do with your own namespace.  E.g., maybe
> you want to delegate a name and then restrict yourself from revoking it
> without seven days notice.
> 
> David
>