Re: Machine Identity

[der Mouse <[e-mail]>]

> Such an identity should be almost unique (as is a number choosen at
> random in a very large space) and the machine should be able to prove
> that it indeed "owns" this identity (as is an ID which is the public
> part of a cryptographic key).

> For me, SSH keys or HIP Host Identifiers fulfill these requirments.

Then you have a relatively loose definition of "owns", because an SSH
identity demonstrates merely that the host has the cooperation of
someone who owns the identity.  Furthermore, there may be multiple
machines that own the identity in the sense of having the private data,
since the private data can be copied between machines.

That may be fine for your purposes, but there are people, such as DRM
wonks, to whom either of those two properties ("has the cooperation
of", and copyability) is unacceptable.  As someone remarked upthread,
get host identities and you'll find that lots of people actually want
something slightly different from host identities (no matter what value
of "host identities" it is you get).

Of course, for on-the-wire purposes, you can't prove more than "has the
cooperation of" no matter what you do; all you can demonstrate is that
some entity able to act as the other end of that packet stream you're
seeing has the identity in question.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [e-mail]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B