Re: [saag] post-X509 cryptographic identities

[Tony Rutkowski <[e-mail]>]

+1

On 2020-02-14 3:13 PM, Phillip Hallam-Baker wrote:
>
>
> On Fri, Feb 14, 2020 at 2:32 PM Michael Richardson 
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>
>     Watson Ladd <[e-mail] <mailto:[e-mail]>>
>     wrote:
>         > In this world plenty of economic transactions take place
>     with DNS names
>         > as the only identifier. Plenty of people are known by
>     monikers that
>         > have nothing to do with any government: Muhammed Ali,
>     Prince, Kirk
>         > Douglass, Liberace, etc. The state doesn't determine these:
>     remember
>         > "Say my name!"?
>
>     Agreed, and those are all, btw, local names.
>
>     Those people convince the world to accept them as their name, to
>     enter it
>     into our personal trusted store.  That we all happen to believe we
>     are each
>     referring to the same person when say "Prince" just means that
>     they are
>     effective. (But, an aunt has a dog named "Prince", and I know who is
>     referring to when she says _Prince_.  It's Mimi's Prince, not
>     AMI's Prince)
>
>
> Let's start thinking in a post anti-Trust IoT world in which the 
> majors are no longer trying to establish monopolies with their voice 
> control systems and we want to be able to give voice commands to any 
> of the devices we own from any of the voice input devices and we want 
> them all to give the same result.
>
> That is the following commands should all have the exact same result:
>
> "Alexa, shut off the lights in the basement"
> "Siri, shut off the lights in the basement"
> "Zen, shut off the lights in the basement"
>
> This can only work if there is a common understanding of "in the 
> basement". Which means that all the systems are using the same catalog 
> to interpret 'basement'. And this has to be a local name. I want the 
> system to do the right thing even if I have more than one house.
>
> According to Noth, a name is a signifier that has no direct 
> correspondence to the signified, it is a purely conventional 
> relationship mediated by some agreed registrar. In the case of my 
> basement, that registrar is obviously going to have to be me or 
> someone in my house. Certainly not ICANN.
>
> DNS names attempt to be universal names. They aren't quite, because 
> the registration is only temporary. The names are leased, not owned.
>
> There is a role for universal names in PKI but we go about it the 
> wrong way. Not wanting to mention blockchain, let us consider a Merkle 
> Tree authenticated sequence as in CT or a DARE Sequence.
>
> The logical implementation of the RPKI is as an incrementally 
> authenticated sequence. Each IP address block assignment is enrolled 
> in the sequence as it is granted or transferred. The entry specifying 
> the range(s) of IP addresses it applies to and the signature key(s) to 
> which they are bound.
>
> This structure allows a single signature by the registry to verify the 
> entire RPKI. We can extract individual range assignments and the 
> corresponding Merkle proof chain or we can just synchronize the entire 
> database.
>
> We can imagine constructing something of the sort for 'real names' 
> with a different binding. So 'Microsoft', the Microsoft Logo, the 
> Microsoft enterprise root key and the address of the .Microsoft DNS 
> server might be enrolled in such a sequence after going through a 
> CABForum EV type process plus some form of trademark verification.
>
> Issuing .Microsoft in this way would naturally upset folk thinking 
> that TLDs should cost $750,000 because they want a nice yacht. But it 
> could easily be done for $1000 without the need for any renewal fees. 
> Though there would be a need for a dispute arbitration process etc. 
> And we might want to have a rule that name owners have to make a 
> maintenance post every so often so as to allow unused names to be 
> recycled.
>
>
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag