Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Thu, Feb 13, 2020 at 12:34:12PM -0500, Tony Rutkowski wrote:
> We have had hierarchical trusted name systems for a while.  PSTN numbers
> still serve that function - which drove ENUM.
> 
> The old idealized legacy DNS model arguably disappeared with vigorous
> competition among alternative root servers, e.g, 1.1.1.1, 8.8.8.8, etc.

The registries and registrars haven't changed.  The quad-Ns have not yet
balkanized the namespace.  They could, and they might, but it'd be
awfully controversial, and it's not likely to happen.

Moreover, DNSSEC still prevents namespace balkanization, and the quad-Ns
aren't yet replacing the root keys with their own.  Nation states _can_
pull this off because they can force people within their jurisdictions
to use balkanized DNS.  And quad-N providers might even provide that
service to nation states, but we're not there yet, and that's not
evidence that a global namespace is bad.

> Then there is also the shift to E2E MEF Ethernet...or with DONA's Handle
> System.
> 
> All of this arguably underscores the continuing need for a trusted PKI
> cert.  As you note, sovereign registries have value.

The registries need not be sovereign, but the dispute resolution
mechanisms they tie into must be.

Users need ways to establish trust.  Person-to-person (or device-to-
device) trust establishment is amenable to TOFU, but customer-to-
provider trust is not really.  The latter requires a namespace that
users can navigate to find -ultimately- where to bring civil suit if
need be.

Nico
--