Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Thu, Feb 13, 2020 at 09:33:47PM +0100, Henry Story wrote:
> > Yes.  But would any alternative look that different to the current
> > DNS?  I am very skeptical.
> 
> As I see it, the problems is not at the naming layer
> at which DNS is located where the problem is that of attaching a name 
> to an IP Address. Whatever system is used - bare ipv6-addresses, 
> namecoins, onion domains,… - all these  only give a way to identify 
> agencies in charge of machines. What is important is knowing what
> agencies those are!

DNS is not just for resolving names to IP addresses and such!

DNS is very much also about registries and registrars, and that is where
the rubber (protocol) meets the road (international law).

In fact, purpose, authority, and delegation of authority are the
essential aspects of DNS, not the protocol, not how it's used, not even
the data model.

You could replace the UDP port 53 protocol with a RESTful HTTP JSON API
running of any version of HTTP (including 3), including accessible RDATA
representations (i.e., not binary).  You could even replace all the
RRtypes and RDATA and have only domainnames in common with today's DNS.
That's all a matter of software and schema mapping.  But the one thing
that cannot be anywhere near as easy to replace is the business and
legal ends of it: authority, delegation, registries.  That and
domainnames (because they have bled into the UI/UX).

> What is needed is rich information that ties these ”publication
> machines” to machine readable official information about those
> entities.  This info exists: states put that together to gather taxes,
> provide services, base legal enforcement on it, … 

DNS already has this by way of the registrars, which already have this.

> The web site could link to such official machine readable information
> by using a ”registry” Link relation in an http header.

Whether such metadata should be public or not is a policy matter for
each registry and associated governance framework (i.e., in the
registry's legal jurisdiction(s)).  The IETF should not mandate
publication of that data because publication is a policy matter, and the
IETF has no leverage to impose such a mandate anyways.

Nico
--