Re: [saag] post-X509 cryptographic identities

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Feb 14, 2020 at 2:32 PM Michael Richardson <[e-mail]>
wrote:

>
> Watson Ladd <[e-mail]> wrote:
>     > In this world plenty of economic transactions take place with DNS
> names
>     > as the only identifier. Plenty of people are known by monikers that
>     > have nothing to do with any government: Muhammed Ali, Prince, Kirk
>     > Douglass, Liberace, etc. The state doesn't determine these: remember
>     > "Say my name!"?
>
> Agreed, and those are all, btw, local names.
>
> Those people convince the world to accept them as their name, to enter it
> into our personal trusted store.  That we all happen to believe we are each
> referring to the same person when say "Prince" just means that they are
> effective. (But, an aunt has a dog named "Prince", and I know who is
> referring to when she says _Prince_.  It's Mimi's Prince, not AMI's Prince)
>

Let's start thinking in a post anti-Trust IoT world in which the majors are
no longer trying to establish monopolies with their voice control systems
and we want to be able to give voice commands to any of the devices we own
from any of the voice input devices and we want them all to give the same
result.

That is the following commands should all have the exact same result:

"Alexa, shut off the lights in the basement"
"Siri, shut off the lights in the basement"
"Zen, shut off the lights in the basement"

This can only work if there is a common understanding of "in the basement".
Which means that all the systems are using the same catalog to interpret
'basement'. And this has to be a local name. I want the system to do the
right thing even if I have more than one house.

According to Noth, a name is a signifier that has no direct correspondence
to the signified, it is a purely conventional relationship mediated by some
agreed registrar. In the case of my basement, that registrar is obviously
going to have to be me or someone in my house. Certainly not ICANN.

DNS names attempt to be universal names. They aren't quite, because the
registration is only temporary. The names are leased, not owned.

There is a role for universal names in PKI but we go about it the wrong
way. Not wanting to mention blockchain, let us consider a Merkle Tree
authenticated sequence as in CT or a DARE Sequence.

The logical implementation of the RPKI is as an incrementally authenticated
sequence. Each IP address block assignment is enrolled in the sequence as
it is granted or transferred. The entry specifying the range(s) of IP
addresses it applies to and the signature key(s) to which they are bound.

This structure allows a single signature by the registry to verify the
entire RPKI. We can extract individual range assignments and the
corresponding Merkle proof chain or we can just synchronize the entire
database.

We can imagine constructing something of the sort for 'real names' with a
different binding. So 'Microsoft', the Microsoft Logo, the Microsoft
enterprise root key and the address of the .Microsoft DNS server might be
enrolled in such a sequence after going through a CABForum EV type process
plus some form of trademark verification.

Issuing .Microsoft in this way would naturally upset folk thinking that
TLDs should cost $750,000 because they want a nice yacht. But it could
easily be done for $1000 without the need for any renewal fees. Though
there would be a need for a dispute arbitration process etc. And we might
want to have a rule that name owners have to make a maintenance post every
so often so as to allow unused names to be recycled.