Re: [saag] post-X509 cryptographic identities

[Tony Finch <[e-mail]>]

Viktor Dukhovni <[e-mail]> wrote:

> On Mon, Feb 17, 2020 at 09:54:13AM -0600, Nico Williams wrote:
>
> > DNS/DNSSEC almost by definition cannot provide a solution for
> > smaller-than-universal namespaces,
>
> That's may not be exactly the case (haven't read most of the thread, so
> perhaps missed something important posted before).
>
> Your last hop (or stub) resolver can be configured with whatever
> trust-anchors you want for suitable private branches of the namespace.

I had something vaguely SKPI-flavoured in mind when I wrote
https://mailarchive.ietf.org/arch/msg/saag/jlVNCTQxyhLRjBLYLl9V0Wk_UKI

And also something related to the notion of "petnames" for capabilities
as a way to tame Zooko's triangle
http://www.erights.org/elib/capability/pnml.html

Interesting things happen when you combine SPKI-style path names with
petnames as local roots, especially for IOT and MANET applications. When I
create a secure association with a device, I give it a petname which is my
personal human-readable stand-in for its public key. And it I want to
share some devices with a friend, they don't have to import a petname per
device, they can just link to my root.

And you can graft a global namespace into such a system by having the
vendor pre-populate petnames for well-known registries. These
pre-populated names become equivalent to the DNS root.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Lough Foyle to Carlingford Lough: West or southwest 6 to gale 8, occasionally
5 later. Mainly very rough or high in north, otherwise moderate or rough.
Squally thundery showers. Good, occasionally moderate.