Re: [saag] post-X509 cryptographic identities

> On 11 Feb 2020, at 14:30, Derek Atkins <derek@ihtfp.com> wrote:
> 
> 
> On Tue, February 11, 2020 5:55 am, Michael Richardson wrote:
>> 
> [snip]
>> I think that the document would say a series of things:
>>  The designers of X500/X509 intended X, but it turned out that this
>>  did not happen, and instead PKIX did Y.
>> 
>> (One could substitute X=DN, Y=SAN for instance)
>> 
>> I think that it is important for any new identity system to recognize what
>> forces pushed us away from the original vision.
>> We made engineering tradeoffs based upon time, code, bandwidth,
>> round-trips
>> and threats.   Not every such decision is still justified.
>> 
>> So this requirements document would essentially be some kind of loving
>> criticism.
> 
> Should this document also include the history of other PKIs, such as SPKI
> and/or OpenPGP's WoT?  I think it would be interesting to put an
> historical contrast on the visions behind the various methods/standards
> and perhaps try to document the reasons (if possible) that "market forces"
> took us in one direction vs another.

After my intervention in this thread earlier today on the importance
of the relation of data and naming, it occurred to me that the
early X509 standards where bound to a data protocol X500, which later lead
to LDAP. (I don’t know this story in detail but I am sure many
here could write books about it). The important thing then is that 
it could be argued that the architecture of naming made sense when complemented with a system for tying identities to richer data. 
As these protocols failed to function at global scale one was left 
only with only identity/reference working.

I claim that Data should be thought of as putting things into relation 
to one another. If I can invoke some mathematics here, a very 
clear way of presenting databases in Category Theory developed 
by Spivak at MIT is as a functor from of a small category (the schema)
onto the category Set. See the very clearly written
  ”Functorial Data Migration”
https://arxiv.org/abs/1009.1166

Now a key concept in this view is that of a Grothendieck construction,
which is a category that arises out of a database instance (i.e. such
a Functor) by flattening the schema and the data together.
This is explained in that article in a few short paragraphs. 
In later work they use this construction  in order to give a mathematical model of how DB queries work. 

Spikvak in that article see this as being the structure behind RDF, 
the semantic web standard developed at W3C, though it turns out that 
this works better when instead of using a functor to Set one works with 
functors from bicategory of Relations to the category Rel of sets and relations. (shown in a recent article)
https://arxiv.org/abs/1706.00526

There is thus some deep mathematical reasons to think that the 
structures behind the Semantic Web project are the right ones
to build databases. Furthermore it was designed
to work in decentralised systems that use all the protocols developed
here at the IETF. So the analysis of data as relational, 
and their tie to identity (each name being an identifier) 
and the need for both to work together, shows it seems to me, that
in order to fulfill the original vision of X509, one should
perhaps help oneself of the 20 years of work done at W3C,
and in universities across the world.

Henry
@bblfish

> 
> -derek
> -- 
>       Derek Atkins                 617-623-3745
>       derek@ihtfp.com             www.ihtfp.com
>       Computer and Internet Security Consultant
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag