Re: [saag] post-X509 cryptographic identities

[Watson Ladd <[e-mail]>]

On Thu, Feb 13, 2020, 2:30 PM Tony Rutkowski <[e-mail]>
wrote:

> It is interesting that no one is addressing Bob Kahn's evolving models.
> Bob, after all, approved, paid for, and nurtured DARPA's DNS and BIND
> namespace/platforms. (The BIND part proved serendipitous but ultimately
> critical because some Berkeley grad students needed a funded project.)
>
> In the 1990s, he created the DOI namespace and infrastructure to
> identity and resolve all network based objects with IPR significance.
> He achieved a measure of success by obtaining both government support
> and transferring authority to a nominally global non-profit foundation
> (the International DOI Foundation) while maintaining some continuing
> control of the BIND equivalent. It has been quite successful, and even
> RFCs now have DOIs.
>
> Shortly afterwards, he rolled out Handles as a superstructure for all
> network identifiers.  Success for that namespace and platform proved
> more difficult.  Ultimately he used a combination of intergovernmental
> nexus (ITU-T X.1255) plus treaty conference resolutions - combined with
> a slightly more independent global non-profit foundation based in Geneva
> (the DONA Foundation).  The success has proven more elusive, even as
> some nations have considered it as an alternative/backup for DNS, and in
> theory solves the meta-identifier problem that will get more vexing as
> object namespaces proliferate.
>
> Views?
>

I'd prefer to focus on real world experience and the lessons learned, and
solving tractable problems that are serious.

In this world plenty of economic transactions take place with DNS names as
the only identifier. Plenty of people are known by monikers that have
nothing to do with any government: Muhammed Ali, Prince, Kirk Douglass,
Liberace, etc. The state doesn't determine these: remember "Say my name!"?

For all the supposed essentially of tying DNS names and cert issuance to
the real world, the WebPKI has focused on domain control and been widely
accepted. OV and DV certs have completely failed to deliver, with the
browser UI becoming depreciated due to serious issues with assuming
globally unique names and consequent security. OCSP didn't work because CAs
can't meet the uptime requirements. Shortlived certs can't work because
they would clog CT logs, and X509 is too hairy for what it is used for now.

Where is the running code for all these wonderful ideas? Where is the
demonstration that they will actually add value?

Sincerely,
Watson Ladd