Re: [saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Nico Williams <[e-mail]> wrote:
    > It seems like a miracle that we have DNS at all.

    > And when you talk about x.509 naming, it really does seem to mean that
    > you're referring to dNSName SANs, so, DNS.

    > It seems unlikely to me that we could replace a global system we have
    > (DNS) with a non-global system.  That's a lot of value to leave behind!

SPKI permitted things like:
     DNS's www.cryptonector.com
or:  Nico's second-floor bathroom

and in particular it would permit:
or:  Russia's nameservice cryptnector.com        (national DNS root)
or:  employer.example.com's www.amazon.com       (forced corporate proxy)

    >> Typical PKI implementations just makes it really hard for end users to
    >> actually manage their trust anchors, because it pretends that the
    >> local trust anchors were a pronouncement from god.

    > Yes.  But that's not a fault of PKIX, or DNS, or anything other than
    > the

I agree, it's not inheirently the result of PKIX, but then we got meaningless
junk like CPS which makes it really hard for people (even lawyers) to have
their own.

    > So I take the opposite view: a single global namespace IS fine.  It may
    > well be the single biggest key to the Internet's success.  WebPKI is
    > busted.  ISTM incorrect to conclude that because WebPKI is busted, and
    > that because the "I" in it wanted it to be a single global namespace,
    > that then it must be that a global namespace is bad.

In the SPKI days I wanted no DNSSEC root.
I wanted 158 national roots with k-of-n cross-signatures.
Countries would recognize (in the political/legal, UN sense) each other by
signing each other's ccTLD trust anchors.

Everyone in Canada would be obligated by law to use the "CA" trust anchors,
and to get to "amazon.DE", I'd have to go "CA-cross->DE->amazon".

Which definitely lets my government spoof me, which they already say they
have the right to do under certain circumstances, but it doesn't let them
spoof you.   Would we have to kill ".com", etc. and all the ICANN zoo?  
Maybe. It's not a big loss to me, but others would object.  And we don't need
to do it overnight.

It also means that my government is assuming liability if I get spoofed,
which also seems reasonable. 

    >> learn this practice as infants.  In the family environment names work
    >> as identifiers, even today.  What we learn as infants is especially
    >> difficult to re-learn later in life.  Therefore, it is natural for
    >> people to translate the need to know who the keyholder is into a need
    >> to know the keyholder's name.

    > Locality in naming usage does not imply that a global namespace is bad.

So, we see this in things like maps where national authorities inform
google/bing/etc. what the official name of a conquored place is, in
contradiction to what name the locals, (and possibly, the world) use.
I don't know which name is global and which name is local, but I can do all
of that with relative (SPKI) names.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [