6 ms·
This reminds me of a very tangible shortcoming in the OSI model that <https://en.wikipedia.org/wiki/Host_Identity_Protocol> https://en.wikipedia.org/wiki/Host_I
by a3_nm 13y ago
This reminds me of a very tangible shortcoming in the OSI model that <https://en.wikipedia.org/wiki/Host_Identity_Protocol> https://en.wikipedia.org/wiki/Host_Identity_Protocol> is trying to address and which is, in my opinion, far more important that exchanging value.
It is the fact that we always talk of machine addresses, and never of machine identities (except through DNS, but DNS is also about giving human-readable identifiers, so it cannot be decentralized <https://en.wikipedia.org/wiki/Zooko%27s_triangle> https://en.wikipedia.org/wiki/Zooko%27s_triangle>).
However, now that everyone is using public-key crypto, we should understand that a machine can be referenced by a public key, and that it can prove ownership of it to anyone who asks. (This can also be used to encrypt traffic, but this is not what I am thinking of.)
Hence, why do we connect to IP addresses, rather than connecting to public key hashes? Granted, public key hashes are not routable, but there could be a service to provide the mapping from hashes to addresses -- not DNS, because it doesn't have to give human-readable names (so doesn't have to be centralized), and because there is little penalty for receiving a wrong answer (as long as you always check the identity of who you are talking to.
I think that, had asymetric crypto been in widespread use before the OSI model came about, this would have been the natural way to do things. Now the problem is unsatisfactorily solved both in DNS (which is not the right solution, as I already explained), and in an ad-hoc way with TLS, in SSH, etc.; but this is still too high in the hierarchy, machines should be addressed with public key fingerprints unless we are concerned about actual routing.
- panic 13y agoWhat happens if the private key is compromised, and you have to switch to a new one? Does the identity of the machine then change too?
- StavrosK 13y agoNecessarily, I would imagine.
- a3_nm 13y agoYes, but with IP addresses your identity changes whenever your connection changes, which is much worse. When using fingerprints, instead, the machine identity stays the same (and conceivably you would just have to ping a decentralized repository of "fingerprints => IP" mappings).
- p4bl0 13y agoI think that's pretty much how the routing works in Tor for Hidden Services and in I2P for EepSites (except that it's mixed with onion routing (Tor) / tunnel routing (I2P) to provide anonymity).
- noselasd 13y agoThe OSI model accounts for that in layer 4. However, the IP based protocols didn't implement that piece, but let the protocols (TCP/UDP etc.) just use the layer 3 addresses instead of having their own layer 4 addresses. I'll try to find some references, but back when TCP was conceived, the idea was to have layer 4 addresses too, but this was dismissed for simplicity.
- rnnr 13y agoThis is the issue with Bitcoin. It's essentially a p2p network, the virtual currency aspect is secondary to this. It will be a major breakthrough if it's proven to be immune to Sybil attacks.
- runeks 13y ago> Hence, why do we connect to IP addresses, rather than connecting to public key hashes? Granted, public key hashes are not routable, but there could be a service to provide the mapping from hashes to addresses [...] As I understand it, this is already an issue with the IP protocol. Here's a Google Tech Talk from 2007 discussing the issue with having both the unique ID and location identifier be a single thing (IP address): https://www.youtube.com/watch?v=QIGSMLrU4Xw https://www.youtube.com/watch?v=QIGSMLrU4Xw and the solution: https://en.wikipedia.org/wiki/Locator/Identifier_Separation_Protocol https://en.wikipedia.org/wiki/Locator/Identifier_Separation_...
- vertex-four 13y agoThere's a few different systems that implement connecting to public key hashes. Most recently, cjdns has had a fair bit of attention, and it's backwards-compatible with IPv6-supporting apps.