3 ms·

What do you mean by perfect authentication? We're talking about referring to Telehash's approach as "ubiquitous encryption" with "self-consistent authenticatio

What do you mean by perfect authentication? We're talking about referring to Telehash's approach as "ubiquitous encryption" with "self-consistent authentication" but nobody seems to agree on what authenticating an identity means in the first place. Pinning encryption to addressing solves those problems at a lower layer, and leaves phishing attacks to be solved separately. I don't know that anything I'd call "perfect authentication" can be solved within the X.509 framework.

chetanahuja 13y ago
Could you elaborate what you mean by "pinning encryption to addressing"? Do you mean DNSSEC? Doesn't that suffer from the same third party trust problem as any other PKI based system?
- dvanduzer 13y ago
  Public key cryptography doesn't require X.509's third party trust model, but as the author of the article points out, PGP key exchange is not quite as simple as just trusting the CAs your browser vendor decided you should trust. Telehash is taking an approach that completely sidesteps the problem of human-memorable names, though. It uses the public key fingerprint as the "network address" of a node in a DHT. The Telehash address is globally routable, like an IP address, but there is no MITM possible, because only a node with the private key generating the address (fingerprint) can communicate at all using that address. There is still the problem that humans don't want to type in an IP address, let alone remember something unwieldy as 9ba9c175c3c26af9df5c8163ea91d4ae4eca59ba95d66deb287c89ea0c596979. But deciding whether to trust that key is distinct from verifying data is signed with the same fingerprint.
  - derefr 13y ago
    For a simpler model, if you don't want to wade into consistent hashing and DHTs, there's also IPv6 Cryptographically-Generated Addresses[1]. [1] http://en.wikipedia.org/wiki/Cryptographically_Generated_Address http://en.wikipedia.org/wiki/Cryptographically_Generated_Add...

chetanahuja 13y ago

Could you elaborate what you mean by "pinning encryption to addressing"? Do you mean DNSSEC? Doesn't that suffer from the same third party trust problem as any other PKI based system?

dvanduzer 13y ago
Public key cryptography doesn't require X.509's third party trust model, but as the author of the article points out, PGP key exchange is not quite as simple as just trusting the CAs your browser vendor decided you should trust. Telehash is taking an approach that completely sidesteps the problem of human-memorable names, though. It uses the public key fingerprint as the "network address" of a node in a DHT. The Telehash address is globally routable, like an IP address, but there is no MITM possible, because only a node with the private key generating the address (fingerprint) can communicate at all using that address. There is still the problem that humans don't want to type in an IP address, let alone remember something unwieldy as 9ba9c175c3c26af9df5c8163ea91d4ae4eca59ba95d66deb287c89ea0c596979. But deciding whether to trust that key is distinct from verifying data is signed with the same fingerprint.
- derefr 13y ago
  For a simpler model, if you don't want to wade into consistent hashing and DHTs, there's also IPv6 Cryptographically-Generated Addresses[1]. [1] http://en.wikipedia.org/wiki/Cryptographically_Generated_Address http://en.wikipedia.org/wiki/Cryptographically_Generated_Add...