Subject: Re: A different architecture

From: Elliott Ginsburg <[email-masked]>
Date: Tue, 03 Nov 1998 08:00:45 -0500

I think it was on this thread that someone stated that 'we would never have
a global distributed directory'. But we already have one (DNS), so why is
it inconceivable that we would have another? I don't advocate stretching
DNS for this prupose, but it does suggest that we can create global
directories. Am I missing something here?

Elliott Ginsburg

---

From: Bill Burr <[email-masked]>
Date: Mon, 02 Nov 1998 10:30:55 -0500

Elliot,

But DNS is a rather specialized sort of directory.  I don't know that it
follows that, because we can build a very specialized global DNS service,
that proves it is practical to build a very general global X.500 directory
service.  Nor does the success of DNS establish that the specific X.500
standard itself is workable on a global scale, or even a local scale.  It
doesn't make a business case for creating a global X.500 PKI directory,even
if we have X.500 directory products that could do the job. It may be that
we should take the contrary lesson: that to be successful, a global service
must be lean and mean and focused, rather than grand and all encompassing.

I don't have any certain answers here.  What bothers me as much as anything
is that PKI seems now to bear the main burden of the X.500 directory.  An
X.509 PKI would be relatively straightforward if there were an in-being
pervasive X.500 directory service, but is PKI a sufficient application to
drive the creation of a global X.500 directory service?  If the main reason
we are building a global X.500 directory service is PKI, maybe there are
simpler solutions.  Perhaps piggybacking on DNS, as Phill suggests, would
be one.

Another somewhat distressing thing is that, while directories seem to be
becoming central to distributed applications, and network operating
systems, they don't seem to be X.500 directories.  Netscape, Microsoft
(with NT 5.0) and Novell all seem to be relying on directories to glue
things together effectively, and hold configuration information.  But I
don't believe that any of them are X.500 directories.  So, in the real
world, most of us are going to have a directory of some sort, but it isn't
necessarily going to be an X.500 directory.  And it isn't obvious how we're
going to chain them all together, or even that we want to.

What does seem to be constant I think, even for "proper X.500" directories,
is some flavor (but which flavor?) of LDAP access.  

It isn't obvious that you want to let outsiders into the Active X
directory, or NDS directory that is near the core of your own system.
Maybe we need separate "border directories" and maybe those could be X.500
directories, all chained together.  But do we then have to maintain two
kinds of directory products, one internal and one external?  And how do we
manage the shadowing of the internal directory by the external directory?
Maybe we can manage this for DoD, or most of the Federal government, but
will the rest of the world go this way?

Another point: the apparatus for X.500 distinguished name assignment and
management, does apparently exist, but it seems to be expensive and few
folks actually seem to know how to get a DN, or to have done it.  Managing
a consistent global DIT for the Federal Gov. seems possible if not trivial,
but can we expand that to the country or the world?  It may be primitive,
in some ways, but the DNS management does exist (although I guess it's
changing a bit), it's cheap to get a domain name, practically any ISP will
do it for you, and even I know how to get one this afternoon, if I want to.

Perhaps the best thing about Phill's proposal, as I understand it, is that
it doesn't really seem to demand or ask anything of the DNS that it isn't
already doing, and it seems like that extra load on the DNS would be very
small.

Maybe the worst thing is accepting Internet domain names as the foundation
of PKI naming.  But perhaps that's also a good thing, in that it is bowing
to reality: on the Internet it is domain names that matter.

Regards,

Bill Burr

---

From: Elliott Ginsburg <[email-masked]>
Date: Tue, 03 Nov 1998 12:19:04 -0500

I did not advocate an X.500 directory, only that we are capable of creating
and administering a global directory space. I myself am looking at various
technologies. DNS is a great model for what can be done and for the value
of a global directory, but it may or not be overloading DNS to expect it to
take on another directory task. 

As far as DNs for naming, its too big a subject for me to tackle at this
time. Suffice it to say that I personally want my personal identity, based
upon which all kinds of conclusions will be drawn, to be as meaningful a
representation as possible, and not bound to domain naming constraints and
mnemonic email addresses.

Elliott

---

From: Stephen Kent <[email-masked]>
Date: Wed, 4 Nov 1998 18:17:39 -0500

Elliott,

>directories. Am I missing something here?

DNS is very simple compared to an X.500 or LDAP directory system, and thus
people do question whether thye Internet will succeed in building a
parallel directory structure of this latter sort.  That doesn't mean it
won't happen, but it is by no means certain.

Steve

---

From: Al Arsenault <[email-masked]>
Date: Fri, 06 Nov 1998 07:56:41 -0500

Well, as the "loudmouth" who started this, let me quickly clarify.  What I
actually wrote was:

"There is not, and will not ever be, a single, unified, global directory where
everything has 
a name that fits into the schema. There are instead "directories" of 
information that apply to a specific "domain"." 

I was responding to previous comments about the X.500 notion of everything
(specific examples cited were toll plazas, toll booth operators, etc.) having a
name that fits into a single global structure - much different from the
(relatively simple) idea of assigning domain names to things that connect to
the Internet.

The DNS is an example of a directory of information that applies to a specific
"domain".  (Yes, I realize that my use of the term 'domain' in the original
post was unfortunate - I'm now overloading the word.  Hopefully, the meaning is
clear from context.)  This is what we meant in Section 5.1.2 of the Roadmap
document, which says:
5.1.2 Scope of Names

The original X.500 work presumed that every subject in the world wouldhave a
globally-unique distinguished name. Thus, every subject could be easily
located, and there would never be a conflict. All that would be needed is a
sufficiently-large name space, and rules for constructing names based on
subordination and location.

Obviously, that is not practical in the real world, for a variety of reasons.
There is no single entity in the world trusted by everybody to reside at the
top of the name space, and there is no way to enforce uniqueness on names for
all entities. (These were among the reasons for the failure of PEM to be widely
implemented.)

This does not mean, however, that a name-based PKI cannot work. It is important
to recognize that the scope of names in PKIX is local; they need to be defined
and unique only within their own domain. 

Suppose for example that a rootCA is established with DN "O=IETF, OU=PKIX,
CN=PKIX_CA". That CA will then issue certificates for names subordinate to it.
The only requirement - and this can be enforced procedurally - is that no two
distinct entities beneath this rootCA have the same name. We can't prevent
somebody else in the world from creating her own CA, called "O=IETF, OU=PKIX,
CN=PKIX_CA", and it is not necessary to do so. Within the domain of the
original rootCA, there will be no conflict, and the fact that there is another
CA of the same name in some other domain is irrelevant.

This is analogous to the current DNS or IP address situations. On the Internet,
there is only one node called www.ietf.org. The fact that there might be 10
different intranets, each with a host given the DNS name www.ieft.org, is
irrelevant and causes no interoperability problems- those are different
domains. However, if there were to be another node on the Internet with domain
name www.ietf.org, then there would be a problem due to name duplication.

The same applies for IP addresses. As long as only one node on the Internet
responds to the IP address 130.85.1.3, there is no problem, despite the fact
that there are 100 different corporate Intranets, each using that same IP
address. However, if two different nodes on the Internet each responded to the
IP address 130.85.1.3, there would be a problem.

Since Bill Burr did an excellent job of answering the original post, I'll add
that I agree with Bill, and let it go at that.

(Request:  any other comments on the Roadmap - on the above section or any
other part of the document - would be appreciated.)

                        Al Arsenault

--  these are my opinions only. They do not necessarily reflect the 
opinions of my employer, or of any other organization with which I have a 
relationship.

>directories. Am I missing something here?

-- these are my opinions only. They do not necessarily reflect the 
opinions of my employer, or of any other organization with which I have a 
relationship.