Subject: [p2p-sip] FYI: I-D regarding decentralized identity infrastructure based on ENUM

From: alexander.mayrhofer at enum.at (Alexander Mayrhofer)
Date: Tue, 28 Feb 2006 11:30:47 +0100

Hi,

i've recently submitted a draft which describes an approach to use ENUM as a
distributed/decentralized identity architecture:

http://www.ietf.org/internet-drafts/draft-mayrhofer-enum-domainkeys-00.txt

Abstract:

   This document creates a decentralized indentity infrastructure by
   combining technology from E.164 Number Mapping (ENUM) and DomainKeys
   Identified Mail (DKIM).  This infrastructure uses E.164 numbers as
   identities, ENUM DNS for key distribution, and leverages the trust
   relations from ENUM validation to actual messages signed by the
   number holder.

This is currently supposed to "document the basic idea", not a perfect
protocol. Since one of the potential use cases is P2P communication i'd
appreciate any feedback about this document.

I'm not sure if i can attend the friday afternoon p2psip session, but if
there is demand, i'd provide a few slides about the concept anyways (I'll
present it in the ENUM WG anyways).

cheers

alex

---

From: kns10 at cs.columbia.edu (Kundan Singh)
Date: Tue, 28 Feb 2006 15:46:31 -0500

Hi Alex,

Based on a quick read, I understand (correct me if I am wrong) that
you propose to use E.164 identifiers instead of user at domain because:
- it can be validated that the owner of this DNS record is the right 
person who owns the telephone number.
- friends already know the phone number, so can use that to contact you 
in p2p.

This has a problem: phone numbers are too rigid and tied to a physical 
port/line. Users may get E.164 number but what about entities like 
virtual user identifiers or devices (e.g., sip:lamp at cs.columbia.edu 
belongs to an electric x10 controlled lamp in our lab).

Phone numbers are hard to remember and hence most users will need 
address book entry anyway. Thus it doesn't make much difference whether 
phone number, or email address (SIP URI) is used when you know the 
remote's public key, I think.

So the real problem is the distribution of public key for the user 
identifier (which can be user at domain or phone number).

One option could be to allow only self certifying identifiers in the p2p 
network and let users maintain the pet names individually and 
independently (or verify using any means such as your draft or trusted 
CA which attaches SIP URI to email address). Thus everything in your 
draft will work as it is, except that instead of E.164 identifier it 
will be SHA1(user's-public-key), and instead of ENUM it will be a DNS 
name of form 7A.5C....54.sha1.scid.arpa, where (7A5C...54) is 
SHA1(public-key). An automated program can update the DNS entry for any 
user by interacting with the user and making sure that the user has the 
corresponding public key. The interaction could be on email for example, 
or on VoiceXML dialog if verifying by phone.

But I don't think there is much difference between this approach and the 
one that uses user certificates from some well known CA (certifying 
authority).

Minor comments:
In section 3.1: 'However, a centralized...still required' => can you 
give an example? Similarly, 'credential verification by a central 
component' is not true in P2P, e.g., in certificate based verifications 
each client can do the verification without contacting the CA every time.

Alexander Mayrhofer wrote:
> _______________________________________________
> p2p-sip mailing list
> p2p-sip at cs.columbia.edu
> https://lists.cs.columbia.edu/cucslists/listinfo/p2p-sip