Subject: Re: [arch-d] On identifiers: what is virtual and what is global (wasRe: thou...

From: [email-masked]
Date: Fri, 24 Nov 2006 05:39:44 EST

Quote from below:Fundamentally one can not "locate" without  "identifying."
But also: Pure identifying does not help either. Try to send a letter to  
somebody just by writing his passport number on the envelope.
In the realm of ITU-T you would use address (locator) plus  
sub-address(identifier).
Heiner
 
In einer eMail vom 24.11.2006 05:51:05 Westeuropäische Normalzeit schreibt  
[email-masked]:

At 20:23  -0800 2006/11/23, David Conrad wrote:
>Jim,
>
>On Nov 23,  2006, at 7:04 PM, Bound, Jim wrote:
>>>>If a user changes his  ISP then he would get a different address anyway!
>>>This is what  we're trying to avoid.
>>I don't think this can be avoided nor can it  be assumed.
>
>Separating identity from location via indirection  would allow us to 
>avoid folks having to renumber when they change  providers and thus 
>allowing locators to be highly  aggregated.
>
>>If the address
>>prefix used by the  ISP is different a node should use it and this also
>>has mobility  implications per the use cases I sent.
>
>The whole point of this  discussion is that the term "address" as it 
>is used today implies the  concepts of identity and location are 
>merged.  "Addresses" as  they are used today simply will not scale.  
>Period.  Since I  do not believe we have the luxury of coming up with 
>and deploying  IPv7, we have to backfit the separation of identity 
>from location into  IPv6.

We had that opportunity 14 years ago and decided to stick with  what 
doesn't work.

Fundamentally one can not "locate" without  "identifying."  This is 
why this whole loc/id discussion has been  such a red herring. 
Addresses as they are used today are being used in  half an addressing 
architecture which is why they don't scale, not because  they are 
addresses.

>>What should not change is the  identifier.
>
>Exactly.  To bad identity and location is the  same thing in IPv4 and IPv6.

Only because you don't have a complete  addressing architecture.  If 
it was complete, you would all of the  names whether addresses, names 
or identifiers, would do what they need to  do quite well.

>
>>Thus here we may disagree.  The  complexity
>>for routing for performance reasons will not scale ever  in my view.
>
>As I'm sure you are aware, aggregation allows  hiding of information 
>thereby allowing for greater scalability.   As long as identity and 
>location are tied, the only way you can  aggregate is by forcing 
>identity to change when location changes.  Since changing identity is 
>hard, people don't do it and thus,  scalability goes out the window. 
>This does not have to be the  case.

All of these arguments are an artifact of the current approach  not 
universally the case.

Perhaps we should figure out what does  work and then worry about how 
we get there.  Rather worry about how  to fix what we have with no 
clear idea of where we need to go.

Take  care,
John

_______________________________________________
Architecture-discuss  mailing  list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss

---

From: John Day <[email-masked]>
Date: Fri, 24 Nov 2006 07:43:11 -0500

At 5:39 -0500 2006/11/24, [email-masked] wrote:
>But also: Pure identifying does not help either. Try to send a 
>letter to somebody just by writing his passport number on the 
>envelope.

Actually you can.  For all intents and purposes, this is what an IP 
address was pre-CIDR, a name.

>In the realm of ITU-T you would use address (locator) plus 

The next thing to understand is why one should not use elements of a 
lower layer address as elements of a higher layer address.

Take care,
John

---

From: "Bound, Jim" <[email-masked]>
Date: Fri, 24 Nov 2006 08:12:21 -0500

Interesting.  sub-address-identifier.   makes me wonder should we use a different term than identifier for that which does this and identifier for end--to-end above IP and routing?
 
/jim

________________________________

	From: [email-masked] [mailto:[email-masked]] 
	Sent: Friday, November 24, 2006 5:40 AM
	To: [email-masked]; [email-masked]; Bound, Jim
	Cc: [email-masked]
	Subject: Re: [arch-d] On identifiers: what is virtual and what is global (wasRe: thou...

	Quote from below:Fundamentally one can not "locate" without "identifying."
	But also: Pure identifying does not help either. Try to send a letter to somebody just by writing his passport number on the envelope.
	In the realm of ITU-T you would use address (locator) plus sub-address(identifier).
	Heiner
	 
	In einer eMail vom 24.11.2006 05:51:05 Westeuropäische Normalzeit schreibt [email-masked]:

		

		

		
		Take care,
		John

---

From: David Barak <[email-masked]>
Date: Fri, 24 Nov 2006 07:06:59 -0800 (PST)

> address was pre-CIDR, a name.

I don't understand - are you saying that knowledge of
a unique identifier automatically provides locational
information about that identifier?

In the realm of the real, neither a passport number
nor a US SSN (both of which uniquely identify humans)
provide any useful locational information about the
humans who are identified thereby.  It is possible to
derive some locational information (i.e. person gets
job, uses SSN, that gets communicated to credit
companies, ask them what city s/he's in) - but that is
indirect, coarse, and often quite wrong (my job's in
DC, but I'm in Albuquerque).

And just to be clear, it is absolutely possible to
locate 8199 parkway drive NW in New Mexico without
having the foggiest idea what is there.  I could
develop algorithms which provide me the optimum route
to reach that location without knowing anything about
why I'm going or what's there.

So location is a prerequisite of identification, not
the other way around.

> lower layer address as elements of a higher layer

That was always one of my pet peeves with the IPv6
implementation of autoconf.

-David

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com

____________________________________________________________________________________
Do you Yahoo!?
Everyone is raving about the all-new Yahoo! Mail beta.
http://new.mail.yahoo.com

---

From: "Bound, Jim" <[email-masked]>
Date: Fri, 24 Nov 2006 10:52:06 -0500

agree but think identification have many locations.  also identification
while we are here is important for nothing that has to do with location.
If we can figure out identification transparent to location we can
change how the SPI is determined/calculated/etc for IPsec not using
location at all.  

/jim 

> -----Original Message-----
> From: David Barak [mailto:[email-masked]] 
> Sent: Friday, November 24, 2006 10:07 AM
> To: [email-masked]
> Subject: Re: [arch-d] On identifiers: what is virtual and 
> what is global(wasRe: thou...
> 
> 
> I don't understand - are you saying that knowledge of a 
> unique identifier automatically provides locational 
> In the realm of the real, neither a passport number nor a US 
> SSN (both of which uniquely identify humans) provide any 
> useful locational information about the humans who are 
> identified thereby.  It is possible to derive some locational 
> information (i.e. person gets job, uses SSN, that gets 
> communicated to credit companies, ask them what city s/he's 
> in) - but that is indirect, coarse, and often quite wrong (my 
> job's in DC, but I'm in Albuquerque).
> 
> And just to be clear, it is absolutely possible to locate 
> 8199 parkway drive NW in New Mexico without having the 
> foggiest idea what is there.  I could develop algorithms 
> which provide me the optimum route to reach that location 
> without knowing anything about why I'm going or what's there.
> 
> So location is a prerequisite of identification, not the 
> other way around.
> 
> 
> >

---

From: John Day <[email-masked]>
Date: Fri, 24 Nov 2006 11:00:31 -0500

Just to totally confuse, my own investigations of this have indicated 
that for very large systems of identification, identification systems 
become systems of locating although it is locating in a context which 
is non-spatial.  (Think about a thesaurus or a dictionary.)

Take care,
John

---

From: "Tony Li" <[email-masked]>
Date: Fri, 24 Nov 2006 11:46:41 -0800

> is non-spatial.  (Think about a thesaurus or a dictionary.)

You're right, that's confusing.  ;-)

I think it would be safer to say that systems of identifiers are
necessarily structured.  At the very least, administration of a large
flat unstructured name space doesn't scale.

Tony

---

From: John Day <[email-masked]>
Date: Fri, 24 Nov 2006 14:50:09 -0500

>flat unstructured name space doesn't scale.

Indeed. But even here concepts of distance and locality may have 
meaning in the strict sense of a topology.  I believe this is more in 
the direction that the semantic web is trying to pursue and others 
have in the past with variously named structures such as entailment 
diagrams, etc.

Take care,
John

---

From: Peter Sherbin <[email-masked]>
Date: Fri, 24 Nov 2006 13:26:21 -0800 (PST)

So location is a prerequisite of identification

What is "location" - geography, topology, virtual?

Thanks,

Peter

> http://new.mail.yahoo.com

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

---

From: Peter Sherbin <[email-masked]>
Date: Fri, 24 Nov 2006 13:40:52 -0800 (PST)

> necessarily structured.

I can identify a taste of a beer from a running rabbit. In both cases all info
neurons get is sequences of elctromagnetic pulses.

>  At the very least, administration of a large

Will Social Security office ever run out of numbers?

Thanks,

Peter

 
____________________________________________________________________________________
Yahoo! Music Unlimited
Access over 1 million songs.
http://music.yahoo.com/unlimited

---

From: John Day <[email-masked]>
Date: Fri, 24 Nov 2006 16:47:55 -0500

>Will Social Security office ever run out of numbers?

Yes, and it isn't a flat space.

---

From: Jefsey_Morfin <[email-masked]>
Date: Fri, 24 Nov 2006 20:03:27 +0100

At 17:00 24/11/2006, John Day wrote:
>Just to totally confuse, my own investigations of this have 
>indicated that for very large systems of identification, 
>identification systems become systems of locating although it is 
>locating in a context which is non-spatial.  (Think about a 
>thesaurus or a dictionary.)

I tried to synthesise, in my own way, a consistent summary which 
simultaneously addresses the different (often opposite) requirements 
documented. This seems interesting as its seems to scale whatever the 
nature of the considered networking: physical, logical, intellectual.

Considering that exchanged content is shipped in containers
- an IP address is a topology plane related information sub-container.
- a name is an application plane related information sub-container
- an identity is a user/user_agent plane related information sub-container.

They permit to uncouple the informations in those sub-containers. One 
can resolve one into the other(s) through any process agreed by the 
two or more ends participating to an exchange, or imposed by one of them.

An authentication is a verification of the consistence of the content 
of these sub-containers.

The information they contain may result from one or several 
registries, represent any concept, be organised in any order, support 
any type of additional function, such as authentication, encrypting, 
location, extensions, etc., as long as they include the appropriate 
information in the appropriate order and format to permit to compute 
the required hop/end to hop/end routing, along with the algorithm and 
parameters agreed by the end or imposed by some of them.

Depending on the size (local, wide, very wide, very very wide), 
nature (centralised, decentralised, distributed), constraints (new, 
transition from, addition to a deployed system) different 
technologies can be exclusively, successively or complementary used 
to determine, compute, and follow the resulting route. The resulting 
Route (list of transited nodes and ends) can be stored in the nodes, 
sent to them in a route routing information container, or locally 
dynamically computed. Nodes can be physical, logical, or intellectual 
depending if the process is at data, information, or knowledge layer.

Tranmission protocols are orthogonal but they probably should carry 
all the sub-containers information or a pointer in each fragment 
being transmitted.

Very wide decentralised systems must constrain their options not to 
be strangled by complexity. This is probably not enough for very very 
wide systems which must be designed along a different paradigm. This 
paradigm seems to be granular distribution, where specialised smart 
standalone cells (to avoid the word node) only react to the 
information container, and to the part to the carried information 
they are interested in.

As experimented in the DNS model this distributed paradigm permits to 
seamlessly replace complex centralised/decentralised systems (like 
Host.txt) by a multiplicity of much simpler elements.

Most difficult issue: many users tend to confuse the address, name, 
identity, route sub-containers with (a part of) their content.
jfc

---

From: David Conrad <[email-masked]>
Date: Sat, 25 Nov 2006 21:37:37 -0800

Heiner,

On Nov 24, 2006, at 2:39 AM, [email-masked] wrote:
> Quote from below: Fundamentally one can not "locate" without  
> "identifying."

True.  However, the vast majority of users (and applications) care  
about the inverse.  One _can_ identify without knowing location: we  
do it every day.

> But also: Pure identifying does not help either.

Sure it can.  Flat routing works very well.  It just doesn't scale  
very well.

> In the realm of ITU-T you would use address (locator) plus sub- 

I don't think anyone is suggesting separation of identity from  
location is a new idea.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Sat, 25 Nov 2006 21:37:37 -0800

Heiner,

Rgds,
-drc

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 27 Nov 2006 08:30:54 +0100

David Conrad wrote:
...
> Since a primary goal (at least of enterprise network folks) is to be  
> able to change providers,

I think that understates it.

- ability to use multiple simultaneous providers
- ability to add and drop providers
- ability to have multiple points of attachment
- both while preserving business continuity

> the easiest (at least from my perspective)  
> way of implementing this is to have uniqueness within all possible  
> providers, that is, global uniqueness for identifiers used for the  
> enterprise.

It may be the easiest from the PoV of the enterprise, but it certainly
isn't the easiest from the PoV of the service providers, which is why we
are having this conversation, I think.

     Brian

---

From: Pekka Nikander <[email-masked]>
Date: Mon, 27 Nov 2006 11:08:05 +0200

John Day once wot:
>>> indicated

On Nov 24, 2006, at 21:50, John Day wrote:
> meaning in the strict sense of a topology.  I believe this is more  
> in the direction that the semantic web is trying to pursue and  
> others have in the past with variously named structures such as  
> entailment diagrams, etc.

But doesn't the recent work on distributed hash tables (DHTs)  
indicate that you can make a flat identifier space of any size to  
scale roughly O(log n)?

For example, we estimated that for storing reasonably dynamic  
information about 10^7 mobile nodes, each o f them changing its  
location every few minutes, requires under certain architectural  
assumptions in the order of a few hundreds of servers, resulting in  
look-up times in the order of 1-2 seconds.  [Andrei Gurtov, Dmitry  
Korzun, Pekka Nikander, "Hi3: An Efficient and Secure Networking  
Architecture for Mobile Hosts," Technical report 2005-2, Helsinki  
Institute for Information Technology, June 2005]

Hence, my tentative conclusions are that for a very large flat name  
space, you need

- enough of bits in the identifier, in order to make the probability  
of random collisions considerably smaller than the probability of  
double-assignment due to human errors.  256 bits seems to be enough  
(assuming an order of 10^10 nodes or so).

- good enough random number generators

- some genuine randomness (entropy) during identifier generation  
time, e.g., current time down to millisecond

- an DHT-like infrastructure to store and look up data associated  
with the identifiers

For the infrastructure, a few hundred or at most a few thousand nodes  
seems to suffice, giving a reasonable look-up time and enough of  
redundancy, and keeping the capacity requirements of each  
infrastructure node small enough.

So, what I am missing?  Why do identifier systems necessarily need to  
be structured?

--Pekka Nikander

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 27 Nov 2006 11:43:42 +0100

...
> - enough of bits in the identifier, in order to make the probability  of 
> random collisions considerably smaller than the probability of  
> double-assignment due to human errors.  

Surely the risk you need to evaluate is the probability of double
assignment due to random loss of messages in a distributed
assignment system?

...
> So, what I am missing?  Why do identifier systems necessarily need to  

That depends whether "look-up times in the order of 1-2 seconds"
are considered sufficient. If, for example, that is 6 orders of
magnitude too long, you'd have a problem.

     Brian

---

From: Scott W Brim <[email-masked]>
Date: Mon, 27 Nov 2006 09:35:33 -0500

> flat unstructured name space doesn't scale.

... but the structure in the "identifier" space does not need to be
the same as in the address space.  Just because structure is useful in
both does not mean the structure has to be interdependent.

---

From: "Tony Li" <[email-masked]>
Date: Mon, 27 Nov 2006 08:21:43 -0800

> both does not mean the structure has to be interdependent.  

In fact, creating any kind of interdependence in the structures would
suggest that we've allowed semantic overload to creep in again.

Tony

---

From: John Day <[email-masked]>
Date: Mon, 27 Nov 2006 11:24:04 -0500

Very much agree.

---

From: Geoff Huston <[email-masked]>
Date: Tue, 28 Nov 2006 05:12:25 +1100

>both does not mean the structure has to be interdependent.

agreed - the structure in the identifier space is one that should be 
capable of supporting a "mapping" function to provide one (or 
possibly more) viable locators du jour.

---

From: David Meyer <[email-masked]>
Date: Mon, 27 Nov 2006 11:11:54 -0800

> >both does not mean the structure has to be interdependent.

	Exactly, and in many cases, the "incongruence" is by
	design (for any number of reasons).

> possibly more) viable locators du jour.

	Yep.

	--dmm

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 28 Nov 2006 13:27:52 +0200

>> Hence, my tentative conclusions are that for a very large flat  
>> name  space, you need
>> - enough of bits in the identifier, in order to make the  
>> probability  of random collisions considerably smaller than the  
>> probability of  double-assignment due to human errors.
>

Thanks, I missed that!  Fool me still thinking that the system would  
be reliable...

>> So, what I am missing?  Why do identifier systems necessarily need  
>> to  be structured?
>

Yes.  :-)

Flat identifier spaces do not seem to be very suitable for large- 
scale routing.  IIRC, the ROFL paper had some numbers.  Checking...   
Yes, from "Summary of results": "host can join across all providers  
and peers ... with ∼445 control messages.  An average [routing]  
stretch of 2.5. .... [Possible to] reduce [host] join overhead to  
∼100 messages, but requires 74 Mbits of bloom filter state per AS."

 From that, the stretch of 2.5 seems pretty bad.  I don't have any  
numbers for the stretch in the current system, though.  (stretch =  
the ratio between the traversed path and the shortest path.)

--Pekka Nikander

---

From: David Conrad <[email-masked]>
Date: Tue, 28 Nov 2006 00:34:48 -0800

Brian,

On Nov 26, 2006, at 11:30 PM, Brian E Carpenter wrote:
> David Conrad wrote:
>> Since a primary goal (at least of enterprise network folks) is to  
>> be  able to change providers,
>

Yes, as I said, "a" not "the".

Yep.

> [global uniqueness of identifiers] may be the easiest from the PoV  
> of the enterprise, but it certainly isn't the easiest from the PoV  
> of the service providers, which is why we are having this  
> conversation, I think.

Wouldn't this would argue for NAT?

I believe we want uniqueness in the identifier space sufficient to  
cover all sources and destinations who may want to communicate in an  
end-to-end fashion (although saying "globally unique" is easier).

Rgds,
-drc

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 28 Nov 2006 17:46:51 +0100

David Conrad wrote:
...
>> [global uniqueness of identifiers] may be the easiest from the PoV  of 
>> the enterprise, but it certainly isn't the easiest from the PoV  of 
>> the service providers, which is why we are having this  conversation, 
>> I think.
> 
> 

That's a juicy worm, let me see if I can avoid the hook
buried in it ;-)

IMHO, it argues for some way of separating the usage of address prefixes
to identify sites from their usage for wide-area routing. But (as you say
below) there is also the architectural need for e2e identifiers. What
map-and-encap, shim6 and GSE have in common is that they attempt to
meet all of those needs simultaneously. NAT doesn't get the e2e one.

> end-to-end fashion (although saying "globally unique" is easier).

Yep
    Brian