Subject: [rrg] Universally unique identifier

From: Toni Stoev <[email-masked]>
Date: Fri, 16 Jul 2010 10:11:51 +0300

A universally unique identifier is needed to let nodes roam everywhere in the common network while preserving their ongoing communication sessions.
To keep identifier unique a system for issuing, distribution and control over it is needed. The system has to provide uniqueness and also be flexible and robust.

There is an acting solution with much the said characteristics. That is the DNS with its FQDN.
The FQDN is by best effort universally unique. And the DNS has proven itself to be surviving and moreover prevailing.
Because of node mobility the Dynamic DNS is the closer match. With this technology a node can change its topological location and retain a same identifier.
But the FQDN is not quite suitable for the hereby projected usage. It is made out of names that are for human use. This not a networking best practice.

So, can we turn the top supported network node identifier system into a useful solution for also session identification supplement? And how?

Yes. By deciphering the N as "number". That's all to it.
A dynamic domain number system can supply the desired network node identifier. The fully qualified domain number will be hierarchically structured, fairly distributed, unique.

Dear fellow researchers, your choice is welcome.

Toni

---

From: Klaas Wierenga <[email-masked]>
Date: Fri, 16 Jul 2010 14:57:06 +0200

On 7/16/10 9:11 AM, Toni Stoev wrote:

Hi Toni,

Interesting idea, however I am not conviced that a hierarchic model is 
desirable to guarantee uniqueness (I do understand the appeal, don't get 
me wrong). What concerns me is the fact that if you take delegation far 
enough you will end up with a very limited set of "N"-s per domain, and 
thus the ability to track users.
Furthermore, I think the requirements for unique identifiers are not the 
same as for domain names. Arguably the delegation of subdomains is meant 
as a way to indicate some sort of subordinate relation, i.e. 
sales.acme.com is the sales department of acme etc. For uniqueness of 
identifiers I see no clear reason why you need a hierarchy, other than 
to avoid collissions.
Don't you think it much easier to just use a method with a very low 
probability of collissions and deal with those?

Klaas

> A universally unique identifier is needed to let nodes roam
> everywhere in the common network while preserving their ongoing
> communication sessions. To keep identifier unique a system for
> issuing, distribution and control over it is needed. The system has
> to provide uniqueness and also be flexible and robust.
>
> There is an acting solution with much the said characteristics. That
> is the DNS with its FQDN. The FQDN is by best effort universally
> unique. And the DNS has proven itself to be surviving and moreover
> prevailing. Because of node mobility the Dynamic DNS is the closer
> match. With this technology a node can change its topological
> location and retain a same identifier. But the FQDN is not quite
> suitable for the hereby projected usage. It is made out of names that
> are for human use. This not a networking best practice.
>
> So, can we turn the top supported network node identifier system into
> a useful solution for also session identification supplement? And
> how?
>
> Yes. By deciphering the N as "number". That's all to it. A dynamic
> domain number system can supply the desired network node identifier.
> The fully qualified domain number will be hierarchically structured,
> fairly distributed, unique.
>
> Toni _______________________________________________ rrg mailing
> list [email-masked] http://www.irtf.org/mailman/listinfo/rrg

---

From: Toni Stoev <[email-masked]>
Date: Fri, 16 Jul 2010 17:29:33 +0300

Hi Klaas,

> thus the ability to track users.

If we don't set unwise limits, like the domain name system doesn't, we have nothing to worry about. The market will regulate spanning.

> identifiers I see no clear reason why you need a hierarchy, other than 

I agree, the reason differs here. Hierachy is a good way to control distribution.

> probability of collissions and deal with those?

With online distribution we have flexiblity. One can change the identifier at will.  

> Klaas

Thanks
Toni

---

From: [email-masked]
Date: Sat, 17 Jul 2010 13:36:16 -0400

Toni,

I think you are pursuing the wrong objective (which is global uniqueness of the identifier).

There are millions of people with the surname Li and yet they aren't a serious problem for the postal services.
IMHO ( I have expressed it many times and did also show how to get it done ) the Internet routing should also  become as smart  so that local uniqueness of any identifier will do.

Remember MADCAP. It was a similar mad idea (RFC2730). It tried to manage a clash-free multicast address assignment - globally. It didn't fly at all.

Heiner 

-----Ursprüngliche Mitteilung----- 
Von: Toni Stoev <[email-masked]>
An: IRTF RRG <[email-masked]>
Verschickt: Fr., 16. Jul. 2010, 16:29
Thema: Re: [rrg] Universally unique identifier

Hi Klaas,

> thus the ability to track users.

If we don't set unwise limits, like the domain name system doesn't, we have 
nothing to worry about. The market will regulate spanning.

> identifiers I see no clear reason why you need a hierarchy, other than 

I agree, the reason differs here. Hierachy is a good way to control 
distribution.

> probability of collissions and deal with those?

With online distribution we have flexiblity. One can change the identifier at 
will.  

Thanks
Toni

> > Dear fellow researchers, your choice is welcome.
_______________________________________________
rrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/rrg

---

From: Chris Campbell <[email-masked]>
Date: Sat, 17 Jul 2010 18:57:28 +0100

The postal service would have issues when delivering confidential mail to Mr. Li if two live at the same address.

Chris Campbell
---------------------
+447796352724

On 17 Jul 2010, at 18:36, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>> wrote:

Toni,

Heiner

-----Ursprüngliche Mitteilung-----
Von: Toni Stoev <[email-masked]<mailto:[email-masked]>>
An: IRTF RRG <[email-masked]<mailto:[email-masked]>>
Verschickt: Fr., 16. Jul. 2010, 16:29
Thema: Re: [rrg] Universally unique identifier

Hi Klaas,

> sales.acme.com<http://sales.acme.com> is the sales department of acme etc. For uniqueness of

Thanks
Toni

_______________________________________________
rrg mailing list
<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>
<http://www.irtf.org/mailman/listinfo/rrg>http://www.irtf.org/mailman/listinfo/rrg

_______________________________________________
rrg mailing list
[email-masked]<mailto:[email-masked]>
http://www.irtf.org/mailman/listinfo/rrg

---

From: Tony Li <[email-masked]>
Date: Sat, 17 Jul 2010 11:21:05 -0700

> The postal service would have issues when delivering confidential mail to Mr. Li if two live at the same address. 

First hand experience says that this is not the case.  ;-)

However, the authentication mechanisms used to confirm identity are questionable.

Tony

---

From: Chris Campbell <[email-masked]>
Date: Sat, 17 Jul 2010 21:07:54 +0100

Maybe my experience with Royal Mail colours my opinion. :)

Chris Campbell
---------------------

---

From: Toni Stoev <[email-masked]>
Date: Sun, 18 Jul 2010 10:37:00 +0300

> I think you are pursuing the wrong objective (which is global uniqueness of the identifier).

Does anyone else think global/universal uniqueness of the identifier is the wrong objective?

> There are millions of people with the surname Li and yet they aren't a serious problem for the postal services.

For each letter sent to Li at a given postal address the sender already knows/expects the right Li is at that address.

> IMHO ( I have expressed it many times and did also show how to get it done ) the Internet routing should also  become as smart  so that local uniqueness of any identifier will do.

So, Heiner, the Internet routing system with its smartness would provide node identity for free roaming and session preservation?

In my opinion the Internet has been successful so far because of IP addressing and the DNS, which are systems that give general uniqueness to nodes/interfaces. And I think these uniqueness systems give consistency to the sum of networks we have.

> Remember MADCAP. It was a similar mad idea (RFC2730). It tried to manage a clash-free multicast address assignment - globally. It didn't fly at all.

I may find the time to read RFC 2730. But would you summarize it here with regard to local/universal uniqeness of identifiers?

> Heiner 

Regards
Toni

---

From: Tony Li <[email-masked]>
Date: Sun, 18 Jul 2010 01:02:25 -0700

> Does anyone else think global/universal uniqueness of the identifier is the wrong objective?

I think that if that is the only acceptable identifier that privacy advocates would have a major issue.

Tony

---

From: Scott Brim <[email-masked]>
Date: Sun, 18 Jul 2010 07:11:17 -0400

> I think that if that is the only acceptable identifier that privacy advocates would have a major issue.

You need universally unique identifiers for anything that wants to
communicate with authentication.  That doesn't mean particular things
need to carry unique identifiers in particular protocols, as long as
whatever is in the relevant protocols can map to them.  Sticking an
identifier in a network protocol header is just one mechanism.

  - When I connect to a network I need to be authenticated but what
    actually has to happen?  If I hand the access network an opaque
    string and the name of my bank, the access network doesn't need to
    know "who" I am, it just needs to know that I can pay for access.
    In that case yes I need a unique identifier but it doesn't have to
    be something I show the access network.  The access network doesn't
    care -- it just needs to use _its_ mechanisms to monitor my usage
    or whatever it wants to bill me for.

  - When I connect to you, "Tony" or "Toni", I need to verify who I am,
    and maintain a mapping between that identity and my packets, but
    what needs to be in packets?  After initial authentication (in
    which my unique identifier can be payload, not necessarily in a
    packet header), perhaps the packets only need to point to a
    security association.

So ... yes you need unique identifiers -- many of them at many layers --
but AA functions do not need to have an identifier thrown at them again
and again, all they really need is for packets to have something that
uniquely maps to that unique identifier at a particular time in their
particular scope.

---

From: Klaas Wierenga <[email-masked]>
Date: Sun, 18 Jul 2010 16:02:40 +0200

Sent from my iPad

> I think that if that is the only acceptable identifier that privacy advocates would have a major issue.

Unless it is easy to change it (but I don't see how you can do that without a >0 chance of collisions)

Klaas

---

From: "Joel M. Halpern" <[email-masked]>
Date: Sun, 18 Jul 2010 12:49:07 -0400

For some systems, being able to craft unique identifiers is helpful.
For some of those systems, mandating and attempting to guarantee that 
uniqueness is also helpful.
For other systems, it is not necessary.

And when it is needed, there are multiple possible ways to craft such 
things.  Any technique wew use has some risk of failure.  The risks are 
in different places.  (Vendor manufacturing, allocator error, ...)

It is not the case that we need to define one such mechanism, and 
mandate that it be used by all solutions.  The overall problem space is 
constrained in many ways, and is mult-dimensional.  It is fair to 
criticise a solution if it requires a specific property and then 
provides mechanisms which do not sufficiently ensure that property.  But 
the proposed solution gets to pick the mechanism, define the degree of 
confidence required for the system to work, and then put forward an 
answer.

Domain names are sometimes a useful answer.  For example, they are 
propsoed for the name based socket work.  They have been discussed in 
other contexts at times.  They have benefits, and costs.

Yours,
Joel M. Halpern

> Does anyone else think global/universal uniqueness of the identifier is the wrong objective?
...

---

From: Tony Li <[email-masked]>
Date: Sun, 18 Jul 2010 10:28:05 -0700

> uniquely maps to that unique identifier at a particular time in their

Fair points all.  Allow me to modify and restate:

I think that a fixed, unchangeable, global identifier that is exposed in any way is a privacy issue.

Users need a way to be wholly anonymous to the network.  They should be able to (privately) arrange their access connectivity and then be able to access the network without concerns that they can be identified based on their link layer or network layer information.

I have no problems with a cryptographic private key being used as a globally unique identifier, as long as users have the ability to have multiple keys.  Certainly someone who wants to be anonymous can generate a temporary key.

Tony

---

From: Toni Stoev <[email-masked]>
Date: Mon, 19 Jul 2010 09:55:52 +0300

> Users need a way to be wholly anonymous to the network.  They should be able to (privately) arrange their access connectivity and then be able to access the network without concerns that they can b…

How about using a temporary fully qualified domain number each time they choose to roam? Nodes would obtain one on demand by a publicly available dynamic domain number service.

---

From: Javier Ubillos <[email-masked]>
Date: Tue, 20 Jul 2010 11:36:56 +0200

> How about using a temporary fully qualified domain number each time they choose to roam? Nodes would obtain one on demand by a publicly available dynamic domain number service.

Are you referring to a service like dyndns and no-ip? Where you register
an arbitrary sub-domain name to their service and continually update the
IP?

E.g. javier.dynamic-dns.org  ->  IN A 193.10.64.51

Does any one know how well/badly this could scale?
I've had thoughts along this path my self, where each host at will can
register an arbitrary "throw-away" sub-domain.

To whom should one be anonymous to?
Which turnover would people require on these identifiers?

E.g. would it be sufficient if each ISP provides the service to its
customers, and that the change rate corresponds more or less to the rate
of IP changes (dhcp). Which could mean anything from never to a few
times per day.

In the case where the local ISP provides the service, I can't see why
this wouldn't be a great idea, if the ISP can provide IP's, it should
also be able to provide a few sub-domain names.

In the case where the service would be provided by random sites on the
Internet, well, it is already provided for free today, but I don't know
how it would scale (or how a business model would work) if all hosts
start registering names automatically.

// Javier

---

From: Toni Stoev <[email-masked]>
Date: Tue, 20 Jul 2010 14:35:21 +0300

> E.g. javier.dynamic-dns.org  ->  IN A 193.10.64.51

Yes, Javier. This is a good example.

> Does any one know how well/badly this could scale?

Since there isn't much special about numbers, this would scale even better than with names.

> register an arbitrary "throw-away" sub-domain.

And after throwing it away, it can be reused right away.

> To whom should one be anonymous to?

Very accurate question. I would like to read answers.

> Which turnover would people require on these identifiers?

Putting identifiers into TCP sockets for mobility/multihoming.

> of IP changes (dhcp). Which could mean anything from never to a few

Reasonable behavior.

> also be able to provide a few sub-domain names.

Yes, that's right. If the ISP is a mobile operator it would supply its customers with identifiers for roaming among access points.

> start registering names automatically.

Many non-mobile service ISPs employ Dynamic DNS too.
For inter-ISP roaming random/devoted sites are the solution.
The model is quite analogous to the one with names.

> // Javier

Best regards, Javier
Toni