Skip to Content.
Sympa Menu

bluesky - Re: the three-services model

bluesky AT lists.ibiblio.org

Subject: Global-Scale Distributed Storage Systems

List archive

Chronological Thread  
  • From: hal AT finney.org
  • To: bluesky AT franklin.oit.unc.edu
  • Subject: Re: the three-services model
  • Date: Sun, 18 Feb 2001 16:51:33 -0800


Ted Anderson writes:
> There is still the matter of attaching human readable names to content
> hashes. Both a file system directory and an HTML web page provide
> mappings between names and URIs and could be linked into a namespace
> that could be used to attach useful names to content hashes.

The same problem arises with search systems. Freenet is using a
metadata concept where each document has associated with it a set of
attribute-value pairs. These could include title, author, keywords,
etc. and be a target for searches. The question is, how do you know
that a particular set of metadata accurately describes a document.

> Ultimately, I don't think there is any avoiding the need to use digital
> signatures to investing trust in this mapping.

I would question this on two counts. First, digital signature based
systems don't appear to me to be workable, at least in some approaches
I've seen. And second, perhaps there are alternatives that will work
and scale better.

Freenet considered a digital signature approach called mappings.
Essentially, individuals would sign the name-to-address (or metadata
to CHK) mappings. Each such entry would collect signatures by all
the people who had investigated it and found it valid. Then you would
list the people whom you had found to give trustworthy signatures on
the mappings, and the software would check new mappings to see if they
were signed by one of the people you trusted. You could perhaps extend
this with some transitive trust model (where people could share their
recommendations about whom to trust).

I don't think this system can scale. You will have the same problem
as with the PGP web of trust, namely that most people you want to
communicate with are not signed by anyone you have ever heard of.
The number of people in the world and the diversity of their interests
makes me doubtful that you can expect to find a signature on a mapping
that you will respect. Furthermore the number of signatures that would
have to be kept on each mapping is huge.

> You can think of these mappings (e.g. directory entries or web links) as
> statements. Namely, principal A *says* name N *means* content C. A
> signature connects "N -> C" to "A", it is essentially a certificate. To
> decide whether this mapping is useful we need to evaluate our trust in
> "A". This problem has been much studied in connection with public key
> systems (such as SDSI[1] and SPKI[2]) and we can use some of their ideas
> in designing the namespace of the storage system.

I'm not sure what you are proposing here, whether it is similar to
the mappings concept Freenet explored, or perhaps a more direct use of
crypto keys to control namespace. Freenet has a key namespace called
SVKs (Signature Verification Keys) where a public key hash can be the
root of a namespace, and the key holder can create any names he desires
within that namespace. You can have a whole heirarchy rooted at a name
which is essentially the hash of the public key. (Hence this is not a
"friendly" naming system in itself.) This is useful for some purposes
but does not solve the general problem of name mapping.

The non-crypto idea that Freenet has been exploring is essentially a
voting scheme. Whenever you fetch a document you find out whether the
name (or metadata) was good. You can then give some feedback about this
fact back into the system, which will raise or lower the probability
that the mapping will be found in the future.

You could have a hybrid scheme with signed mappings, and a voting based
PKI similar to that proposed by Stubblebine and Reiter (where the amount
you trust a key depends on how many certification paths there are to it).
But in any system that will scale, you're going to end up trusting a lot
of keys without much justification. In that case it is questionable if
the crypto is buying you anything.

Hal




Archive powered by MHonArc 2.6.24.

Top of Page