Skip to Content.
Sympa Menu

bluesky - Re: Naming via SDSI

bluesky AT lists.ibiblio.org

Subject: Global-Scale Distributed Storage Systems

List archive

Chronological Thread  
  • From: Brandon <blanu AT uts.cc.utexas.edu>
  • To: Global-Scale Distributed Storage Systems <bluesky AT franklin.oit.unc.edu>
  • Subject: Re: Naming via SDSI
  • Date: Wed, 28 Feb 2001 19:12:30 -0600 (CST)



> With SDSI, each component of such names is associated with a public key.
> The public key signs bindings of the names below it in the hierarchy
> to their own keys. In the example above, the key associated with "/us"
> signs a certificate binding "com" to its own key; and that key signs a
> certificate binding "microsoft" to the Microsoft key.

Freenet contains a similar mechanism called Mapped Subspace Keys (MSK). An
MSK contains a key to the mapfile and a name to map. If a mapfile's key is
a signed key (SVK or SSK) then all of the mappings are of course
signed with the mapfile's key's public key (did that make sense?).

The main difference I see between Freenet and OceanStore in this respect
is that Freenet MSKs are not broken up into components so
/com/us/microsoft would be treated as an atomic name. I can see the
benefit of the other system. This wasn't chosen in Freenet due to the
overhead of fetching a lot of files to resolve a path and because people
want to use Freenet as if it's the web and therefore complain a lot of
latency.

> One is the special handling necessary for top-level directories (I
> will call them TLDs as they play essentially the same role in DNS).
> For a global name like those above to be meaningful, the user of the
> name must have the key and address of the TLD. If you see a name like
> "/bluesky/mailinglist/archives" and you've never heard of "/bluesky",
> it will be a problem for you to find the data. Some other mechanism
> may have to be introduced to index TLDs.

This is the reason that in Freenet MSKs we made the mapfile key an
intrinsic part of the key. For top level mappings you must either have
1) a central authority, 2) no authority and therefore only second-visit
trust, as per SSH (in Freenet this is done with a KSK redirect to the
MSK), 3) you choose the authorities you trust, as in PGP, which really
won't work for DNS.

> Then, in this situation, the political problems surrounding DNS TLDs
> may become present as well. Getting a new TLD established may require
> convincing some kind of standards body to approve it so that everyone
> will start supporting it. The controversies over the actions of ICANN
> show what a bad situation this is.

In a P2P situation ICANN can be replaced or splintered into multiple
competing systems. A truly global system requires a single trust
authority, however, or else there will be sites that you can't reach.






Archive powered by MHonArc 2.6.24.

Top of Page