Subject: RE: [dix] requirements

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 27 Feb 2006 13:23:57 -0800

> From: Dave Crocker [mailto:[email-masked]] 

> My #3 question was really 3 questions, starting with concept 
> and ending with a technical detail.  Since the word identity 
> is quite literally central to D*I*X, the meaning of identity 
> needs to be more than philosophical.

Is it possible for there to be a higher form of meaning than
philosophical meaning? I think not because the only parties qualified to
judge are philosophers.

I think that what Dave is trying to say here in imprecise fashion is
that we need to have a precise *definition* of what identity means in
the context of DIX and that this must 1) not rely on the outcome of open
philosophical questions and 2) be understood without direct recourse to
modern continental philosophers.

I believe that a useful working definition is something on the lines of:

An identity is a set of assertions concerning a particular subject
identifier.

This is certainly consistent with Dick's Id2 talk. 

As far as the computer is concerned, it first authenticates 'Dick Hardt
of Sxip', as far as the computer is concerned any machine readable
identifier that binds unambiguously to 'Dick Hardt of Sxip' is
acceptable, for the sake of argument lets use [email-masked]'.

Dick's identity is now the set of statements that are bound to
identifiers for Dick:

[email-masked] is Canadian
[email-masked] lives in Vancouver
[email-masked] is Star Alliance member 006342832
    Star Alliance member 006342832 is Star Alliance Gold
[email-masked] likes a bunch of (specified) sports teams
[email-masked] likes a bunch of (specified) bands
[email-masked] has blood group Z
[email-masked] looks like this 

And so on.

> > server,
> > and its uniqueness is based on its reuse of the domain namespace.
> 
> ok.  so, domain name, but something within the domain name 
> (nonce, or whatever), to ensure uniqueness.  Hence, each DNS 
> administration is a sub-registry for DIX identities.

It looks to me like there is a confusion here between the identifier and
the identity. The identifier is not the identity, it is merely a
reference point around which the identity is constructed.

As the identifier is not what the relying party is actually interested
in it can in most cases be factored out:

That dude you just asked me about:
   is Canadian
   lives in Vancouver
   is Star Alliance member 006342832
    Star Alliance member 006342832 is Star Alliance Gold
   likes a bunch of (specified) sports teams
   likes a bunch of (specified) bands
   has blood group Z
   looks like this 

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: John Merrells <[email-masked]>
Date: Mon, 27 Feb 2006 14:39:21 -0800

> An identity is a set of assertions concerning a particular subject

Well sure, that's pretty obvious though isn't it? dmd0 included a simple
information model along those lines. Is Dave saying this should be
pulled up to a higher level? I think that DIX could work within the
context of many alternative information models... In dmd0 we move
properties that have a name and a value. That's it. Simple to map
onto the X500 or relational models or whatever.

John

---

From: John Schnizlein <[email-masked]>
Date: Mon, 27 Feb 2006 18:07:30 -0500

On Feb 27, 2006, at 4:23 PM, Hallam-Baker, Phillip wrote:

>> ...  Since the word identity is quite literally central to D*I*X,
>> the meaning of identity needs to be more than philosophical.
>
> ...

Yes, precise but more abstract than the syntax of a message so we all 
understand the goals.

The sort of problem we do not want to have to deal with is what "is" 
is.  This is not as easy as it may appear when we attempt to design 
technical solutions for abstract things like identity that have such 
rich natural semantics.

> An identity is a set of assertions concerning a particular subject 

This definition seems to apply to the concept in Dick's ID-2 talk, but 
we should be careful.  Do we want to say that any set of assertions 
concerning an identifier is an identity.  This looks like a semantic 
trap to me.  I suggest that a definition more clearly associated with 
what the purpose or use of an identity is might avoid that trap.  This 
is a trap-rich environment.

> This is certainly consistent with Dick's Id2 talk.

The presentation was entertaining.  It contained at least one statement 
of equivalence that I find unpersuasive from just its assertion.  The 
equivalence of identity = reputation is a strong and provocative claim. 
  If the sort of definition of identity on which the WG's effort 
(implicitly) rests includes this equivalence, it deserves to be 
justified better.

> [email-masked] looks like this 

One of the real-world details that is illustrated by this example is 
that assertions can be limited.  For example, the Star Alliance Gold 
might be valid only until January of next year unless Dick flies enough 
this year (or has flown way too much already).  Since XML is a proposed 
format for assertions, it is easy enough to add syntactic elements to 
reflect the limitations, but the careful designer will notice the 
slippery slope of embedding real-world semantics into the format of 
identity assertions.

Careful bounds on the definitions of what we are dealing with are 
important here.  Relying on the rich set of associations that people 
have with an abstract noun like identity will not do.

John

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 15:11:19 -0800

> onto the X500 or relational models or whatever.

The above sort of exchange is a good one, among specialists in the identity and 
x.500 kind of world.

Unfortunately, it is not so useful for the larger community that is expected to 
implement or *use* these services.

Yet those are the folk who will adopt or not adopt the output of the working 
group.

If the working group's planned output cannot be described in a way that such 
folk will a) understand, and b) see immediate need for, then the dix working 
group will be another marginalized standards effort.

 >> That presumes an Internet community consensus about both the meaning
 >> of the term identity, as it will be used here,  and the architecture
 >> for it.
 >>
 >> I haven't noticed either present in the IETF arena, so I suspect you
 >> have some educating to do.
 >
 > You could join the IIW group.

I think this underscores the disconnect that concerns me.

The task of bringing work into the IETF entails the obligation of recruiting the 
IETF community (and the rest of the Internet community) to understand and 
embrace the prior work.  What it does NOT entail is telling the IETF (and 
larger) world that they should go and become familiar with the prior work, 
especially when the implication is that they are excluded from the dialogue 
until they do that outside (and unbounded) homework.

(For reference, my own recent experiences with DKIM's efforts to come into the 
IETF have reminded me quite starkly of the difference between these perspectives.)

d/
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: John Merrells <[email-masked]>
Date: Mon, 27 Feb 2006 15:17:17 -0800

On 27-Feb-06, at 3:11 PM, Dave Crocker wrote:

> The above sort of exchange is a good one, among specialists in the  
> identity and x.500 kind of world.
>
> Unfortunately, it is not so useful for the larger community that is  
> expected to implement or *use* these services.
>
> Yet those are the folk who will adopt or not adopt the output of  
> the working group.
>
> If the working group's planned output cannot be described in a way  
> that such folk will a) understand, and b) see immediate need for,  
> then the dix working group will be another marginalized standards  
> effort.

It seems to me that your comments are somewhat disassociated from the  
work we've done so far. How about you work through the draft charter  
#4 and annotate the bits that you have issue with?

John

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 15:54:21 -0800

On 27-Feb-06, at 3:07 PM, John Schnizlein wrote:
> This definition seems to apply to the concept in Dick's ID-2 talk,  
> but we should be careful.  Do we want to say that any set of  
> assertions concerning an identifier is an identity.  This looks  
> like a semantic trap to me.  I suggest that a definition more  
> clearly associated with what the purpose or use of an identity is  
> might avoid that trap.  This is a trap-rich environment.

Do you have a suggestion Dave?  I hope you are not one of those  
people that just poo-poos what other people do! :-)

> The presentation was entertaining.  It contained at least one  
> statement of equivalence that I find unpersuasive from just its  
> assertion.  The equivalence of identity = reputation is a strong  
> and provocative claim.  If the sort of definition of identity on  
> which the WG's effort (implicitly) rests includes this equivalence,  
> it deserves to be justified better.

Glad you found it entertaining. The key point was that identity is  
much more then a username and password. The "reputation=identity"  
point is for people to get that there are things you say about  
yourself, and things others say about you, and that the latter is  
pretty valuable, and we have no way of communicating those in the  
digital world.

The goal of the talk was to make digital identity issues accessible  
to a broad audience.

>>
>> And so on.
>
> One of the real-world details that is illustrated by this example  
> is that assertions can be limited.  For example, the Star Alliance  
> Gold might be valid only until January of next year unless Dick  
> flies enough this year (or has flown way too much already).  Since  
> XML is a proposed format for assertions, it is easy enough to add  
> syntactic elements to reflect the limitations, but the careful  
> designer will notice the slippery slope of embedding real-world  
> semantics into the format of identity assertions.

No reason a digital claim cannot expire the same way that a physical  
one expires.

> important here.  Relying on the rich set of associations that  
> people have with an abstract noun like identity will not do.

Not sure what is wrong with the definition proposed. Per above, do  
you have a better suggestion so we can move forward?

-- Dick

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 22:12:27 -0800

On 27-Feb-06, at 8:48 PM, Dave Crocker wrote:

>
>
>>>> An identity is a set of assertions concerning a particular  
>>>> subject identifier.
>>>
>>> This definition seems to apply to the concept in Dick's ID-2  
>>> talk, but we should be careful.  Do we want to say that any set  
>>> of assertions
> ...
> Thank heavens you included the dash between the poos.  I might have  
> gotten
> confused about what you were concerned about.

Glad you are not confused

>
> I think i mentioned in any earlier post that I feel obligated to offer
> alternative text, in these situations, when I think I understand  
> enough of the
> goals of those seeking chartering.  In this case, I don't even feel  
> close to
> that understanding, although the single-signon example does help.
>
> Part of the problem I am seeing is that that example is nicely  
> concrete and very
> much in the human realm, yet folks including Lisa seem fine with  
> definitions
> that are entirely abstract.  To me this seems entirely contradictory.
>
> So I'll attempt to lob an example of the sort I am suggesting is  
> needed, but
> without any real faith that it will be in the same ballpark as the  
> bat you folks
> are swinging.
>
> - - - -
>
> An identity is a globally unique reference to an online user or  
> agent.  The form
> of the reference is a URI.  <<There are some serious dragons in a  
> statement that
> general, but they will hold their breath, for now. /d>> Associated  
> with an
> identity is a collection of information that describes  
> characteristics of the
> identity and/or privileges imparted to the identity.  The  
> information about an
> identity can be divided into subsets, according to the different  
> functional
> roles performed by the user or agent.

This is where we differ. You are talking about "an identity" like it  
is an object. I see identity as being *all* the things about me.

What you call identity above, I would call an identifier.

> << Meta-suggestions:  DIX should define an identity object first,  
> and make sure
> it can be carried in multiple ways, unless there is something  
> special in the
> semantics of the exchange mechanism. /d >>

I was not involved, but HTTP did not need to define an object in  
order to be able to move things around.

>
> An initial application of DIX will be to permit users to have a  
> single step of
> authenticating themselves to a DIX client and then having that  
> client be able to
> perform other authentications, on behalf of the user, to servers  
> around the
> Internet.

If all we are doing is solving SSO with DIX, then we might as well  
stop now!

Identity is *so* much more then username and password -- although not  
having to have a different username and password for each site is  
*nice*, it is not all that compelling for sites to adopt. That is a  
user issue. Making it easy for users to give sites data is compelling.

The web took off because it was browsable. You did not need to type  
stuff in. Automating the movement of identity data is what DIX is  
about. SSO is a small subset of that.

>
> << By the way, one problem with this example is that it is not  
> obvious what it
> is that requires an interoperable standard, as opposed to a common  
> database and
> agent on a single machine, as folks already have.  Where is the  
> requirement for
> a distributed mechanism on the client side?  /d >>

that is because we are not just doing SSO -- need a common language  
for sites to make queries to get identity data

>>> assertion.  The equivalence of identity = reputation is a strong and
>
> Wearing my email anti-abuse hat, I will certainly claim that  
> anything called
> "reputation" is grotesquely relative.  It is not even close to "the  
> same as" the
> identity of the thing having the reputation.

your reputation is part of your identity ...

>> much more then a username and password.
>
> or less.
>
> if I change my password, I have not changed my identity.  (Well,  
> not usually.  I
> did build an email service, once that used the password to ensure  
> uniqueness of
> identity, but that was an anomoly is the design world, I think...)

we need to be using the same definition of identity for this  
conversation to make sense :)

-- Dick

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 22:51:50 -0800

...
> Do you have a suggestion Dave?  I hope you are not one of those people 
> that just poo-poos what other people do! :-)

Thank heavens you included the dash between the poos.  I might have gotten
confused about what you were concerned about.

I think i mentioned in any earlier post that I feel obligated to offer
alternative text, in these situations, when I think I understand enough of the
goals of those seeking chartering.  In this case, I don't even feel close to
that understanding, although the single-signon example does help.

Part of the problem I am seeing is that that example is nicely concrete and very
much in the human realm, yet folks including Lisa seem fine with definitions
that are entirely abstract.  To me this seems entirely contradictory.

So I'll attempt to lob an example of the sort I am suggesting is needed, but
without any real faith that it will be in the same ballpark as the bat you folks
are swinging.

- - - -

An identity is a globally unique reference to an online user or agent.  The form
of the reference is a URI.  <<There are some serious dragons in a statement that
general, but they will hold their breath, for now. /d>> Associated with an
identity is a collection of information that describes characteristics of the
identity and/or privileges imparted to the identity.  The information about an
identity can be divided into subsets, according to the different functional
roles performed by the user or agent.

<<This leads to all sorts of questions about how the different personnas are
distinguished.  And, by the way, using a URI model raises the obvious question
about whether an identity can have more than one associated URI and what it
means if it does. There is also the small matter of multiple people (identities)
sharing the same personna, such as store co-manager, conference paper reviewer,
and the like. /d>>

DIX is transaction mechanism for identity information.  <<obvious questions:
you mean dix semantics cannot transit via email?  equally obvious question: why
does this need a new transfer mechanism? >>

<< Meta-suggestions:  DIX should define an identity object first, and make sure
it can be carried in multiple ways, unless there is something special in the
semantics of the exchange mechanism. /d >>

An initial application of DIX will be to permit users to have a single step of
authenticating themselves to a DIX client and then having that client be able to
perform other authentications, on behalf of the user, to servers around the
Internet.

<< By the way, one problem with this example is that it is not obvious what it
is that requires an interoperable standard, as opposed to a common database and
agent on a single machine, as folks already have.  Where is the requirement for
a distributed mechanism on the client side?  /d >>

>> assertion.  The equivalence of identity = reputation is a strong and 

Wearing my email anti-abuse hat, I will certainly claim that anything called
"reputation" is grotesquely relative.  It is not even close to "the same as" the
identity of the thing having the reputation.

(By way of example, for a few folks on this list, there is a set of people among
whom I have a reputation of being patient and kind.  And, yes, they and the IETF
community are perceiving the same identity...  There is a reason I said
"grotesque".)

>> provocative claim.  If the sort of definition of identity on which the 
>> WG's effort (implicitly) rests includes this equivalence, it deserves 
>> to be justified better.

No, it deserves to be fixed.

> Glad you found it entertaining. The key point was that identity is much 
> more then a username and password. 

or less.

if I change my password, I have not changed my identity.  (Well, not usually.  I
did build an email service, once that used the password to ensure uniqueness of
identity, but that was an anomoly is the design world, I think...)

d/
-- 

Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 23:15:46 -0800

> This is where we differ. You are talking about "an identity" like it is 
> an object. I see identity as being *all* the things about me.

So when your password changes or your home phone number changes, it results in a
different identity?  I don't understand this paradigm.

> What you call identity above, I would call an identifier.

ok.

> I was not involved, but HTTP did not need to define an object in order 
> to be able to move things around.

Protocols move data objects of some sort.  No objects, no protocol.

> If all we are doing is solving SSO with DIX, then we might as well stop 
> now!
> 
> *nice*, it is not all that compelling for sites to adopt. That is a user 
> issue. Making it easy for users to give sites data is compelling.
> 
> stuff in. Automating the movement of identity data is what DIX is about. 
> SSO is a small subset of that.

URLs can be typed in.  Forms data can be typed in.  A key click on a URL is a
bit of input that is shipped to the server.

The web was based on a particular usage goal.  There was a very concrete problem
to solve.  That it was able to do more than that original task was not an
accident, but it was not created as an exercise in abstract capabilities.

> that is because we are not just doing SSO -- need a common language for 
> sites to make queries to get identity data

As I said, I was trying to formulate a concrete task.  SSO was mentioned by one
of you folk so that's what I went with.

If the entire goal of the exercise is to create a standard that is highly
general but has no immediate customers trying to solve an immediate, concrete,
specific problem, you will find adoption a tad slow.

> conversation to make sense :)

yup.  as I recall, that was a basic point to my early (and continuing) postings
on this lists.

d/
-- 

Dave Crocker

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 23:32:37 -0800

On 27-Feb-06, at 11:15 PM, Dave Crocker wrote:

>
>
>> This is where we differ. You are talking about "an identity" like  
>> it is an object. I see identity as being *all* the things about me.
>

Good to point the temporal nature of identity.

Since your identity is constantly changing, which makes it hard to be  
an object.

My reputation one day is different then another day.

Trusting me today does not mean you will trust me tomorrow.

Not sure what is hard about this. It is how the world works.

---

From: Lisa Dusseault <[email-masked]>
Date: Tue, 28 Feb 2006 12:46:22 -0800

> roles performed by the user or agent.

This is very useful text.  I'd be happy to see such text in a draft  
introducing a particular identity system, but I think it's also  
appropriate for the charter provided it doesn't contradict too many  
models.  It does pre-suppose some part of a solution but that may  
even be appropriate if we all agree on that part of a solution even  
before chartering.

Is it helpful to also point out that it's expected that these  
identities will come from different authorities that aren't required  
to coordinate with one another in any way?

> does this need a new transfer mechanism? >>

Transport rather than transaction?

Suggested further text perhaps:  "Currently, there is no standard,  
interoperable way for a user to have some identity information  
transferred from an identity authority to a third-party consumer of  
such information."

> perform other authentications, on behalf of the user, to servers  

I think most people are thinking in terms of "users having a way to  
authenticate themselves to a DIX identity authority (NOT a client)  
and having that authority be able to vouch for their identity, oh  
behalf of the user, to servers around the Internet."

That is the most common model I've seen, although it *also*  
presupposes some aspects of a solution.   For example, a solution  
where clients generated one or more self-signed certificates, in  
addition to a possible set of certs signed by other authorities, and  
selected from those to identify themselves to servers around the  
internet --  would not quite fit that description.

> a distributed mechanism on the client side?  /d >>

My last two paragraphs above may answer your question about what  
requires an interoperable standard.

> community are perceiving the same identity...  There is a reason I  

Reputation may be out of scope for an initial charter for DIX.  I  
would suggest that would be a wise choice for limiting the initial  
work as it would not limit later work.

Lisa

---

From: Dave Crocker <[email-masked]>
Date: Tue, 28 Feb 2006 13:21:24 -0800

> Transport rather than transaction?  

Well, I meant transaction, but perhaps it is not correct.  In any event, I 
suspect that a focus on the movement of the identity information is a 
distraction from the hard part, namely formulating a standard data structure, 
and basic contents, for the identity information object(s).

d/
-- 

Dave Crocker

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Tue, 28 Feb 2006 23:37:55 +0100

At 21:46 28/02/2006, Lisa Dusseault wrote:
>>general, but they will hold their breath, for now. /d>>

This is a form of identifier.

>>Associated with an
>even be appropriate if we all agree on that part of a solution "\Àw 
>…»"\ÀwÐ]»àê even before chartering.

Before proposing the IETF to enter the domain of identification, 
registration etc. I strongly suggest to consider the work of the JTC1/SC32/W2.

>to coordinate with one another in any way?

May be a careful reading of ISO 11179 may help?

>transferred from an identity authority to a third-party consumer of 

May be a reading of ISO 20944 oriented work could be considered?

>internet --  would not quite fit that description.

Are we calling indentification and authentication the same?

>>is that requires an inter"\Àw …»"\ÀwÐ]»àê operable standard, as 
>>opposed to a common database and

ISO 11179 has not worked much on networking. I think this is where 
IETF can contribute to a general concept?

>work as it would not limit later work.

I understood that DIX was to be an exchange system? In first 
analysis, I fail to see why reputation would be for it anything 
different from any other identity element and to be considered at all?
jfc

---

From: Johannes Ernst <[email-masked]>
Date: Tue, 28 Feb 2006 19:30:27 -0800

> even be appropriate if we all agree on that part of a solution even  

Minus whether the term is "identity" or "identifier", the above  
paragraph sounds like a description of LID ... its the basic design  
principle is that URLs are used to identify people (or software  
agents), and that methods are associated by which information can be  
obtained that is held "behind" the URL, e.g.
     URL?xpath=/VCARD
gets you the person's VCard info,
     URL?xpath=/VCARD/TEL[descendant::WORK][descendant::VOICE]
gets you the person's work phone number (only)
     URL?xpath=/FOAF
gets you the person's FOAF file, potentially filtered by who is doing  
the asking and how they prove it.

Just thought I point that out ... more info at http://lid.netmesh.org/