Subject: Re: [Ideas] Diasambugating Identifier and Identity

From: Toerless Eckert <[email-masked]>
Date: Sat, 8 Apr 2017 03:31:40 +0200

Inline

On Wed, Mar 29, 2017 at 09:08:32AM -0700, Dino Farinacci wrote:
> > For some there is seems to be no distinction between Identifier and Identity, but when you get to registration and services, Identity starts going into policy decisions.
> 
> But an Identifier identifies an entity, so when the entity is registered it is described by an Identifier value. When an identity is described in a policy statement, it is described by an Identifier value.
> 
> It is hard to disagree with my statement above because it is such a fundamental and basic definition.
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Well...

https://en.wikipedia.org/wiki/Digital_identity
  ISO/IEC 24760-1 defines identity as "set of attributes related to an entity"

So lets say GRIDS stores for an entity one or more identifier entries. Each identifier
entry has data like locators associated as well as some authenticator like a cert owned
by the entity.

Entity connects to grids, "asserts its identity" by a cryptographic proof of ownership
operation for the authenticator (eg: cert) and then it can change the data, eg: locators
associated with the identifier entry of the entity.

In this example, i guess (identifier, authenticator) is one identity of the the entity.
Maybe someone wants to spend 118 CHF on that ISO standard to get the IDEAS terminology
in compliance with it ? ;-))

How many disagreement points do i score ?

Cheers
    Toerless

> Dino
> 
> _______________________________________________
> Ideas mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ideas

---

From: Hesham ElBakoury <[email-masked]>
Date: Sat, 8 Apr 2017 20:49:10 +0000

It seems that Identity is a hot topic nowadays. For example, there are two identity conferences this year that might be of interest:

*         Digital Identity Summit: https://digitalidentitysummit.com/

*         Know Identity - Defragmented Identity Conference : https://oneworldidentity.com/dc-conference-know-identity-2017/?gclid=CMmotYXIlNMCFYS3wAodpTkHhA

Few years ago Microsoft had the Geneva claim based access platform, where services and applications are accessed based on the claims provided by the user.

Hesham

-----Original Message-----
From: Toerless Eckert [mailto:[email-masked]]
Sent: Friday, April 07, 2017 6:32 PM
To: Dino Farinacci
Cc: Robert Moskowitz; Hesham ElBakoury; Padma Pillay-Esnault; Alexander Clemm; [email-masked]; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Inline

Well...

by the entity.

Cheers

    Toerless

> [email-masked]<mailto:[email-masked]>

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 13 Apr 2017 19:58:04 -0400

I am finally getting back to this subject.

On 03/28/2017 12:07 PM, Robert Moskowitz wrote:
> The Identifier/Identity definitions in 
> draft-padma-ideas-problem-statement-01.txt is a good start, it fails 
> in the appreviations used. (There is NO abbreviation for Identity!)
>
> ID should NOT be the appreviation of Identitfier.  People will default 
> to thinking 'Identity' when they see it.  Think about people outside 
> our discussion group.
>
> I propose 'IDf' for Identifier.  'ID' is too owned by Identity.
>
> I will be working on proposed wording to improve these definitions.

I have worked up definitions, sent it out to a few reviewers, got some 
comments and questions.  First my current draft, then a few questions:

Replacement text for:    draft-padma-ideas-problem-statement

Identity (Abbr: IDT or IDt):    A collection of information that is 
unique to an object and differentiates it from all other objects.

An identity consists of information that is stated about the object by 
itself or a governing authority. It consists of a set of attributes 
and/or actions the object can take.  An Identity may be assigned a 
lifetime (e.g., a time period), which is determined by either the object 
or the governing authority responsible for defining the identity of the 
object, or a designated third party. An object can have multiple 
Identities and can create and discard Identities at will.  An Identity 
may be ‘indestructible’. That is, it is so unique and non replicatible 
that no other object could ever duplicate it, nor can the object discard 
it within its lifetime without being a ‘clone’ object.  Identity is used 
in authentication registration and policy ownership proofs.

Identifier (Abbr: IDF or IDf):    A label that is unique for an object a 
particular scope.

The label follows strict construction rules for the objects and the 
context that the label is applied to.  For a particular context, an 
Identifier is used to reference an Identity for the object.  In most 
cases, an Identifier is bound to an Identity through some trusted 
mechanism.  An Identity can have different Identifiers, potentially 
following different construction rules, for different contexts and/or 
domains of applicability.

==========

Now onto a few questions:

Per: "An object can have multiple Identities" clause, I am challenged with

"This is VERY dangerous. In most software systems, it is the 
responsibility of the management system to assign a single identity to 
an object when it is created. If an object has multiple identities, it 
could suffer from 'multiple personality syndrome'.

More importantly, if the object is allowed to create and discard 
identities at will, how do other objects know that the object is who it 
attests to be?"

I think it is very important for some situations for support of multiple 
Identities.  No all.  There are domains as indicated above where it 
causes big problems.

Per: "An Identity may be ‘indestructible’." clause, I am challenged with

"This doesn’t make any sense. Why would anyone care if the identity is 
indestructible or not?"

I can think of examples of such Identities, or claim of such Identities, 
like DNA.

And finally, Per: "Identity is used in authentication registration and 
policy ownership proofs." clause, I am challenged with

"What does this mean?"

I will have to work on this some more, or perhaps it does not belong in 
the definition section.

Comments please

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Thu, 13 Apr 2017 23:29:14 -0700

Hi Robert

I have a few comments

See below <PPE>

On Thu, Apr 13, 2017 at 4:58 PM, Robert Moskowitz <[email-masked]>
wrote:

>> The Identifier/Identity definitions in draft-padma-ideas-problem-statement-01.txt
>> is a good start, it fails in the appreviations used. (There is NO
>> abbreviation for Identity!)
>>
>> ID should NOT be the appreviation of Identitfier.  People will default to
>> thinking 'Identity' when they see it.  Think about people outside our
>> discussion group.
>>
> Identity (Abbr: IDT or IDt):    A collection of information that is unique
> to an object and differentiates it from all other objects.
>

<PPE> Would prefer entity to object in keeping of the definition in the
draft.

> itself or a governing authority. It consists of a set of attributes and/or
> actions the object can take.  An Identity may be assigned a lifetime (e.g.,
> a time period), which is determined by either the object or the governing
> authority responsible for defining the identity of the object, or a
> designated third party. An object can have multiple Identities and can
> create and discard Identities at will.  An Identity may be
> ‘indestructible’. That is, it is so unique and non replicatible that no
> other object could ever duplicate it, nor can the object discard it within
> its lifetime without being a ‘clone’ object.  Identity is used in
> authentication registration and policy ownership proofs.
>
> <PPE> Can we infer than an identity may apply to a group of entities? I
think this is an important aspect not sure the text above reflects that.

> Identifier is used to reference an Identity for the object.  In most cases,
> an Identifier is bound to an Identity through some trusted mechanism.  An
> Identity can have different Identifiers, potentially following different
> construction rules, for different contexts and/or domains of applicability.
>
>
> ==========
>
> responsibility of the management system to assign a single identity to an
> object when it is created. If an object has multiple identities, it could
> suffer from 'multiple personality syndrome'.
>
> <PPE> I tend to agree with you I would prefer one identity but multiple
identifiers.

> <PPE> this is where I think there should always be a Permanent identity
which sticks but it can take aliases but those are bound to the permanent
one.

> Identities.  No all.  There are domains as indicated above where it causes
> big problems.
>

<PPE>  Reading the definition above I felt we should be very careful how to
implement this and in what circumstance. My read is that this is a
permanent identity.

> <PPE> the objective here to have a mechanism where an entity has a means
to prove that it is what it is supposed to be and prevent hijacking of its
identity.

> I will have to work on this some more, or perhaps it does not belong in
<PPE> There are important definitions and thanks for taking a stab at this

Padma

---

From: Michael Menth <[email-masked]>
Date: Fri, 14 Apr 2017 08:45:56 +0200

Hi Robert, hi all,

thanks for your thought-provoking mail. Reading the definitions gave me
the impression that identities can have very different properties
depending on their domains. I feel the text is stimulating but too long
for a definition.

What about:

An identity (Idy) is a distinguishable entity within its domain.

An identifier (Idf) is a label for an Idy. An Idy may have multiple
Idfs.

Anything beyond this definition are valid observations that show the
diverse properties of domain-specific Idys. A discussion including
examples for entities and domains is helpful for illustration. This also
pertains to the relation between objects and Idys.

Regards,

Michael

-- 
Prof. Dr. habil. Michael Menth
University of Tuebingen
Faculty of Science
Department of Computer Science
Chair of Communication Networks
Sand 13, 72076 Tuebingen, Germany
phone: (+49)-7071/29-70505
fax: (+49)-7071/29-5220
mailto:[email-masked]
http://kn.inf.uni-tuebingen.de

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 14 Apr 2017 08:40:20 -0400

> depending on their domains. I feel the text is stimulating but too long

Good point.  After 20+ years of working on Identity vs Identifier, it is 
hard for me to reduce the discussion down to a concise paragraph.  I 
have seen too many domains of applicabilty to say, "this can't be so."

Plus as the originator of self-proving ownership of an Identity with 
domain-specific statistically unique Identifiers, I have argued all 
sides of this subject.

> pertains to the relation between objects and Idys.

And then have a section that goes a little in depth on Identity and 
Identifier.  A can work with that.

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 14 Apr 2017 14:26:54 -0400

> An identifier (Idf) is a label for an Idy. An Idy may have multiple

An identity (Idy) is a collection of data that distinguishes an entity 
within its domain. An entity may have different Idy for different domains.

An identifier (Idf) is a label for an Idy, often following construction 
rules. An Idy may have multiple Idfs.

---

From: Michael Menth <[email-masked]>
Date: Fri, 14 Apr 2017 20:34:53 +0200

Looks good to me.

Michael

---

From: Alexander Clemm <[email-masked]>
Date: Tue, 25 Apr 2017 00:48:51 +0000

Coming back to this thread... I do agree with the notion of identifier.  However, I am not sure I agree with the notion of identity as discussed below.

When you state "An identity (Idy) is a collection of data that distinguishes an entity  within its domain. An entity may have different Idy for different domains.", I see several issues:
- For one I don't think an identity is merely a collection of data.  That would be a data record.  Also, if you change any of the data, you don't automatically change the identity - while some metadata may indeed be an inseparable characteristic of an identity, other may not.  So, at a minimum there needs to be some distinction about that, which is not captured in the definition.  
- Why do we need to bring a notion of "domain" into this definition.  I don't think this is necessary.  Identifiers can be relative to a domain, but identity?  At a minimum, this requires clarification.  Maybe there is a notion of "also known as" by which the same entity is identified differently in different domains.  If we do bring "domain" into the picture, this needs to be clearly explained as well.  In that case, the question also arises what it means for the same "object" to be part of two "domains" - is there something that links the "identities" across those domains "together" - this could be considered the very identity; if not, something is missing and a third concept (for "entity" or the real "self") may be needed, which we should really avoid.  
- I am not sure that a single entity should have multiple identities.  In this case, identity really means not much else than yet-another-identifier.  

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Friday, April 14, 2017 11:35 AM
To: Robert Moskowitz <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Looks good to me.

Michael

Am 14.04.2017 um 20:26 schrieb Robert Moskowitz:
>> thanks for your thought-provoking mail. Reading the definitions gave 
>> me the impression that identities can have very different properties 
>> depending on their domains. I feel the text is stimulating but too 
>> long for a definition.
>>
>> What about:
>>
> An identifier (Idf) is a label for an Idy, often following 
> construction rules. An Idy may have multiple Idfs.
> 
> 
>>
>> examples for entities and domains is helpful for illustration. This 
>> also pertains to the relation between objects and Idys.
>>
>> Regards,
>>
>> Michael
>>
>>>> draft-padma-ideas-problem-statement-01.txt is a good start, it 
>>>> fails in the appreviations used. (There is NO abbreviation for 
>>>> Identity!)
>>>>
>>>> ID should NOT be the appreviation of Identitfier.  People will 
>>>> default to thinking 'Identity' when they see it.  Think about 
>>>> people outside our discussion group.
>>>>
>>> I have worked up definitions, sent it out to a few reviewers, got 
>>> some comments and questions.  First my current draft, then a few questions:
>>>
>>> An identity consists of information that is stated about the object 
>>> by itself or a governing authority. It consists of a set of 
>>> attributes and/or actions the object can take.  An Identity may be 
>>> assigned a lifetime (e.g., a time period), which is determined by 
>>> either the object or the governing authority responsible for 
>>> defining the identity of the object, or a designated third party. An 
>>> object can have multiple Identities and can create and discard 
>>> Identities at will.  An Identity may be 'indestructible'. That is, 
>>> it is so unique and non replicatible that no other object could ever 
>>> duplicate it, nor can the object discard it within its lifetime 
>>> without being a 'clone' object.  Identity is used in authentication registration and policy ownership proofs.
>>>
>>>
>>> following different construction rules, for different contexts 
>>> and/or domains of applicability.
>>>
>>>
>>> ==========
>>>
>>> responsibility of the management system to assign a single identity 
>>> to an object when it is created. If an object has multiple 
>>> identities, it could suffer from 'multiple personality syndrome'.
>>>
>>> identities at will, how do other objects know that the object is who 
>>> it attests to be?"
>>>
>>> I think it is very important for some situations for support of 
>>> multiple Identities.  No all.  There are domains as indicated above 
>>> where it causes big problems.
>>>
>>> Per: "An Identity may be 'indestructible'." clause, I am challenged 
>>> with
>>>
>>> "This doesn't make any sense. Why would anyone care if the identity 
>>> is indestructible or not?"
>>>
>>> I can think of examples of such Identities, or claim of such 
>>> Identities, like DNA.
>>>
>>> And finally, Per: "Identity is used in authentication registration 
>>> and policy ownership proofs." clause, I am challenged with
>>>
>>> "What does this mean?"
>>>
>>> I will have to work on this some more, or perhaps it does not belong 
>>> in the definition section.
>>>
>>> Comments please
>>>

---

From: Michael Menth <[email-masked]>
Date: Tue, 25 Apr 2017 23:57:03 +0200

Hi Alex,

thanks for your comments. I see your points. We possibly should avoid
specifying what exactly constitutes the identity as anything but its
identifier may change. We said, one identity may have several
identifiers, e.g., after a merging identities, but different identities
certainly have different identifiers.

When I think about an entitiy having multiple identities, a human being
with multiple email addresses comes to my mind. An email address may be
an identity to some extent, but we know that several of them may belong
to the same person. I don't think we need to consider that because that
is beyond the considered context of email addresses. We could just live
with different identities that are different in a certain context.

Another try:

An identity (Idy) is a distiguishable entity within a context.

An identifier (Idf) is a unique label.

An Idy may have multiple Idfs but different Idys have different Idys so
that Idys can be distinguished by their Idfs. Idfs often follow
construction rules.

Is that closer to a core definition or are mort important aspects missing?

Regards,

Michael

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Wed, 26 Apr 2017 10:04:46 +0000

It seems that there are a thousand Hamlets in a thousand people's eyes :p

I think the real reason for the disagreements on the definitions is that we have not got a consensus on what they are used for yet. Or the even deeper question is what functions we need for IDEAS. If we can agree on the functions we need, then we can define a term that we use to provide the function. 

For example, (one of) the real reason we want identifiers is that we want something that does not change with topology locations to identify mobile communication end point, which functions that cannot be carried by IP addresses. Since (I believe) we all have consensus on this function, we can at least agree that identifier is topology-independent label that identifies a communication end point. 

For identities, I suggest we first discuss what new functions, which cannot be carried by identifiers, we want to bring into IDEAS. If we have consensus on the functionalities, we can easily make a definition. 

Dino said that we could move on to bigger fish to fry. I think new function are big thing. 

Bingyang (Bryan) 

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Wednesday, April 26, 2017 5:57 AM
To: Alexander Clemm <[email-masked]>; Robert Moskowitz <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Hi Alex,

thanks for your comments. I see your points. We possibly should avoid specifying what exactly constitutes the identity as anything but its identifier may change. We said, one identity may have several identifiers, e.g., after a merging identities, but different identities certainly have different identifiers.

When I think about an entitiy having multiple identities, a human being with multiple email addresses comes to my mind. An email address may be an identity to some extent, but we know that several of them may belong to the same person. I don't think we need to consider that because that is beyond the considered context of email addresses. We could just live with different identities that are different in a certain context.

Another try:

An Idy may have multiple Idfs but different Idys have different Idys so that Idys can be distinguished by their Idfs. Idfs often follow construction rules.

Regards,

Michael

Am 25.04.2017 um 02:48 schrieb Alexander Clemm:
>> An identity (Idy) is a collection of data that distinguishes an 
>> entity within its domain. An entity may have different Idy for different domains.
>>
>>>> defining the identity of the object, or a designated third party. 
>>>> An object can have multiple Identities and can create and discard 
>>>> it is so unique and non replicatible that no other object could 
>>>> ever duplicate it, nor can the object discard it within its 
>>>> lifetime without being a 'clone' object.  Identity is used in authentication registration and policy ownership proofs.
>>>>
>>>>
>>>> Identifier is used to reference an Identity for the object.  In 
>>>> most cases, an Identifier is bound to an Identity through some 
>>>> trusted mechanism.  An Identity can have different Identifiers, 
>>>> potentially following different construction rules, for different 
>>>> contexts and/or domains of applicability.
>>>>
>>>>
>>>> ==========
>>>>
>>>> identities at will, how do other objects know that the object is 
>>>> who it attests to be?"
>>>>
>>>> I will have to work on this some more, or perhaps it does not 
>>>> belong in the definition section.
>>>>
>>>> Comments please
>>>>

---

From: Michael Menth <[email-masked]>
Date: Wed, 26 Apr 2017 16:13:26 +0200

Hi all,

I see that we leverage a mapping system to map identifiers to some
information (locators, service information, priorities, whatever). The
identity seems most useful to me for authenticated registration of the
mapping information. What else are identities good for?

Regards,

Michael

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 26 Apr 2017 10:26:20 -0700

> For example, (one of) the real reason we want identifiers is that we want something that does not change with topology locations to identify mobile communication end point, which functions that can…

Exactly.

So to extend the definition to be specific. The identifier is used for a host stack transport connection. Its the “thing” (the arguments) you pass to connect(), bind(), sendto(), etc, socket API calls. And what you “get back” from gethostbyname().

Dino

---

From: Alexander Clemm <[email-masked]>
Date: Wed, 26 Apr 2017 19:38:35 +0000

Yes, I think we agree on the notion of identifier.  

Of course, this is not just about identifier- but identity-enabled networking, so there is still that other aspect needing to be fleshed out. Re: Michael's question, authentication is one of its applications, but I think there are others, for example related to metadata (back to the earlier point of whether identity is a data record) - an example would be the "type" of endpoint which applies regardless whether one or many identifiers are being used.  Related to metadata, you could have policies that are applied based on identity (e.g. an entity with a paid contract), not based on which one of several identifiers an entity happens to use.   

-- Alex

-----Original Message-----
From: Dino Farinacci [mailto:[email-masked]] 
Sent: Wednesday, April 26, 2017 10:26 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: Michael Menth <[email-masked]>; Alexander Clemm <[email-masked]>; Robert Moskowitz <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Exactly.

Dino

---

From: Michael Menth <[email-masked]>
Date: Wed, 26 Apr 2017 21:55:47 +0200

Hi Alex,

can't a contract be represented by a contract identifier (cidX) to which
several networking identifiers (nidn) are mapped?

nid0 -> cidX
nid1 -> cidX
nid2 -> cidX
cidX -> someProperty

This contract identifier may be mapped to some property yielding a kind
of hierarchical mapping. What I want to say is, I don't see the gain of
an identity concept in this example.

I ask again: what's the value of identities beyond authentication for
registration purposes?

Regards,

Michael

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Thu, 27 Apr 2017 01:30:34 +0000

Hi Michael, 

What do you mean by authentication? 
Is it used by mapping system to authenticate whether an entity can update properties of an identifier, or used by the corresponding node to authenticate whether the entity indeed owns the identifier? 

Bingyang (Bryan)

-----Original Message-----
From: Michael Menth [mailto:[email-masked]] 
Sent: Thursday, April 27, 2017 3:56 AM
To: Alexander Clemm <[email-masked]>; Dino Farinacci <[email-masked]>; Liubingyang (Bryan) <[email-masked]>
Cc: Robert Moskowitz <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Hi Alex,

can't a contract be represented by a contract identifier (cidX) to which several networking identifiers (nidn) are mapped?

nid0 -> cidX
nid1 -> cidX
nid2 -> cidX
cidX -> someProperty

This contract identifier may be mapped to some property yielding a kind of hierarchical mapping. What I want to say is, I don't see the gain of an identity concept in this example.

I ask again: what's the value of identities beyond authentication for registration purposes?

Regards,

Michael

Am 26.04.2017 um 21:38 schrieb Alexander Clemm:
> Cc: Michael Menth <[email-masked]>; Alexander Clemm 
> <[email-masked]>; Robert Moskowitz 
> <[email-masked]>; [email-masked]

---

From: Alexander Clemm <[email-masked]>
Date: Thu, 27 Apr 2017 02:00:08 +0000

Hi Michael,

For your example: yes, you can do what you describe.  Of course, you need to have the same metadata replicated for each identifier.  When the entity decides to use another identifier, its metadata needs to be copied as well.  When you change the metadata, you need to change it in all records.  And there may be more than one piece of metadata; for example, I may be an entity of a certain type.  With a flat identifier-only scheme, the data must be maintained redundantly.  

--- Alex

-----Original Message-----
From: Michael Menth [mailto:[email-masked]] 
Sent: Wednesday, April 26, 2017 12:56 PM
To: Alexander Clemm <[email-masked]>; Dino Farinacci <[email-masked]>; Liubingyang (Bryan) <[email-masked]>
Cc: Robert Moskowitz <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Hi Alex,

nid0 -> cidX
nid1 -> cidX
nid2 -> cidX
cidX -> someProperty

Regards,

Michael

---

From: Michael Menth <[email-masked]>
Date: Thu, 27 Apr 2017 16:06:53 +0200

Am 27.04.2017 um 03:30 schrieb Liubingyang (Bryan):
> Is it used by mapping system to authenticate whether an entity can update properties of an identifier, 
Yes.

Regards, Michael

or used by the corresponding node to authenticate whether the entity
indeed owns the identifier?

---

From: Michael Menth <[email-masked]>
Date: Thu, 27 Apr 2017 16:15:55 +0200

Hi Alex,

Am 27.04.2017 um 04:00 schrieb Alexander Clemm:
> Hi Michael,
> 
> For your example: yes, you can do what you describe.  Of course, you need to have the same metadata replicated for each identifier.  
No, the metadate is mapped only to the single "cidX". But multiplce nidn
are mapped to this single contract id.

When the entity decides to use another identifier, its metadata needs to
be copied as well.
No, we just need another mapping nid3 -> cidX

When you change the metadata, you need to change it in all records.
No, we just need to change the metadata associated to the single "cidX".

And there may be more than one piece of metadata; for example, I may be
an entity of a certain type.  With a flat identifier-only scheme, the
data must be maintained redundantly.
Hm, not sure what you mean.

Regards, Michael

---

From: Alexander Clemm <[email-masked]>
Date: Thu, 27 Apr 2017 20:04:10 +0000

Hi Michael,

In your example, it sounds as if you are effectively having the cidX take on a similar role of an identity - various identifiers are grouped together under the umbrella of their unifying cidX, which is now used in lieu of - but similar role as (minus the authentication) - an identity.  You can do that, but what you are arguing, then, is in effect to restrict the discussion to identifiers and identifier-enabled networks; identity and identity-enabled networks would be a misnomer unless used as a synonym.  The thread started with disambiguating identifier and identity; if we decided that we want to have as scope for the work identifier-enabled networks (without need for the notion of identity distinct from an identifier), the disambiguation would no longer matter.  

One other clarification inline, <ALEX>

Cheers
--- Alex

-----Original Message-----
From: Michael Menth [mailto:[email-masked]] 
Sent: Thursday, April 27, 2017 7:16 AM
To: Alexander Clemm <[email-masked]>; Dino Farinacci <[email-masked]>; Liubingyang (Bryan) <[email-masked]>
Cc: [email-masked]; Robert Moskowitz <[email-masked]>
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Hi Alex,

> For your example: yes, you can do what you describe.  Of course, you need to have the same metadata replicated for each identifier.  
No, the metadate is mapped only to the single "cidX". But multiplce nidn are mapped to this single contract id.

When the entity decides to use another identifier, its metadata needs to be copied as well.
No, we just need another mapping nid3 -> cidX

And there may be more than one piece of metadata; for example, I may be an entity of a certain type.  With a flat identifier-only scheme, the data must be maintained redundantly.
Hm, not sure what you mean.

<ALEX>  What I meant here is there can be other metadata associated with an entity, not just the contract, but for example information of which type a certain endpoint is - for example, if it is a connected vehicle, a server, a mobile CPE.  If an entity has several identifiers, and the same metadata applies to each, it needs to be maintained redundantly (unless you put it under some common umbrella that "unites" the identifiers, such as an identity).  
</ALEX>
  
Regards, Michael

> To: Alexander Clemm <[email-masked]>; Dino Farinacci 
> <[email-masked]>; Liubingyang (Bryan) <[email-masked]>

---

From: Michael Menth <[email-masked]>
Date: Fri, 28 Apr 2017 00:12:10 +0200

Hi Alex,

Am 27.04.2017 um 22:04 schrieb Alexander Clemm:
> Hi Michael,
> 
> In your example, it sounds as if you are effectively having the cidX take on a similar role of an identity - various identifiers are grouped together under the umbrella of their unifying cidX, which is now used in lieu of - but similar role as (minus the authentication) - an identity.
Right. I just want to say that an identity is not necessarily needed to
provide joint information for a set of identifiers.

  You can do that, but what you are arguing, then, is in effect to
restrict the discussion to identifiers and identifier-enabled networks;
identity and identity-enabled networks would be a misnomer unless used
as a synonym.  The thread started with disambiguating identifier and
identity; if we decided that we want to have as scope for the work
identifier-enabled networks (without need for the notion of identity
distinct from an identifier), the disambiguation would no longer matter.
I don't want to get rid of the term identity, I'd rather like to filter
out the very essence of an identity.
Is it just the authentication part or something else?
Certainly not - because we may have a "cidX" whithout authentication
features which is still able to bind several identifiers together.
Is an identity just a "collection of data"? No, because if we have
another identical collection of data, then we don't know which is which.

Can we say it is a distinguishable entity? It may have a collection of
data and may also have some means for authentication. If we have equal
products without a serial number, we probably wouldn't talk about
identities. But with a serial number, they can be distinguished, so that
we can talk about identities. However, it's not the serial number or
identifier that makes them an identity, it rather the distinguishability
which could alternatively be achieved through a collection of data. Hm,
too philosophical?

Regards,

Michael

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Fri, 28 Apr 2017 02:03:51 +0000

See inline [Bryan]
I highly suggest that we can leave the term definition aside, and talk about what functionalities we need in IDEAS. If the functions are decided, we can give whatever terms everyone is comfortable with. The functions are really important things, then the terms.

Best
Bingyang (Bryan)

-----Original Message-----
From: Michael Menth [mailto:[email-masked]] 
Sent: Friday, April 28, 2017 6:12 AM
To: Alexander Clemm <[email-masked]>; Dino Farinacci <[email-masked]>; Liubingyang (Bryan) <[email-masked]>
Cc: [email-masked]; Robert Moskowitz <[email-masked]>
Subject: Re: [Ideas] Diasambugating Identifier and Identity

Hi Alex,

> In your example, it sounds as if you are effectively having the cidX take on a similar role of an identity - various identifiers are grouped together under the umbrella of their unifying cidX, whic…
Right. I just want to say that an identity is not necessarily needed to provide joint information for a set of identifiers.

  You can do that, but what you are arguing, then, is in effect to restrict the discussion to identifiers and identifier-enabled networks; identity and identity-enabled networks would be a misnomer unless used as a synonym.  The thread started with disambiguating identifier and identity; if we decided that we want to have as scope for the work identifier-enabled networks (without need for the notion of identity distinct from an identifier), the disambiguation would no longer matter.
I don't want to get rid of the term identity, I'd rather like to filter out the very essence of an identity.
Is it just the authentication part or something else?
  [Bryan] Agreed with all the above. Btw, an identity by itself may not be sufficient to provide authentication unless accompanied with some keys, tokens, etc. And it is not necessary neither since one can do authentication without the definition of identity. 

Certainly not - because we may have a "cidX" whithout authentication features which is still able to bind several identifiers together.
Is an identity just a "collection of data"? No, because if we have another identical collection of data, then we don't know which is which.
  [Bryan] if we want to bind some identifiers together, we just need a set. If we need to give the set a unique reference, that could just be a set ID, which can be just an index in database internal implementation and doesn't have to be given an explicit meaning. 
  However, if the set ID itself has some properties, the set ID can have some meaning. We can use the properties to indicate, e.g., this set maps to a real entity in the real world. 

Can we say it is a distinguishable entity? It may have a collection of data and may also have some means for authentication. If we have equal products without a serial number, we probably wouldn't talk about identities. But with a serial number, they can be distinguished, so that we can talk about identities. However, it's not the serial number or identifier that makes them an identity, it rather the distinguishability which could alternatively be achieved through a collection of data. Hm, too philosophical?
  [Bryan] To my understanding, people have so different understanding of the term "identity". Some may think it is just for authentication of ownership of identifiers, like HI for HIT. Some may think it is an avatar of a real world entity. 
  I highly suggest that we can leave the term definition aside, and talk about what functionalities we need in IDEAS. If the functions are decided, we can give whatever terms everyone is comfortable with. The functions are really important things, then the terms. 

Regards,

Michael