Subject: [Ideas] Are Identities permanent or have a life cycle?

From: Robert Moskowitz <[email-masked]>
Date: Thu, 20 Jul 2017 16:49:52 +0200

This is to Jari's question.

What is the nature of Indentity to Entity relationship.  What IS 
Identity and how is it presented.

After working on this for over 20 years, this is HARD!!!  And we may 
need to scope out what is meant or punt.

If I buy a notebook on ebay, does its Identity change as the meta data 
associated with the notebook most likely will change?

I tried to use 'the language used to communication knowledge of 
Identity' or some such wording.  Meaning that the language is mutable 
and has a lifecycle itself.  So if there is a claim that a x.509 cert 
represents the Identity, can it change?  Well in IEEE 802.1AR the iDevID 
is immutable and never changes for the usable life of the Entity.  It is 
the lDevID that changes.  But in use, it is the lDevID that the system 
operates with!

I feel this is an important position for the workgroup to develop 
concensus around.  Identity, IMHO, is NOT the 'DNA' of the Entity (work 
on clip power analysis to create such a DNA record).  I believe there is 
Lasic (sp?) surgery that can change eye color... :)

I do not hold that this needs to be nailed down in the Charter before 
the workgroup.  This is one of the workgroup items:  Defining Identity 
and how it is managed and discovered.

I am willing to put my stake in the ground that Identity is mutable and 
inevitably changes through the life of the Entity.  Further that an 
Entity (ignoring hypervisor/virtual machine scenarios) may have multiple 
Identities at any time, yielding different Identifiers that may all map 
to the same location.

I know others disagree.  I will work with the group position.

Bob

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 20 Jul 2017 17:26:37 +0200

> This is to Jari's question.

I'll le Jari speak for himself, but there might be a concern about the 
privacy considerations for long-lived identities/identifiers which we 
have seen in the last for instance when including the IEEE MAC address 
in auto-generated IPv6 addresses.
Such a concern is unrelated to the nature and definition of identity.

The IETF and the large community clearly has significant privacy 
concerns when such a number is disclosed everywhere as was the case with 
those IPv6 addresses.

But in the case of the identity in IDEAS I think the idea is that it 
wouldn't be widely exposed; not carried in datapackets etc.

 From my perspective I think that is fine.
In many cases I expect devices to have a hardware root of trust with 
manufacturing certificates, owner certificates, etc which can be used as 
part of secure/trusted boot with remote attestation etc. BUT such 
identifying information should only be disclosed on a need-to-know 
basis. For instance, the owner of an endpoint might have an inventory 
management system which tracks their endpoints and their secure boot state.

But I don't think we've had discussion about this in the IETF context, 
and it would be broader than IDEAS.

    Erik

> _______________________________________________
> Ideas mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ideas
>