<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'>Philip,<o:p></o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'>Your proposed use of names derived from cryptographic keys reminds me a lot of the work with did several years ago with PNRP. The principle was the same, pick a master key and use a hash of that master key as a node’s identity. In our case, it was a key to an entry in a P2P mesh. Leaving aside the specific details of the application, we got lots of feedback from our use of identifiers of form <hash>+<string>, very similar to:<o:p></o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'> </span></font><span lang=EN>mmm:MB2GK-6DUF5-YGYYL-JNY5E-RWSHZ:alice@cryptomesh.org<o:p></o:p></span></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'>The main issue is that the hashes are very unwieldy. They cannot be visually verified by the user. An attacker can generate an alternate key whose hash looks “close enough” to the real thing, and then use MITM attack to substitute that when the key is sent from Alice to Bob. Bob performs a visual check, is fooled, and then the communication between Bob and Alice can be intercepted. <o:p></o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'>We explored using a “compressed hash” for verification purposes, which we dubbed “call sign.” The idea was to hash “MB2GK-6DUF5-YGYYL-JNY5E-RWSHZ:alice@cryptomesh.org” plus some “salt”, choosing the salt so the hash ends with a large number of zeros. Let Z be that number. We would then build the call sign from the first N bits of the hash, and publish it as a short Base32 string. The strength of the verification is “N+Z”. For example, N=50 and Z=32 results in a 82 bit strong password, and a 10 character string.<o:p></o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'>The point of the small string is that it can be spelled over the phone, or copied from a card, without being too unwieldy.<o:p></o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span lang=EN style='font-size:11.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=2 face=Calibri><span style='font-size:11.0pt'>-- Christian Huitema<o:p></o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'><o:p> </o:p></span></font></p><p class=MsoNormal><font size=3 face=Calibri><span style='font-size:12.0pt'><o:p> </o:p></span></font></p></div></body></html>