Several of us have recently thought that a PGP finger print makes a fine name, but this is in the context of some implicit assumptions.
Here are some of those:
- A PGP finger print is a secure hash of a public key.
- The named entity has submitted his public key to at least some widely available registries who can and will index those public keys by their secure hash (which includes a key ID).
- People (or their trusted agents (such as a computer)) can store and communicate these finger prints wherever they need names.
- People (or their trusted agents (such as a computer)) can do 2048 bit arithmetic.
- Factoring big numbers is hard enough over the time interval we want the names to last.
First I want to propose a requirement on a name space that is weaker than “collision free”:The entity wanting to gain a name in the name space should have a feasible way to acquire a name that is and will remain unique even after he disseminates the name among untrusted agents.
Tyler raised the issue that knowledge of a name should not convey authority to send to the named person.
This connection results from one of the above assumptions that there is a public registry of public keys.
That need not be.
This is notion of keeping public keys secret.
If we decide that the common presumption is indeed good (I think it is)
that the public key of a RSA key pair is indeed public, then I can identify to you Joe’s identity by my sending to you the hash of the hash of Joe’s public key.
See this.
Some new stuff