, Emergent Chaos 2009-09-10
Once apon a time, I was uunet!harvard!bwnmr4!adam. Oh, harvard was probably enough, it was a pretty well known host in the uucp network which carried our email before snmp. I was also harvard!bwnmr4!postmaster which meant that at the end of an era, I moved the lab from copied hosts files to dns, when I became adam@bwnmr4.harvard...wow, there's still cname for that host. But I digress.
Really, I wanted to talk about a report, passed on by Steven Johnson and Gunnar Peterson, that Vint Cerf said that if he were re-designing the internet, he'd add more authentication.
And really, while I respect Vint a tremendous amount, I'm forced to wonder: Whatchyou talkin' about Vint?
I hate going off based on a report on Twitter, but I don't know what the heck a guy that smart could have meant. I mean, he knows that back in the day, people like me could and did give internet accounts to (1) anyone our boss said to and (2) anyone else who wanted them some of this internet stuff and wouldn't get us in too much trouble. (Hi S! Hi C!) So when he says "more authentication" does that mean inserting "uunet!harvard!bwnmr4!adam" in an IP header? Ensuring your fingerd was patched after Mr. Morris played his little stunt?
But more to the point, authentication is a cost. Setting up and managing authentication information isn't easy, and even if it were, it certainly isn't free. Even more expensive than managing the authentication information would be figuring out how to do it. The packet interconnect paper ("A Protocol for Packet Network Intercommunication," Vint Cerf and Robert Kahn) was published in 1974, and says "These associations need not involve the transmission of data prior to their formation and indeed two associates need not be able to determine that they are associates until they attempt to communicate." That was before DES (1975), before Diffie-Hellman (1976), Needham-Schroeder (1978) or RSA. I can't see how to maintain that principle with the technology available at the time.
When setting up a new technology, low cost of entry was a competitive advantage. Doing authentication well is tremendously expensive. I might go so far as to argue that we don't know how fantastically expensive it is, because we so rarely do it well.
Not getting hung up in easy problems like prioritization or hard ones like authentication, but simply moving packets was what made the internet work. Allowing new associations to be formed, ad-hoc, made for cheap interconnections.
So I remain confused by what he could have meant.
