How would you manage identities in decentralized p2p?

[alphabeater]

when managing identities in a decentralized p2p system, it's important to note the difference between user indentification and user location. the public/private key system is good for protecting anonymity and verifying identities, but only once you've found your peer's computer on the network. just doing a search for a specific user out of a whole network is unlikely to return a result.

so your current system goes:

1) find peer on decentralized network
2) you and peer become friends and add each other to trusted lists
3) you both disconnect from the network
4) you both reconnect (perhaps with changed ip addresses)
5) ?
6) you can identify each other reliably using the keys.

when you log on to the decentralized network and look for the people on your hotlist, how are they found? you could store an ip address for each person along with the various bits to verify their identity, but if that ip changes, how do you find them again? you could query each user you can find, i suppose ('hey peer, have you seen so-and-so?'), but on a network of millions it could take a little while to find your friend.

the only solution i can see is to establish a system of groups and sub-groups, with reliable, high-bandwidth computers with static ips sharing the work of 'managing' each group. upon joining the network, you would be assigned to the group and sub-group nearest to you, and this information would be stored and sent out with that verifiable identity.

this would then mean that, when you couldn't find your friend using their last-known ip address, you could connect to peers on the network and ask 'where is one of the heads of sub-group xyz of group pqr?'. this would be far more likely to return a result, but if it didn't, the client could go around asking 'where one of the heads of group pqr?'. almost all peers would know this, and the head of the group could then be asked for the head of the sub-group.

once the sub-group was found, the client could ask it where its friend is, and the heads of the sub-group could talk about it amongst themselves with one hopefully knowing. more sub-group layers could be added as necessary.

a system like this is still flawed, however - it introduces an element of (albeit reasonably dynamic) centralisation, would eat bandwidth and would have a less than 100% success rate, which to me that is unacceptable when talking about hotlisting.

gnutella identifies its users simply by ip address. this makes for 100% success on static ips, and none on dynamic ones... which unfortunately comes out at about 0% overall as the two types can't easily be told apart. what it teaches us, however, is that if you build your identification on a basic protocol of the internet, it's very hard to shut down.

my favourite idea, as i've mentioned before, is to use the dns for this. if you don't know what dns is, it's like a step up from ip - dns is what lets you have a .com, .org, .net or whatever else domain registered in any country and then have it locatable from pretty much anywhere in the world within about two days. i know it's a little excessive to ask people to register domains just to use a p2p, but there are lots of services around that will give you a subdomain of their own (you.dtdns.com, you.no-ip.com, etc.) for free, and then let you update it dynamically.

dynamic dns update means that whenever your ip changes, a program either running in the background or manually run by you will update your subdomain with your new ip address. within about five to ten minutes (this time depends on which site you get your subdomain from) anyone, anywhere on the internet can do ask their isp for a dns lookup on you.no-ip.com (or whatever) and find you.

i can already hear (uh, read) people saying "but that'll give your isp a list of all the computers you've connected to for p2p". your isp, even going by ip address alone and asking other isps who was using that address at that time, can always track everywhere you connect to. however, connections by themselves mean nothing. millions upon millions (probably billions) of dns lookups are handled every day by isps - they're generated by web surfing, email, online gaming, and any other internet-enabled program that locates a server or computer on the internet using the dns' abc.def.tld format. sorting through everything you've done today for possible p2p connections becomes like finding a needle in the largest haystack ever, and isps just won't want to take the time to do it.

by building a hotlist of people's domains/subdomains as you go around the p2p network, you can fill in step five in the verifiable keys technique. the existence of the keys also means that, if your free subdomain provider pulls the plug on you, you can simply register somewhere else, go back to your hotlisted peers and have your client say 'this is my new dns'. your client will be able to answer their key challenge and they can update their peer list with your new dns, allowing them to find you in future.

at this point i believe you have a proper verifiable, persistent user identification system - even more reliable than a centralized system in many ways, as your address on the network can change and your friend can still be sure that you are who you say you are.