[cap-talk] Why is EQ so dang fascinating?

[David Hopwood]

Toby Murray wrote:
> It is precisely for corroboration that I introduced the petname example.
> (Displaying the same petname for two caps that have come from two
> difference sources is a useful example of corroboration.)
> 
> Alice introduces Bob to Carol. Dave introduces Bob' to Carol. Carol
> would like to be able to determine whether Bob and Bob' are one and  the
> same. (This is the corroboration.) Let's also presume that Bob and Bob'
> are remote objects, hence they must be some form of caps-as-data.
> Further, that Bob and Bob' are arbitrary references. They're not
> guaranteed to partake in any synergy protocol with a coercer or
> authenticator. But because they're caps-as-data, we might as well
> compare the data bits of Bob with the data bits of Bob' and say that
> corroboration has occurred iff the bits match.
> 
> I personally see the above scenario as quite possible in any
> person-to-person communications system based on capabilities. It appears
> that EQ (or something equivalent to it, as above) is required in order
> to not rule out the possibility of corroboration of arbitrary
> references.
> 
> The reason is that corroboration must be independent of the behaviour of
> the references one is trying to corroborate (i.e. independent of the
> behaviour of Bob and Bob'). Suppose that Alice who has first introduced
> Bob to Carol is totally untrusted by Carol. The point of corroboration
> is to enable Carol to alter her trust in Bob, based on her trust in Dave
> (the second introducer).

Critically, the point is to enable Carol to alter her trust in the
existing Bob, which Carol may already have invoked. This is why an
authenticating EQ is needed, rather than a coercing EQ.

So, I'm sold (finally!) on the requirement for EQ -- although not
necessarily on it having to work for all references.

-- 
David Hopwood <david.hopwood at industrial-designers.co.uk>