Wednesday, March 22, 2006

Some researchers posted the results of their effort to figure out how Skype works -- http://www.secdev.org/conf/skype_BHEU06.handout.pdf. It is useful to be able to understand how Skype works in detail in order to trust the code. I'm glad to see that the authors noted that it is difficult to block Skype traffic.

The more important result is to understand Skype's Edge-connectivity. It's an example of how communities can stay connected independent on the accidental properties of the Internet and the gatekeepers. Because the relationships are maintained at the edge mobility is fundamental. You don't need the network to do meshing when the applications maintain their own relationships. Meshing then becomes a low level technique for pooling routers rather than a way to make applications mobile.

This edge approach can also allow the Internet itself to be simplified since the IP address can be used to facilitate routing rather than being overly constrained by having to also serve the role of stable (and dynamic) identifier. Since the identifiers are stable you don't need a mechanism like the DNS to provide stability. Unlike the DNS, the Skype directory is a directory though it also maps identifiers into handles to facilitate rendezvous.

A more general implementation would distribute this mapping. If the applications themselves are able to participate in finding dynamic paths we can start to move beyond the current Internet's single omniscient backbone that interconnects local LANs. The applications would find a path through a network consisting of way stations. Unlike a router a way station can be a visible transit point or an invisible. We see this kind of choice in airline flights. A flight might have a single identifier that allows one to be indifferent to the path or the user can choose explicit routing or a combination of the two.

Both end points are mobile so rendezvousing can be a challenge butt doable as the current cellular network demonstrates. But unlike the cellular network the relationships are not in danger of being lost if there is a temporary failure to connect. Algorithms like sending extra packets ahead and router pooling allow for maintain packet flows even in very dynamic environments.

Skype's encrypted communications is vital because it allows connectivity without having to trust intermediaries and, even better -- it frustrates attempts to block the traffic even if some corporate IT managers view that as a deficiency.

Encrypting the code itself is less important. It serves mainly to prevent third parties from vetting the code for simple bugs or maliciousness. Perhaps the real value is in the four billion dollars eBay paid. But biggest value to eBay may not be in the voice business but in creating a trust community that frustrates phishing and local gatekeepers. The basic concepts should work fine even with the code fully exposed -- that's a basic tenet of secure communications.

The Skype approach doesn't solve all problems of edge relationships. For example, how do you know the JohnSmith you are trying to reach is the one you think it is? Of course you have the same problem in the real world in recognizing friend vs foe so we must tolerate surprises.

The authors of the paper focused on the crypto aspects. The real importance is in helping others understand how to create communities that operate at the edge of the network independent. The next challenge is how to make these communities more distributed and interoperable.

Skype, not "Internet 2" represents the future of connectivity. As I keep trying to explain (mostly on http://www.frankston.com/public/writings.asp) we have to create connectivity from the edge rather than relying on today's carrier networks. Today's tele/communications is no more the future of connectivity than pulp-fiction is the future of selling lumber.