Parsing is not attestation: why a syntactically valid subject is still untrusted

Reading the Draft · No. 3 · Source: draft-li-rttp-iqa-addressing-00 §5.2 / §5.5.1 / §6.1-6.2 · Sister pillars: rttp:// (CRI 27) · iqa:// (CRI 28)

An Identity Quality Assurance (IQA) URI looks like this: iqa://3f9a1b2c.gateway.iqa — eight hex digits, shaped like a miniature credential. That is precisely the question this piece answers: what does a syntactically valid subject string actually prove? The answer: nothing. And the specification builds three defenses around that nothing.

The first is in Section 5.2: "The hexadecimal subject form is a routing hint, not evidence. It carries no verification weight; identity is bound outside the URI and is never established by parsing one." Eight hex digits are a 32-bit space with a birthday floor of 2^16 — short enough to be collided, enumerated, and forged into something that looks perfectly respectable. Its entire job is "helping you find the path you still have to verify," and nothing more.

The second defense has a section title that is itself the conclusion — "Parsing Is Not Attestation": "A client that displays a parsed or rendered iqa URI MUST NOT present the result as evidence of standing. Reading the syntax establishes nothing about any subject; standing is established only by the answer of the named organ, under the rules of the reference specification." The target of this ban is every interface: badges, status lights, checkmark icons — any UI that renders "parsed successfully" as "verified" is a non-conformant implementation.

The third is in Section 6.1, the symmetric statement on the rttp side: "The derived address is an entry fingerprint, not a proof of identity. Identity is carried by the subject's AID, and any attestation of it is carried separately." Here the two pillars complete their division of labor: the address answers WHERE & WHEN, the envelope answers WHETHER — hash self-consistency is not provenance, and a self-consistent fresh keypair fools no verifier who understands derivation.

Why so harsh? Because "syntactically correct" is the one thing a forger gets for free. The grammar is public; anyone can write a well-formed iqa URI. If well-formedness bought trust, the whole system would degrade into "whoever dares to write it is trustworthy." So the specification moves the entire weight of trust out of the syntax: the syntax addresses, the organ's answer proves — and neither substitutes for the other.

One line: parsing is what a machine does; attestation is what an organ answers — keeping those two apart is the single clause of the iqa scheme we are least willing to bend.