Zooko's Triangle¶
A contested network-naming design triangle weighs human-readable names, secure binding, and decentralized control under explicit trust and namespace assumptions.
Core Idea¶
Zooko's triangle frames a network-naming design tension among readable names, secure name-to-target binding and decentralized control. Its “choose two” slogan is a historically important conjecture, not a proved theorem: the original author explicitly said he had not proved joint satisfaction impossible.[^ref-1cd852b0e8bc]
Scope of Application¶
RFC 4035's constructed “x.w.example.com” MX example gives a specific trace: the signed answer names an “example” DNSKEY (algorithm 5, key tag 38519); a validator authenticates that key through a configured root key or DS and the root-signed “example” DS before accepting the MX signature. The readable label and authenticated binding thus depend on an upstream delegation and initial trust choice; DNSSEC does not itself decide who may claim the label. Self-authenticating names can avoid one central allocator but are often opaque; a user may save key K as “workshop” while another saves it as “repair shop,” improving local display without giving K one globally shared name. These petname labels are an author-constructed trace of the original proposals. Ledger naming claims a different route and must be evaluated under consensus and governance assumptions.
Clarity¶
Separate a globally shared readable name from a personal nickname. Specify what “secure” protects against and which party or coalition can change a binding. A claimed escape may shift the trust model or the layer at which readability is supplied.
Manages Complexity¶
The triangle exposes opposed choices: a central allocator can settle collisions but becomes privileged; open claiming removes that office but transfers the burden to ordering and disputes. A self-authenticating identifier strengthens binding while losing easy human recognition; local petnames restore usability without global name agreement. A signed hierarchy has a clear validation path but depends on a configured anchor; consensus-ledger naming changes that authority structure without automatically proving security. It is misleading to call these choices a universal impossibility proof.
Abstract Reasoning¶
Define namespace and threat model, operationalize each property, then locate the authority or consensus mechanism that resolves collisions. Test any claimed all-three solution for local/global name substitution and conditional security assumptions.
Knowledge Transfer¶
The framework transfers across governed network identity systems that assign and resolve names under adversarial trust. Its general three-property skeleton is not a portable prime by itself: the named identity depends on human-facing name claims, target binding and local/global namespace distinctions. It conditionally presupposes Naming System as the design space being evaluated, but is not a subtype that itself assigns names. The live Trilemma prime requires an established impossibility that Zooko's original note expressly disclaims.
[^ref-1cd852b0e8bc]: Zooko Wilcox-O'Hearn, “Names: Distributed, Secure, Human-Readable: Choose Two,” version 0.9.1 (2001), archived original reproduced by Princeton, especially the author's explicit no-proof statement and petname proposal.
Relationships to Other Abstractions¶
Current abstraction Zooko's Triangle Domain-specific
Parents (1) — more general patterns this builds on
-
Zooko's Triangle presupposes, conditional Naming System Domain-specific
Evaluating Zooko's three design properties presupposes a governed network naming-system design space.
Hierarchy path (1) — routes to 1 parentless root
- Zooko's Triangle → Naming System → System → Composition → Gestalt Principles → Holism
Neighborhood in Abstraction Space¶
Zooko's Triangle sits in a sparse region of the domain-specific corpus (94th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.
Family — Network Security Vulnerabilities & Trust (26 abstractions)
Nearest neighbors
- Anonymous P2P — 0.79
- Authentication Failure — 0.79
- Distributed lock manager — 0.78
- Social VPN — 0.78
- Fallacy of the Secure Network — 0.78
Computed from structural-signature embeddings · 2026-10-08