<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Dear Joe & elijah (or Elijah?),<div><br></div><div><div apple-content-edited="true"><div>On Oct 3, 2014, at 12:54 PM, elijah <<a href="mailto:elijah@riseup.net">elijah@riseup.net</a>> wrote:</div><blockquote type="cite"><blockquote type="cite">In the CT world, auditing and monitoring are two very different things,<br>and they must not be confused.<br><br>Auditing does not detect mis-issued certificates/keys/whatever before<br>the fact, during the fact, or after the fact [1].<br></blockquote><br>Hmmm... I am not even talking about CT, but the general class of<br>approaches that rely on auditing (of which CT is one example).<br><br>It feels to me that you are compelled to keep bringing up this point<br>about CT, even in reply to tangentially related posts, because you have<br>not received any sense that others understand your critique.</blockquote><div apple-content-edited="true"><br></div><div apple-content-edited="true">Well, I have received the sense that some have understood the critique. It's just that I see what appear to be false/inaccurate understandings of CT being spread around and that's when I feel the urge to speak up. Isn't it important that everyone who is discussing and making decisions about CT have an accurate understanding of it?</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><blockquote type="cite">Your scenario, afaik, is an attacker who can mitm any and all network<br>connections and so can inject bad data in the gossip among monitors and<br>the connections between user-agents-auditors and monitors. To me, this<br>assumes that this global mitm attack has existed for all time, since<br>once a user agent or a monitor is able to initially bootstrap some<br>correctly authenticated secure connection with a monitor, they should be<br>able to detect subsequent mitm attempts from that point forward.<br></blockquote><br></div><div apple-content-edited="true">It does not assume a global MITM, but a global MITM is possible. It certainly is not discussing MITMs who are performing attacks in perpetuity (that is impractical).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">There are two attacks mentioned in that post, one of which you loosely described above here (with the exception that I'm not discussing a perpetual MITM attack).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The other is simply the traditional TLS MITM attack wherein a CA issues a fraudulent cert (the primary impetus for CT). The post was updated (search it for "September 27") to point out that CT doesn't actually guarantee detection of this basic attack.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The original attack is potentially catchable via gossip of STHs after the fact, depending on how that gossip is implemented.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The traditional attack is not. Here a copy of the update that was made to the post, where this is discussed:</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">###</div><div apple-content-edited="true"><br></div></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div apple-content-edited="true"><div apple-content-edited="true">I’m not sure how no one brought this up until recently [1], but the attack can be much simpler. None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [2]. On the other hand, if CT switches to using SCTs for gossip [3], that might successfully catch the CA responsible if the MITM leaves [4] and if the server software keeps track of all the certs it issued. It will not help, however, if a revoked certificate was used for MITM.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">[1] <a href="http://www.ietf.org/mail-archive/web/trans/current/msg00588.html">http://www.ietf.org/mail-archive/web/trans/current/msg00588.html</a></div><div apple-content-edited="true">[2] <a href="https://moderncrypto.org/mail-archive/messaging/2014/000873.html">https://moderncrypto.org/mail-archive/messaging/2014/000873.html</a></div><div apple-content-edited="true">[3] <a href="http://www.ietf.org/proceedings/90/slides/slides-90-trans-2.pdf">http://www.ietf.org/proceedings/90/slides/slides-90-trans-2.pdf</a></div><div apple-content-edited="true">[4] <a href="http://www.ietf.org/mail-archive/web/trans/current/msg00600.html">http://www.ietf.org/mail-archive/web/trans/current/msg00600.html</a></div></div></div></blockquote><div><div apple-content-edited="true"><div apple-content-edited="true"><br></div><div apple-content-edited="true">###</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Back to your questions:</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><blockquote type="cite">(1) do you agree that once correctly authenticated connections are<br>established with monitors that future mitm will be prevented (connection<br>will fail close, system will refuse to work)?</blockquote><br></div><div apple-content-edited="true">I'm not sure what you mean by "future mitm" (could you elaborate? is this referring to before-the-fact? for the same website? same MITM?).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">So I'll give you a "tentative yes" (depending on your answers) so long as these conditions are met:</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">1. The Monitor is trustworthy (doesn't lie).</div><div apple-content-edited="true">2. The Monitor monitors *all* possible logs.</div><div apple-content-edited="true">3. This system is feasible in reality (quite a lot to ask of the Monitor).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><blockquote type="cite">(2) if not, do you agree that CT could be modified to perform in this manner?</blockquote></div><div apple-content-edited="true"><br></div><div apple-content-edited="true">In the post and in the quote from it above I showed how gossip can be done in a way that catches the MITM (by gossiping certs between clients/servers). Note that this mechanism can be done today without needing to rely on Monitors, Auditors, Merkle Trees, or any of the rest of the CT system.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Now, to answer Joe:</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><div>On Oct 3, 2014, at 2:03 PM, Joseph Bonneau <<a href="mailto:jbonneau@gmail.com">jbonneau@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">I'd add a third question: in the threat model in which CT doesn't work, does a blockchain-based approach work? Can't a permanent MITM that a user doesn't have any secure channel to avoid also confuse that user into accepting an incorrect block chain?</blockquote><div><br></div><div>This question was brought up by Tony over on [metzdowd] and thoroughly dissected.</div><div><br></div><div>TLDR: We are not discussing permanent MITM (those break all systems), but for non-permanent MITM the blockchain provides better protection than CT for numerous reasons, including:</div><div><br></div><div>1. MITM cannot attack the data that has been downloaded and unlike CT there is only one log to monitor [everything prior to the fork is accurate in other words],</div><div>2. It is far easier for Alice to detect and recover from an attack, and </div><div>3. There is a very tiny window in which a meaningful attack can occur [MITM would need to anticipate the exact time of registration, a nearly impossible task, to falsify data, and beyond that it can only censor updates, not falsify them].</div></div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><div>For the complete answer, see these emails and surrounding ones (feel free to read the whole thread if you have the free time). They are in reverse chronological order:</div><div><br></div><div>- <a href="http://www.metzdowd.com/pipermail/cryptography/2014-September/023035.html">http://www.metzdowd.com/pipermail/cryptography/2014-September/023035.html</a></div><div>- <a href="http://www.metzdowd.com/pipermail/cryptography/2014-September/023034.html">http://www.metzdowd.com/pipermail/cryptography/2014-September/023034.html</a></div><div>- <a href="http://www.metzdowd.com/pipermail/cryptography/2014-September/023031.html">http://www.metzdowd.com/pipermail/cryptography/2014-September/023031.html</a></div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div></div><br><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <br></div></body></html>