Re: [CFRG] A Duck Test for End-to-End Secure Messaging: "Video Deck" on YouTube

[Alec Muffett <[e-mail]>]

Hi All!

Thank you for a great first CFRG experience.

One key comment/thread from the chat, which I just wanted to repeat here in
order to avoid confusion:

> Chris Lemmons: Yeah, we should avoid producing two different definitions
of e2ee.
> Alec Muffett: @Chris: for absolute clarity: I am NOT providing a
definition of E2EE. I am providing a test, possibly one of many, which
would invalidate claims of E2EE.
> Chris Lemmons: Alec: That's a good point. I had missed that. It's
important, though.

The first cut of this I-D was posted with an ill-advised, misconceived
name, referring to it as a definition.  That was foolish of me.

The process of developing this deck for presentation at CFRG has taught me
a huge amount* regarding how to think about and describe what this test is
offering - and it is not offering a definition.

The I-D provides one (single) mechanism to falsify claims of "end-to-end
security" (or: "end-to-end encryption?") being provided by a given solution.

There may be other mechanisms invented, and I would welcome them, and
welcome other research in this space.

Nonetheless: this test and this I-D do not live in the space of
definitions; they propose metrics of behaviour, and divide that behaviour
as being compliant with E2E, or not (i.e. "backdoor")

    -a

*learnings which I will clearly need to roll into the I-D.