MIME-Version: 1.0
References: <CAMm+LwiZqA=M90YdmQOV+sAy+T-prhzphct2bsOyPmaQ4V2oOA@mail.gmail.com>
 <6241.1567487279@localhost>
 <CAMm+LwhKHHz8e6b2C61zjFDv+shsLsBgxaAv=88dFG3kdJ9Fiw@mail.gmail.com>
 <14973.1567579627@dooku.sandelman.ca>
 <CAMm+LwhYv+m3swyipb5_7_N0-f0wM4MBSW4KFz4c=WT4jQzHfw@mail.gmail.com>
 <20190909163813.GG7920@localhost>
In-Reply-To: <20190909163813.GG7920@localhost>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Mon, 9 Sep 2019 23:02:41 -0400
Message-ID: <CAMm+LwizQf_s6rAw8x8m1rOU=5E+NyWsLaGpguBctOBhxcMhtw@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>, mathmesh@ietf.org,
 cfrg@irtf.org
Content-Type: multipart/alternative; boundary="000000000000ec837205922a2305"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/W6w_jGu6a9OsRpPHvit4yDCwQos>
Subject: Re: [Cfrg] [Mathmesh] A different approach to key escrow
Precedence: list

--000000000000ec837205922a2305
Content-Type: text/plain; charset="UTF-8"

On Mon, Sep 9, 2019 at 12:38 PM Nico Williams <nico@cryptonector.com> wrote:

>
> Speaking of which, how does master secret change work?
>

That might not be so critical with the changes I made to the way accounts
work.

The master secret for the Mesh is only used in the management of the user's
Mesh devices. It is no longer something that is exposed to other people.
Only the account keys are exposed to other users.

What we probably need to do is to go through the scenarios that would
require re-keying a personal Mesh.

The way that would have least impact on other systems would be to simply
create a parallel Mesh and then create an assertion 'the person who used to
have fingerprint X now has fingerprint Y'. And then various parties would
have to decide the extent to which they trust that assertion.

--000000000000ec837205922a2305
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon=
t-size:small">On Mon, Sep 9, 2019 at 12:38 PM Nico Williams &lt;<a href=3D"=
mailto:nico@cryptonector.com">nico@cryptonector.com</a>&gt; wrote:<br></div=
></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex"><br>
Speaking of which, how does master secret change work?<br></blockquote><div=
><br></div><div class=3D"gmail_default" style=3D"font-size:small">That migh=
t not be so critical with the changes I made to the way accounts work.</div=
><div class=3D"gmail_default" style=3D"font-size:small"><br></div><div clas=
s=3D"gmail_default" style=3D"font-size:small">The master secret for the Mes=
h is only used in the management of the user&#39;s Mesh devices. It is no l=
onger something that is exposed to other people. Only the account keys are =
exposed to other users.<br></div><div class=3D"gmail_default" style=3D"font=
-size:small"><br></div><div class=3D"gmail_default" style=3D"font-size:smal=
l">What we probably need to do is to go through the scenarios that would re=
quire re-keying a personal Mesh.=C2=A0</div><div class=3D"gmail_default" st=
yle=3D"font-size:small"><br></div><div class=3D"gmail_default" style=3D"fon=
t-size:small">The way that would have least impact on other systems would b=
e to simply create a parallel Mesh and then create an assertion &#39;the pe=
rson who used to have fingerprint X now has fingerprint Y&#39;. And then va=
rious parties would have to decide the extent to which they trust that asse=
rtion.</div></div></div>

--000000000000ec837205922a2305--