Re: [Cfrg] (on Algebraic Eraser) Re: Meeting notes

[Nico Williams <[e-mail]>]

On Mon, Mar 30, 2015 at 02:00:21PM -0400, Rene Struik wrote:
> Perhaps. However, please start a new topic thread then. {with

Subject: Re: [Cfrg] (on Algebraic Eraser) Re:  Meeting notes
                     ^^^^^^^^^^^^^^^^^^^       ^^^^^^^^^^^^^

If parameter generation is not to be discussed in this thread (it
certainly came up during the meeting whose notes we're discussing), what
is?  According to whom?

> hopefully carefully contemplated thoughts, rather than twitter-like
> trigger-happy traffic}

The observation that AE might require careful parameter generation
ceremonies had to come before (or with) any proposals for specific
ceremony procedures, and it seems like a critical aspect of AE
application to many possible use-cases.  It's not "twitter-like" to say
so.

(As if, too, twitterings could never be meaningful, important, pithy,
valuable, ...  That seems like a middle-school insult, which, as you can
see, we're all capable of.  Better just not get started. :)

AE's TTP backdoor makes it difficult to conceive of a believable
ceremony, particularly one that will be believed decades after the fact.

Part of the problem is social/political.  So far all sketches of such a
ceremony that I can come up with are mainly about using hardware so
simple that various participants can verify that there are no covert
channels of any sort via which the seed could be communicated to anyone
during or after the ceremony.  The "after" part is trivial: incinerate
the hardware in place, dynamiting it if need be.  The "during" part is
really difficult, and leads me to suggest using 8-bit hardware from the
early 80s.  But really, it's a hard problem, and not in the crypto
sense.

It'd be more productive to find use-cases where the backdoor-capable TTP
is either desirable or not fatal.  For IoT, per-household user-generated
parameters seems utterly acceptable.  Derek suggested (at the meeting)
that a backdoor-capable TTP might be acceptable for DNS root keys, and I
don't yet disagree[*].

[*] I would prefer to ensure that there is no backdoor, and that use of
    the root key be auditable in any case.  But I also tend to think
    that CT for DNSSEC may work well enough.  It's much too soon to tell
    though, which is why I don't yet take a position.

Nico
--