Re: [Eligibility-discuss] On 3797 alternatives

[Donald Eastlake <[e-mail]>]

Hi Martin,

On Tue, May 30, 2023 at 7:51 AM Martin Thomson <[e-mail]> wrote:

I am replying just to your point below which seems equally applicable
to 3797 and Paul's draft even if the entropy in the method in Paul's
draft is increased to about what it is in 3797:

> Ekr's point about requirements is important.  We want an outcome
> that is hard to predict.  Our threat model allows an attacker to
> know the set of candidates and to manipulate it.  Therefore, in
> addition to being independently verifiable, any selection procedure
> needs to inject sufficient entropy.  We do this so that it is
> infeasible to alter the inputs in such a way as to alter the outcome
> toward an attacker's preferred choice, even with low
> probability[*].  This means the analysis in 3797 is flawed.  That
> concentrates on ensuring that the amount of entropy exceeds the
> number of permutations possible in the outcome, where what is needed
> is entropy sufficient to make an enumeration of possible outcomes
> impractical.

I disagree. First of all, you are assuming one attacker. If there is
more than one, they interfere with each other and none can predict the
results of some attempted manipulation. Furthermore, the attacker
cannot practically add people, since there is no need to announce the
list before it is closed to additional volunteers. They could possibly
remove people by having volunteers that they would direct to decline
to serve.

If you have enough entropy that the probability of each possible set
of selections deviates only insignificantly from random, then all an
attacker can do to try to get a particular person selected is (1) make
the pool smaller or (2) stuff the pool with ringers who will decline
to serve if selected. But, if you re-randomize, I think 2 is no better
than 1. Say the attacker wants a particular person selected and they
stuff in 10 ringers and the total number of volunteers in the pool is
100. Say the person the attacker wants selected in not in the initial
10 selectees but 5 of them are ringers who the attacker directs to
decline to serve. The probability of the person the attacker wants
selected to be selected in the next round is 1 in 90, exactly what it
would have been if those 5 ringers were not in the pool and 5 people
had already been selected. So, the attacker has gained nothing in the
case of enough entropy at each stage.

Large amounts of publicly trusted entropy are not that easy to
collect. I am inclined, based on your points, to change rfc3797bis to
recommend enough entropy to be able to produce all possible selections
but no more than that.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [e-mail]

>
> ...
>