Re: HTTP/2 and Pervasive Monitoring

["Poul-Henning Kamp" <[e-mail]>]

--------
In message <[e-mail]>, Stephen Farrell writes:

>PHK and I disagree a bit about the definition of PM in that respect.
>I conclude that BCP188 would include storing breakable ciphertext in
>the definition of PM. He doesn't.

Stephen, you're free to express your own opinion, but I think it
would be best if you let me express mine.

My argument is that if the attacker captures and stores N>1 connections
in the same time he manages to break the crypt on 1 connection,
then it is by definition not PM, since he will not ever be able to
decrypt all the traffic.

The footnote to this is that that the attacker still gets to chose
which fraction of the traffic to spend his limited resources breaking
the crypto on, so N has to be very large before it affects human
rights in a relevant fashion.  PM probably already only captures
metadata for most of the porn traffic, major news sites etc and
certainly would give such a resource constraint.

Also note, that getting the 99% out from under PM by sacrificing
the 1%, is not a final solution to the human rights problem, and
skirts dangerously Martin Niemöllers warning.

In the present situation my straw-man it at best just stopgap measure
until the political process implements the correct solution to the
PM problem.  On the long scale it could also vaccinate the net
against recurrences or regimes where political solutions are not
forthcoming.

The important thing in my straw-man is not if we should or shouldn't
do it, but the fact that PM can be made impossible with ciphersuites
you can break in a matter of seconds.

That observation should be made part of our BCP188 response, because
clearly a lot of people don't realize this.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[e-mail]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.