Re: [Lurk] Lurk: new undetectable backdoor possibility?

Hi,

I am afraid I do not follow the rationale behind that supposed attack. If it is the key owner colluding with some data collector (government-related or not, why should be connected with a government?) would not be way easier to simply share the logs with that data collector?

Be goode,

On 30 Jun 2016, at 15:24 , Dmitry Belyavsky <beldmit@gmail.com<mailto:beldmit@gmail.com>> wrote:

Hello Thomas,

On Thu, Jun 30, 2016 at 3:04 PM, Fossati, Thomas (Nokia - GB) <thomas.fossati@nokia.com<mailto:thomas.fossati@nokia.com>> wrote:
Hi Dmitry

I think I found a new undetectable LURK-specific backdoor possibility.

The (government-related) attacker installs an extra frontend server and redirects a victim DNS requests to it.

The only thing the attacker needs from the key owner to perform this attack is a certificate to make the attacker's frontend server capable to send requests and obtain responses from the key server.

The attack described does not cause the Key owner's key compromise and does not require to issue a bogus certificate for the Key owner's domain. So if I am not mistaken, the attack is technically undetectable if the Key owner agrees to provide such a possibility.

Please correct me if I am wrong.

Is it an attack on the protocol if you need to collude with the Key owner to run it successfully?

No, the attack I describe is not an attack on the protocol.

It is an attack that can be named "Key abuse". And it is much "cheaper" to the Key owner than just providing a private key.

--
SY, Dmitry Belyavsky
_______________________________________________
Lurk mailing list
Lurk@ietf.org<mailto:Lurk@ietf.org>
https://www.ietf.org/mailman/listinfo/lurk

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: diego.r.lopez@telefonica.com<mailto:diego.r.lopez@telefonica.com>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição