Re: [MLS] Deniability without pairwise channels.

[Jeff Burdges <[e-mail]>]

> On 22 Jan 2020, at 10:54, Raphael Robert <raphael=[e-mail]> wrote:
> I hope I understood your correctly, you are essentially proposing a “sign & reveal” scheme. If not, I’m sorry, and please let me know.
> 
> What has become clearer in some of the discussion is that a “sign & reveal” scheme puts the burden of proof on the victim to some (large) extent. The attacker can publish a signature chain that starts with the public identity of the victim and ends with the signature of a specific message. This signature chain will most likely look valid to a third party at first sight. It then becomes the duty of the victim to prove that they indeed published secret keys and that therefore anyone could have signed the last part in the signature chain. For the victim, this is painful at best and impossible at worst. It would be much nicer if the attacker couldn’t publish such a signature chain in the first place.

Interesting thanks!

I suppose the victim could often be prevented from providing this proof too, like by evidence being “lost”, making this worse than no deniability.

It appears the golden rule for deniability is
  (*) anytime the parties have unequal power then deniability heavily favours party with more power,
so your observation provides a case when “sign & reveal” just makes (*) even worse.

I’ve never seen a “user story” that contradicts (*) but please do let me know if you think you know one, maybe off list if that’s a derail here.  I’d love to participate in some more user oriented formalisation of deniability eventually.  I do think deniability becomes useful when both parties have relatively equal power, although maybe the user interface suffices for the common messaging cases, but presumably properties related to full deniability become really useful in layer 2 blockchain scaling solutions like state channels.

Anyways in the vein of "sign & reveal” making (*) worse, I also want to caution that deniability schemes based on ring signatures actually make (*) worse because they prove that some party made the comment.  If you assume the parties have unequal power, as in a court case, then a ring signature effectively means the more powerful party can convince the court that the less powerful party signed the document.

Jeff