Re: [perpass] Getting started...

Stephen Farrell <stephen.farrell@cs.tcd.ie> Sat, 17 August 2013 11:52 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: perpass@ietfa.amsl.com
Delivered-To: perpass@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F07511E8106 for <perpass@ietfa.amsl.com>; Sat, 17 Aug 2013 04:52:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level:
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ajYRljeWH4AL for <perpass@ietfa.amsl.com>; Sat, 17 Aug 2013 04:52:39 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id 83EA911E8104 for <perpass@ietf.org>; Sat, 17 Aug 2013 04:52:39 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AAA10BE24; Sat, 17 Aug 2013 12:52:38 +0100 (IST)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GOggNji4IEv7; Sat, 17 Aug 2013 12:52:37 +0100 (IST)
Received: from [10.87.48.8] (unknown [86.44.67.197]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 71572BE1C; Sat, 17 Aug 2013 12:52:37 +0100 (IST)
Message-ID: <520F6405.6010102@cs.tcd.ie>
Date: Sat, 17 Aug 2013 12:52:37 +0100
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130803 Thunderbird/17.0.8
MIME-Version: 1.0
To: Ben Laurie <benl@google.com>
References: <520E5684.1090005@cs.tcd.ie> <CABrd9SS6txRujNLbLqscKncK+Q=9YLPzX_3-sNuLP56VFMBLiw@mail.gmail.com>
In-Reply-To: <CABrd9SS6txRujNLbLqscKncK+Q=9YLPzX_3-sNuLP56VFMBLiw@mail.gmail.com>
X-Enigmail-Version: 1.5.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: perpass@ietf.org
Subject: Re: [perpass] Getting started...
X-BeenThere: perpass@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "The perpass list is for discussion of the privacy properties of IETF protocols and concrete ways in which those could be improved. " <perpass.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/perpass>, <mailto:perpass-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/perpass>
List-Post: <mailto:perpass@ietf.org>
List-Help: <mailto:perpass-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/perpass>, <mailto:perpass-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Aug 2013 11:52:44 -0000

Hi Ben,

On 08/17/2013 12:37 PM, Ben Laurie wrote:
> On 16 August 2013 12:42, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
>> what should we be doing?
> 
> 
> Certificate Transparency is an anti-monitoring tool, amongst other useful
> properties.

Yep. Its a fine tool but more I guess directed at countering
an active attacker who spoofs as a web site and then monitors
or snarfs passwords or whatever.

> The more generalised idea of a public, verifiable log of stuff is probably
> useful in other ways, too.
> 
> For example, DNSSEC Transparency (OK, hardly much different from CT).
> 
> Someone mentioned default encrypting emails: sparse Merkle trees are an
> efficient data structure for making a verifiable map of email addresses to
> public keys...

neat idea... maybe.

However, that and other foo-transparency ideas also require
clients to ask the log about stuff, in a way that the log
can.... log.

For CT, thats ok since the web site itself (or its
auditors) can contact the CT log, but I wonder if that'd
become a problem for other foo-transparency applications,
e.g. how could an MUA query a log of public keys without
exposing the meta-data that I'm sending you an encrypted
message?

> Yes, I have a hammer and I am looking for nails.

:-)

S.

> 
> 
> 
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass
>