IETF Logo Mail Archive

Re: [perpass] A reminder, the Network is the Enemy...

David Conrad <drc@virtualized.org> Fri, 06 December 2013 16:12 UTC

Return-Path: <drc@virtualized.org>
X-Original-To: perpass@ietfa.amsl.com
Delivered-To: perpass@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 569E51AE092 for <perpass@ietfa.amsl.com>; Fri, 6 Dec 2013 08:12:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.903
X-Spam-Level:
X-Spam-Status: No, score=-1.903 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OFBt4Ixmkw9x for <perpass@ietfa.amsl.com>; Fri, 6 Dec 2013 08:12:22 -0800 (PST)
Received: from alpha.virtualized.org (alpha.virtualized.org [199.233.229.186]) by ietfa.amsl.com (Postfix) with ESMTP id 33D531ADFFB for <perpass@ietf.org>; Fri, 6 Dec 2013 08:12:22 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by alpha.virtualized.org (Postfix) with ESMTP id EA65A84CEF; Fri, 6 Dec 2013 11:12:17 -0500 (EST)
Received: from alpha.virtualized.org ([127.0.0.1]) by localhost (alpha.virtualized.org [127.0.0.1]) (maiad, port 10024) with ESMTP id 25333-05; Fri, 6 Dec 2013 11:12:17 -0500 (EST)
Received: from [10.0.1.6] (c-24-4-109-25.hsd1.ca.comcast.net [24.4.109.25]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: drc@virtualized.org) by alpha.virtualized.org (Postfix) with ESMTPSA id 4BEF5848F1; Fri, 6 Dec 2013 11:12:15 -0500 (EST)
Content-Type: multipart/signed; boundary="Apple-Mail=_DCAC32BC-8923-49F0-B075-7E9FC741B5FE"; protocol="application/pgp-signature"; micalg="pgp-sha1"
Mime-Version: 1.0 (Mac OS X Mail 7.0 \(1822\))
From: David Conrad <drc@virtualized.org>
In-Reply-To: <CAMm+LwgJU9DSyrOCi0h7WfV4m4ULAAXqnQt9=PUaonTtvU5mzw@mail.gmail.com>
Date: Fri, 06 Dec 2013 08:12:12 -0800
Message-Id: <30BA9CB8-129F-4D9A-AF5F-EB6309A4F15A@virtualized.org>
References: <C0D19C51-6EA6-4EAF-B9CB-D80F673262E5@icsi.berkeley.edu> <52A050E7.8010405@uni-due.de> <m2y53z1g2r.wl%randy@psg.com> <CAMm+LwgJU9DSyrOCi0h7WfV4m4ULAAXqnQt9=PUaonTtvU5mzw@mail.gmail.com>
To: Phillip Hallam-Baker <hallam@gmail.com>
X-Mailer: Apple Mail (2.1822)
Cc: Randy Bush <randy@psg.com>, perpass <perpass@ietf.org>, Matthäus Wander <matthaeus.wander@uni-due.de>
Subject: Re: [perpass] A reminder, the Network is the Enemy...
X-BeenThere: perpass@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "The perpass list is for IETF discussion of pervasive monitoring. " <perpass.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/perpass>, <mailto:perpass-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/perpass/>
List-Post: <mailto:perpass@ietf.org>
List-Help: <mailto:perpass-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/perpass>, <mailto:perpass-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Dec 2013 16:12:24 -0000

On Dec 5, 2013, at 7:27 AM, Phillip Hallam-Baker <hallam@gmail.com> wrote:
> A better approach is to design the system so that it takes a defection by more than one party. Instead of relying on just the ICANN root KSK require a TLD to be signed by three out of five trusted national cryptolabs.

Trusted by whom? E.g., trusted like NIST now? (No disrespect of folks at NIST intended: just observing some may no longer view them as trustable)

I personally believe a better approach is to make the operation of the system extremely public and documented such that it doesn't matter who is involved since the risk would be too high that attempts at compromise would be observed. This is what ICANN tried to do with the root KSK (one can argue whether they succeeded). 

Regards,
-drc

v2.23.0 | Report a Bug | By Email