Re: [Privacy-pass] Draft on key consistency and discovery

Thanks!  Some notes:

>    Privacy-focused protocols which rely on widely shared public keys
>   typically require keys be consistent and correct.

Is TLS not a privacy-focused protocol?  I guess not by this definition.  A
"terms" section could help.

>   *  Presenting a signed assertion from a trusted entity that the key
>      is correct.

Do you mean "the key is universal/consistent"?

>   *  Presenting proof that the key is present in some tamper-proof log,
>      similar to Certificate Transparency ([RFC6962]) logs.

Do you mean that the log would apply some policy to prevent large numbers
of keys (prevention)?  Or that an external auditor could use the log to
accuse the server of a policy violation (deterrence)?

>   *  The proxy can give all users a key owned by the proxy, and either
>      collude with the server to use this key or retroactively use this
>      key to compromise user privacy when users later make use of the
>      key.

The latter vulnerability seems easily avoided, no?  If the server has a
domain name, for example, it can easily sign its current "universal key"
with a public key that is tied to the name (e.g. a DV X.509 certificate).

For Privacy Pass, at least, there is potentially a presumption that the
user has access to the network in a way that hides their identity and does
not collude with the target.  This might mean that the user's DNS resolver
is presumed to be trusted.  In that model, the resolver could act like a
trusted proxy (Section 4.2).

On Mon, Feb 22, 2021 at 6:13 PM Christopher Wood <caw@heapingbits.net>
wrote:

> A few of us put together a draft describing various requirements and
> possible solutions for key consistency and discovery:
>
>    https://datatracker.ietf.org/doc/draft-wood-key-consistency/
>
> The result be of interest to folks in this WG. If there is room on the
> agenda for a discussion around this topic, especially as it pertains to
> Privacy Pass, I would be happy to present it during the upcoming IETF 110
> meeting.
>
> Best,
> Chris
>
> --
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass
>

Re: [Privacy-pass] Draft on key consistency and discovery

Attachment: smime.p7s