[Privacy-pass] Searching for simplicity

[Ben Schwartz <[e-mail]>]

Hi all,

Not as chair.

I found the discussion today of "preventing abusive account creation", and
the goal of "ensuring that no single party knows both the stable client ID
and the origin name", very helpful to understand the requirements for the
rate-limiting proposal.  After reviewing the draft, it seems that it has
already been simplified substantially (no Schnorr proofs!), so I can
certainly believe that this is the simplest instantiation.

Some questions for the authors:
 * Are you assuming that the client enforces some limit on the number of
distinct Issuers, as discussed in other Privacy Pass drafts?  If any origin
operates its own private Issuer, the Attester ends up learning that the
user visited that origin, violating the separation goal.  Do you intend to
prevent this?
 * The draft notes that "The Origin does not learn which Attester was used
by a Client for issuance".  Is this a requirement?  Would relaxing it allow
any simplifications?  Does this hold true if there is an Issuer that issues
tokens to only one Attester?

I would also appreciate some thought on the post-compromise properties of
this system, e.g. describing the downstream implications of a misbehavior
of one of these parties.

Thanks,
Ben Schwartz