Re: [Privacy-pass] Questions on client trust

[Chelsea Komlo <[e-mail]>]

Hi Alex,

Thanks for opening these issues- looking forward to these discussions.

On Tue, Apr 14, 2020 at 5:24 AM Alex Davidson <[e-mail]>
wrote:

> Hi Chelsea & Matt,
>
> Thanks for taking the time to review the current documents. Your insights
> are really valuable and raise a number of points that do indeed require
> addressing. I’ve inlined my responses below.
>
 [...]

> I agree that trusted registries are still not very well-defined. I expect
> that, if we decide to go down the trusted registry route, the user-registry
> trust dynamic will be similar to the trust dynamic between user and Issuer.
> We will need mechanisms for the clients to ascertain the state of this
> dynamic and subsequently act on that. Ideally, we would have some more
> discussion on whether the trusted registry approach is the right path to
> take, or whether an alternative approach may be better suited (such as
> those raised by Steven in the BoF).
>
>
After thinking through how to verify registry behavior more, one additional
consideration that may be worth exploring is immediate versus eventual
verification/detection. While immediately detecting a registry's
misbehavior is ideal, if this approach proves too difficult to implement in
practice, it could be worth exploring if a relaxation to eventual detection
is a more acceptable alternative.

One simple example I can think of for eventual detection of registry
misbehavior is in the setting of Tor (but could be adapted more broadly).
Clients could easily build several different circuits to a registry to
request an issuer's public key, so the attack of selectively issuing
different public keys is more difficult to hide (as the registry cannot
differentiate a single client with multiple different Tor circuits from
multiple different clients). I suspect there are other smaller-scoped
alternatives in this category.

Thanks again,
Chelsea