[Privacy-pass] "Correctness" in draft-ietf-privacypass-key-consistency-00

[Richard Barnes <[e-mail]>]

Hi all,

In prep for Friday's meeting, I took a look at this document.  Overall, it
seems like a helpful summary of the options.

The document goes astray, though in trying to do anything about
"correctness":

> key correctness is that the key's secret information is controlled by the
intended entity and is not known to be available to an external attacker

These are not properties that any cryptographic protocol will ever be able
to prove, so there's no point to stating it as an objective.  As I put it
to Chris Wood earlier, it's like saying "This is a protocol for assuring
that Chris gives consistent answers and has pure intentions."  I get the
consistency bits, but you're never going to prove that Chris has pure
intentions, so why even mention it?

I suspect what the authors are after is a notion more like, "the key the
client uses is the one published by the server".  But that's more of a
standard data origin authentication property, maybe with some notion of
freshness.  It's about the fidelity of the server's instruction to clients,
not what private values the server controls or what an attacker knows.

Hope that helps,
--Richard