Re: [saag] Direct trust between users

[Nico Williams <[e-mail]>]

On Wed, Apr 24, 2019 at 01:56:40PM -0400, Phillip Hallam-Baker wrote:
> So we have an assertion that my public key is MC23-... dated 2019-Jul-18.
> It would have cost $1000 to forge that assertion before that date and
> $infinity to forge afterwards.

ISTM that it's $1000 (or whatever) the first and _every_ time.  That's
because the blockchain will have to support the "help, I've lost my one
and only device!" or "help, I've lost all my devices!" cases.

E.g., you're on a plane that lands on the Hudson river and you have to
leave everything behind, including your laptop, tablet, and phone, and
you're thousands of miles away from your desktop device or backups.
Now, you could just cancel everything and fly home (after drying up
anyways), but this may be very costly in time and money so you probably
won't want to.

> So why might we want to do key signing at IETFs?
> 
> Well we write code and some of that code ends up on GitHub and makes its
> way into software used in the wild. So credentialling IETF-ers would be
> pretty useful. Credentialling the Linux Plumbers etc. is probably even more
> useful. Probably a good thing if we could do something at Black Hat or RSA.
> 
> We could probably deliver a real improvement in the robustness of the
> Internet software development ecosystem if we produced a system serving
> 10,000 or so users and was never used by outside that community.

I agree with this.

> So how might it work?
> 
> I have done a few sketches but I haven't come to a firm conclusion on how
> to realize the crypto yet.

It's a PGP-alike with a blockchain and with keyservers that participate
in the blockchain, and a few very popular people (or conferences, or
even large corporations) who act as notable notaries.  Without a work
factor this is a like like a distributed Merkle hash tree.

> The simplest user experience to implement would be to have an app for
> mobile devices that can be used to scan a dynamic QR code presented on a
> screen near the registration desk. This would provide the necessary crypto
> info to complete the key signing.

We're assuming trusted devices, but we practically have to anyways, so,
sure.

> We could go further and make it so that scanning the QR code tells the
> attendee which line to join and causes the registration staff to be told
> which badges to find next. The registration staff could then check
> government issued ID, hand over the badge and tell the system the ID
> matched.

The ID check is not going to be that good.  As with PGP, having
something of a key signing party where people who know you vouch for you
(and vice-versa) seems better.  This is where a notion of security level
starts creeping in: do I trust the IETF registrar more than I trust an
IETF participant I've known for decades?  If I do take the registrar's
say-so at face value and have N>100 interactions with you where I have
every reason to think it's you every time, does the security level go
up, and do I get to say that or does it happen automatically?

Nico
--