Re: [Secdispatch] Quantum Resiliant

[Michael Richardson <[e-mail]>]

Phillip Hallam-Baker <[e-mail]> wrote:
    > Class 2 presents some very interesting challenges as Lamport signatures
    > are statefull so we need a way to manage the state. Another approach
    > that could be interesting is to attempt a federated version of
    > Kerberos. CAs become Kerberos ticket granters.

    > So lets say I am trying to contact Amazon.com, I do this using a ticket I
    > have acquired from TicketCo which has a shared ticket with both of us.

    > Easy! OK, but how do I establish that shared ticket? Well I am going to
    > have to meet each CA in person or rely on some sort of federated
    > introduction infrastructure and we end up with multiple inputs to KDFs or
    > Shamir secret sharing and the like.

What's the business model for TicketCo?

While it might be declassez to ask such a question at the IETF, we do need to
understand where TicketCo's incentives are, in order to know if they are
aligned with the user.  We need to know in order to answer privacy and
security questions.

And also to know how it is that such an entity could come to exist at all.

It seems like it might have to wind up as a sunk cost for Enterprises, ISPs
and other Institutions.  DNS registrars?  The existing Certificate
Authority "cabal^H^HFORUM"?

Otherwise, it's gonna be facebook, google, amazon, apple, etc. (We clearly
need a TLA for this "group". See below)

Google could do this unilaterally today, leveraging Chrome and their
WebMaster interface.  Unilaterally sounds dark; someone could repaint this as
permissionless innovation if they prefer :-)
(A few rounds of AES256 has got to be faster than ECDSA operations)

A bitter-sweet point about this is that clearly governments/spy-agencies
would like to operate TicketCo, because it potentially gives them the power
they have always wanted, but math has denied them.  Bitter-sweet: looking to
the RCMP to rescue me from hegemony of Apple/Facebook/Amazon/Google/Others)
(AFAGO? AGAFO? OFAGA? OGAFA?)

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-