Re: [Secdispatch] Dispatching draft on key consistency

[Michael Richardson <[e-mail]>]

Christopher Wood <[e-mail]> wrote:
    > There are a number of different protocols that require multiple clients
    > to discover a common — or consistent — cryptographic public key for
    > use, including: Privacy Pass [1], Oblivious DoH [2], and Oblivious HTTP
    > [3]. Consistency here means that all clients obtain the same view of
    > the public key. An inconsistent view can lead to privacy attacks.

    > For example, in Privacy Pass, if an attacker can somehow force a single
    > (set of) client(s) to use a public key that is distinct from all other
    > clients, then the key used effectively partitions the set of clients
    > into two buckets, and the size and number of these partitions influence
    > the overall privacy posture of the protocol.

"somehow" ... such an attacker can substitute any on-path attacker key.
I don't see how this is distinct from all the other attacks.

    > [4] https://datatracker.ietf.org/doc/draft-wood-key-consistency/
    > [5] https://datatracker.ietf.org/doc/slides-110-privacypass-key-consistency-and-discovery/

In reviewing the documents, it seems that it's not "somehow", it's that the proxy has been
persuaded to collude with a third party.  Perhaps that would be better to say.
Perhaps "persuaded" is the wrong term as well, since I think that the goal is
to defend the proxy against NSLs that would force the proxy to collude.

What is needed is a kind of canary such that for clients can detect when they
are being singled out, and then refuse to operate with that proxy.  By
existence of such a mechanism, proxies can effectively render themselves
useless to such forms of "persuasion".

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide