[Secdispatch] The Mathematical Mesh

[Phillip Hallam-Baker <[e-mail]>]

Five years ago I started to look at the reasons that Internet users do not
use end-to-end secure mail despite the fact that almost every email client
in use supported S/MIME and OpenPGP had been available for decades.

In answering that question, I quickly realized that we were trying to solve
the problems we were interested in rather than the ones that the user
actually cared about. And yes, users do really care about security but
their security concerns are much broader than the ones raised on the
cypherpunks mailing lists. They are concerned about the control that
corporations might have over them much more than governments. They are
concerned with the risk of losing the pictures of their kids at 5 years old
to ransomware.

Carl Ellison says that the user base of any security protocol halves for
each click required to use it. This led me to ask, 'how can we reduce total
user effort' and not just effort required for security. Today we ask the
user to configure their email client twice, first to make use of email and
again to make email secure (and then we require them to redo the second
annually for S/MIME).

The result of this approach is an infrastructure I call the Mathematical
Mesh which I would like IETF participants to consider as a standards track
effort, either in part or in whole.

The goal of the Mesh is to make computers easier to use by making them more
secure. This is easier than people might imagine. The key here is that
every set of instructions that you write down and give to a human can be
written as code and given to a suitably authorized computer system.

The phrase suitably authorized is key here, often the reason manual
intervention is required to configure systems requires is that certain
system privileges are needed.

Like BitCoin, the Mesh extends the traditional cryptographic repertoire.
While all of the cryptographic techniques used in the Mesh are well
established in the academic field, this is the first time anyone has (to my
knowledge) proposed making use of them in an open standard.

The Mesh is designed to make full use of the capabilities of modern
computer systems: It is assumed that every user has access to a machine
with at least the capability of a Raspberry Pi Zero for purposes of
configuring an managing devices. Connection and use of constrained devices
of Arduino Mega class and above is also supported by offloading certain
security functions to a trusted gateway.

I am posting this here to solicit opinions as to whether I should bring
some or all of this work to the IETF or if I should take it to other forums.

The drafts are available in plaintext or HTML format. Since some of the
drafts make extensive use of mathematical notations, I recommend reading
them in the HTML format.

HTML:
http://mathmesh.com/Documents/draft-hallambaker-mesh-architecture.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-udf.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-dare.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-schema.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-protocol.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-trust.html
http://mathmesh.com/Documents/draft-hallambaker-mesh-cryptography.html

Plaintext:
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-architecture/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-udf/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-dare/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-schema/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-protocol/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-trust/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-cryptography/

These drafts are not yet complete as the example material and schema
documentation is still being revised. This will be addressed as the
reference code passes the remaining unit tests for each functional unit.
The principle adopted being that it is better to have no examples than
incorrect ones.

The following drafts are planned but not yet written:

https://datatracker.ietf.org/doc/draft-hallambaker-mesh-constrained/
https://datatracker.ietf.org/doc/draft-hallambaker-mesh-quantum/

The reference code is open source and runs in C# under .net Core. It is
currently tested only on the Windows platform but previous versions have
run on OSX and Linux.

https://github.com/hallambaker/Mathematical-Mesh

The code system is also open source. These tools allowed me to design,
implement and document a code base that is capable of performing
significant portions of the functions of PKIX, S/MIME, Blockchain, SMTP,
IMAP and TLS on my own in a little less than three years.

https://github.com/hallambaker/PHB-Build-Tools