Re: [Secdispatch] Comments on draft-knodel-e2ee-definition-02

[Chelsea Komlo <[e-mail]>]

Hi Eric,

Thanks for this review; responses specifically for the succinct definition.

On Mon, Jul 26, 2021 at 5:08 PM Eric Rescorla <[e-mail]> wrote:

>
>    The adversary successfully subverts an end-to-end encrypted system if
>    it can succeed in either of the following: 1) the adversary can
>    produce the participant's local state (meaning the adversary has
>    learned the contents of participant's messages), or 2) the states of
>    conversation participants do not match (meaning that the adversary
>    has influenced their communication in some way).  To prevent the
>    adversary from trivially winning, we do not allow the adversary to
>    compromise the participants' local state.
>
>    We can say that a system is end-to-end secure if the adversary has
>    negligible probability of success in either of these two scenarios
>    [komlo].
>
> I'm not sure if this is intended to be a formal definition, but
> it seems to me that it has a number of edge cases which are
> problematic:
>
> 1. Consider the case where I persuade you to install a new E2E
>    messenger and then send you a message. At this point, I know
>    your state, but presumably I have not violated the defn.
>

Sure, this is a trivial win condition.  This is considered in the citation
but should be reflected in this draft.

2. Consider the case where A sends a message to B but I succeeed
>    in blocking that message by (for instance) jamming B's network.
>    In this case, the states don't match, but again we wouldn't
>    say E2EE was violated.
>

DoS is another trivial win condition; it is considered in the citation and
should also be reflected in this draft. Note that while protocols/systems
should try to protect against this case, it cannot be ruled out entirely.

I'll work with Mallory to make these edits.

Thanks,
Chelsea