Re: [Tcpcrypt] v3 of the charter

[Daniel Kahn Gillmor <[e-mail]>]

On 04/30/2014 04:20 AM, Eggert, Lars wrote:
> Is it desirable to have a model where you're vulnerable to MiM the first time you connect to a server, but not afterwards? (Like what SSH provides in terms of warning when the server key has changed?)

I'd call this trust-on-first-use (TOFU) or leap-of-faith (LoF).  I'm not
sure it's appropriate for TCP Inc as currently designed, because these
models have serious problems with re-keying events.  In particular, what
do we expect a TCP Inc client to do if a host's key changes?  If it
aborts the connection, then we've violated the "don't display state to
the normual user" approach.  If it falls back to cleartext, then we're
back to plain TCP, unprotected even against passive attackers.

Keys get compromised; hosts fail and need to be rebuilt; there are
legitimate reasons to re-key.  If TOFU or LoF deals poorly with those
circumstances, and we include TOFU/LoF in TCP Inc, it would make
thoughtful sysadmins wary of rolling out TCP Inc, out of fear of what it
would do for their reachability.

this isn't to say that a layer above TCP Inc couldn't do TOFU or LoF,
based on the authentication hooks provided by TCP Inc, of course,
assuming that the authentication hooks are built in a way to support
that behavior.  But i don't think it belongs in TCP Inc itself as
currently framed.

	--dkg