Re: [Trans] How to redact an entry

Phillip Hallam-Baker <ietf@hallambaker.com> Wed, 16 November 2016 14:20 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
In-Reply-To: <CABrd9SQjMkWCOv1jPky+DiOE61qCTXej2Ovy9nRVAKs66OtEGA@mail.gmail.com>
References: <CABrd9SSeePrsNq8ERjxpbEvUAdyb=yQOGAom0qh9SZMoP=nsMw@mail.gmail.com> <CAMm+LwiZUw+JpEanY5vkxGBOtdrs9HfYzp34cBtwDv34uJCjKw@mail.gmail.com> <4E665C5B-BC28-428E-9BFB-626D3364E05B@nohats.ca> <CABrd9STPBWt=p-eAW5t=QSw2oexuSeW5tbtcbczagA0jx77gQA@mail.gmail.com> <alpine.LRH.2.20.1611160636020.4488@bofh.nohats.ca> <CABrd9SQjMkWCOv1jPky+DiOE61qCTXej2Ovy9nRVAKs66OtEGA@mail.gmail.com>
From: Phillip Hallam-Baker <ietf@hallambaker.com>
Date: Wed, 16 Nov 2016 09:20:03 -0500
Message-ID: <CAMm+Lwim3NDovHGp62UBKhGc4ewYQQkq2=qH9ssAOFk=JTF=Cw@mail.gmail.com>
To: Ben Laurie <benl@google.com>
Content-Type: multipart/alternative; boundary="047d7b66fd9dee5cd105416bc4f1"
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/Ior2bPcX806_QaNrg8Yvo4GyR94>
Cc: Paul Wouters <paul@nohats.ca>, "trans@ietf.org" <trans@ietf.org>
Subject: Re: [Trans] How to redact an entry
Precedence: list

Lets break this down.

In what way is suppression of a previously enrolled certificate different
to not enrolling the certificate at all?

The only ones I can see is that it means that 1) the CA is off the hook,
they fulfilled their duties and 2) the fact that suppression has occurred
is visible.

CT relies on there being some feedback mechanism to detect unenrolled
certs, the same would apply to suppressed certs.

So let us imagine that a government coerces a CA to issue a bogus cert and
then coerces a notary to suppress it. What next?

Well first off anyone who has a copy of that cert taken from the repository
before the suppression is going to hard look at it. So the chance of people
being aware of the suppression and working out the reason for it is
essentially 99%.

A person formerly very senior in NSA told me that the governing paradigm
post Snowden was 'NOBUS': Nobody but us. Sure they might want to perform
this type of attack if they think they can get away with it but they won't
do things that are liable to get caught.

On Wed, Nov 16, 2016 at 6:48 AM, Ben Laurie <benl@google.com> wrote:

> On 16 November 2016 at 11:39, Paul Wouters <paul@nohats.ca> wrote:
> > On Wed, 16 Nov 2016, Ben Laurie wrote:
> >
> > (no hats on)
> >
> >> On 16 November 2016 at 03:46, Paul Wouters <paul@nohats.ca> wrote:
> >>>
> >>> How can I as log consumer detect the difference between the log
> removing
> >>> illegal content and the log being compelled by a government to hide a
> >>> rogue
> >>> certificate?
> >>
> >>
> >> Court orders are court orders. That issue is not in the log's domain.
> >
> >
> > It was an example. the core isuse is, how can a consumer determine the
> > log censored itself with a valid reason, versus an attack, compromise,
> > having been compelled, or for financial gain or any other invalid reason?
> >
> > Using a hash of a removed cert won't allow anyone to verify the reason
> > for removal. And clearly the content cannot remain their either. It's
> > a catch22.
>
> This is why the redaction reason entry exists, so that there _is_
> something to reason about. If you (a consumer) are unconvinced by the
> reason, well, there are public fora where you can voice your concerns.
>

[Trans] How to redact an entry Ben Laurie
Re: [Trans] How to redact an entry Phillip Hallam-Baker
Re: [Trans] How to redact an entry Paul Wouters
Re: [Trans] How to redact an entry Phillip Hallam-Baker
Re: [Trans] How to redact an entry Paul Wouters
Re: [Trans] How to redact an entry Phillip Hallam-Baker
Re: [Trans] How to redact an entry Ben Laurie
Re: [Trans] How to redact an entry Ben Laurie
Re: [Trans] How to redact an entry Paul Wouters
Re: [Trans] How to redact an entry Ben Laurie
Re: [Trans] How to redact an entry Phillip Hallam-Baker
Re: [Trans] How to redact an entry Eran Messeri
Re: [Trans] How to redact an entry Peter Bowen