Re: [Trans] Threat model outline, attack model

Tao Effect <contact@taoeffect.com> Sat, 27 September 2014 21:41 UTC

Content-Type: multipart/signed; boundary="Apple-Mail=_AA12B2A8-F388-4B38-8F15-DBCB61D54144"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Tao Effect <contact@taoeffect.com>
In-Reply-To: <20140927211940.GP28050@hezmatt.org>
Date: Sat, 27 Sep 2014 14:41:37 -0700
Message-Id: <FDC8E60C-4CB4-447D-8562-FDB7B755B0B4@taoeffect.com>
References: <54173589.3000404@bbn.com> <CABrd9SRShqm1r-2ajbqD5w1s686ciyjcEvywsXZaapgmi57NsA@mail.gmail.com> <54242F8A.2080602@bbn.com> <CABrd9SSwAdv-mAgofNT6bMWky7q=bZhAaX=L4gZUQDkROQ-3ZA@mail.gmail.com> <54258AF0.7090602@bbn.com> <4842B04F-A058-4F3C-9DA3-F29735EC7570@taoeffect.com> <alpine.LFD.2.10.1409262236210.27616@bofh.nohats.ca> <FC4A18E2-A42C-472F-B9FE-2278BB5A0BBA@taoeffect.com> <CABrd9SQBuQO1wrv7s06aT-GGyeWmu2sFzJrH6a+t81aq-dei+w@mail.gmail.com> <77D4B290-D2C8-44D7-AF84-A0A1B91B9557@taoeffect.com> <20140927211940.GP28050@hezmatt.org>
To: Matt Palmer <mpalmer@hezmatt.org>
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/Uziu1w0VARfAjkjWLnQ1xA1ua4k
Cc: trans@ietf.org
Subject: Re: [Trans] Threat model outline, attack model
Precedence: list

On Sep 27, 2014, at 2:19 PM, Matt Palmer <mpalmer@hezmatt.org> wrote:

> On Sat, Sep 27, 2014 at 09:58:56AM -0700, Tao Effect wrote:
>> "No barrier"? Subjects (domain owners) would need to monitor *all* the logs out there.
>> 
>> There will be like 1000+ logs out there.
> 
> "Citation needed", as the Wikipedeans say.  I'm not sure how you could
> possibly come to that conclusion.

I am citing your own documentation:

"we think “every major CA” is within limits of feasibility"

http://www.certificate-transparency.org/faq

And using Jacob's numbers from here:

http://www.ietf.org/mail-archive/web/therightkey/current/msg00745.html

> Please also see these estimates which are even higher:
> 
> https://zakird.com/slides/durumeric-https-imc13.pdf
> 
> "Identified 1,832 CA certificates  belonging to 683 organizations"
> "311 (45%) of the organizations were provided certificates by
> German National Research and Education Network (DFN) "
> 
> http://link.springer.com/chapter/10.1007%2F978-3-642-39884-1_28
> 
> "More than 1200 root and intermediate CAs can currently sign
> certificates for any domain and be trusted by popular browsers."
Now, should the number be less than 1000, it will still be in the hundreds, and that is still impractical for Monitors to provide any sort of a useful service to most website owners.

Not to mention that it does nothing to help with gossiping clients, they will still be MITM attacked, and they will likely not notice it for the aforementioned reasons.

Kind regards,
Greg Slepak

--
Please do not email me anything that you are not comfortable also sharing with the NSA.




--
Please do not email me anything that you are not comfortable also sharing with the NSA.

Attachment: signature.asc

[Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Katriel Cohn-Gordon
[Trans] Fwd: Threat model outline, attack model Melinda Shore
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Paul Wouters
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Greg
Re: [Trans] Threat model outline, attack model Gervase Markham
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model David Leon Gil
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Stephen Kent

Re: [Trans] Threat model outline, attack model

Attachment: signature.asc