Re: [Trans] Threat model outline, attack model

Tao Effect <contact@taoeffect.com> Sat, 27 September 2014 16:59 UTC

Content-Type: multipart/signed; boundary="Apple-Mail=_D55F2E67-BE92-491D-92A2-880754B25C36"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Tao Effect <contact@taoeffect.com>
In-Reply-To: <CABrd9SQBuQO1wrv7s06aT-GGyeWmu2sFzJrH6a+t81aq-dei+w@mail.gmail.com>
Date: Sat, 27 Sep 2014 09:58:56 -0700
Message-Id: <77D4B290-D2C8-44D7-AF84-A0A1B91B9557@taoeffect.com>
References: <5411E511.1040605@bbn.com> <CABrd9STmog8-JZCg9Tfv_ToUswY=9LBcZAPQM2cqUVcO0dhAnQ@mail.gmail.com> <54173589.3000404@bbn.com> <CABrd9SRShqm1r-2ajbqD5w1s686ciyjcEvywsXZaapgmi57NsA@mail.gmail.com> <54242F8A.2080602@bbn.com> <CABrd9SSwAdv-mAgofNT6bMWky7q=bZhAaX=L4gZUQDkROQ-3ZA@mail.gmail.com> <54258AF0.7090602@bbn.com> <4842B04F-A058-4F3C-9DA3-F29735EC7570@taoeffect.com> <alpine.LFD.2.10.1409262236210.27616@bofh.nohats.ca> <FC4A18E2-A42C-472F-B9FE-2278BB5A0BBA@taoeffect.com> <CABrd9SQBuQO1wrv7s06aT-GGyeWmu2sFzJrH6a+t81aq-dei+w@mail.gmail.com>
To: Ben Laurie <benl@google.com>
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/sINDOvpGhLcTWbPaTmj52eX78Hc
Cc: Paul Wouters <paul@nohats.ca>, "trans@ietf.org" <trans@ietf.org>
Subject: Re: [Trans] Threat model outline, attack model
Precedence: list

Dear Ben,

On Sep 27, 2014, at 4:53 AM, Ben Laurie <benl@google.com> wrote:

> I agree that CT doesn't mitigate mis-issuance for subjects that do not participate.

If by "participate" you mean owners who submit their certs to logs, CT doesn't detect mis-issuance even for those who do, as that email explained.

> On monitors and guarantees - anyone can run a monitor,
> including, of course, the subjects themselves, so clearly there's no
> barrier to participation for subjects who want to participate.

"No barrier"? Subjects (domain owners) would need to monitor *all* the logs out there.

There will be like 1000+ logs out there.

Each log will be how large (gigabytes?), and CT is not P2P, so Monitors must *poll* 1000+ logs constantly for updates, just for the purpose of detecting mis-issuance.

On top of this, Section 4.6 of your RFC (bis-04) states that logs are not required to send monitors everything they ask for, making it unclear whether a log is misbehaving or not.

This is not practical.

###

But that is all besides the point.

The point is that gossip doesn't detect mis-issuance, whether or not "subjects participate" in CT or not.

Kind regards,
Greg Slepak

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

Attachment: signature.asc

[Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Katriel Cohn-Gordon
[Trans] Fwd: Threat model outline, attack model Melinda Shore
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Paul Wouters
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Greg
Re: [Trans] Threat model outline, attack model Gervase Markham
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model David Leon Gil
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Stephen Kent

Re: [Trans] Threat model outline, attack model

Attachment: signature.asc