Re: [Trans] Gossip: Unsticking a client caught with potential evidence of log misbehavior

[Ben Laurie <[e-mail]>]

On Fri, 23 Oct 2015 at 06:12 Tom Ritter <[e-mail]> wrote:

> On 22 October 2015 at 05:25, Ben Laurie <[e-mail]> wrote:
> > On Thu, 22 Oct 2015 at 03:16 Tom Ritter <[e-mail]> wrote:
> >>
> >> I can't
> >> think of a way you receive (no-maliciously) an older-then-three-week
> >> STH.
> >
> > You can end up with one if you receive a fresh one and then go to sleep
> for
> > 4 weeks...
>
> That's true. It seems different from the client receiving a 4-week old
> STH via the network though.
>
> If you start up and have a 4-week old STH in your store - you can
> presume that you recived it when it was fresh. And if you cannot
> resolve with a consistency proof - it seems 'safer' to me in some way.
> If you receive a 4-week old STH from a site, I might assume they're
> trying to load me with a tracking STH.
>
> But in general we're back in the bucket of "What do I do with this."
> Do we share it with websites via STH Pollination even though it can
> enable very reliable cross-origin linkage?  I don't think we can,
> because (besides the privacy issue) we don't want to require the
> website to resolve consistency proofs nor do we want the website to
> give 4-week old STHs to other clients.  Do we share it with an
> auditor-of-last-resort (after failing to resolve a consistency proof),
> thinking that the privacy implications of a STH are much lesser than
> the near-certainly of cross-origin linkage?
>

The problem with discarding old STHs is it makes an attacker's job easier:
now they only have to isolate their victim until the STH expiry age, and
all evidence is gone.



>
> -tom
>