Re: [Unbearable] WGLC 3 on core documents

[Andrei Popov <[e-mail]>]

> If we had more formal analysis of the protocol, we might be able to have these discussions without resorting to "I think" statements.
Having a formal analysis would have been wonderful. My conclusion was derived from the 3 points listed right above the conclusion:)

> If your claim is that a client might, under different circumstances, be coerced into making a claim that it controlled a key that it did not in fact control, that's an extraordinary claim requiring extraordinary evidence.
A TB library sitting on a server has no knowledge of exactly how federation happens to be arranged, and what guarantees the federation mechanism provides. With the current design, the TB library does not need to know these things. It can simply make sure the client is in control of the TB private keys by verifying signatures.

Cheers,

Andrei

-----Original Message-----
From: Martin Thomson [mailto:[e-mail]] 
Sent: Wednesday, March 1, 2017 7:06 PM
To: Andrei Popov <[e-mail]>
Cc: Nick Harper <[e-mail]>; [e-mail]; Leif Johansson <[e-mail]>
Subject: Re: [Unbearable] WGLC 3 on core documents

On 2 March 2017 at 12:41, Andrei Popov <[e-mail]> wrote:
> I think that eliminating the signature on the referred bindings makes the protocol less secure and potentially narrows the range of scenarios where it can be used.

If we had more formal analysis of the protocol, we might be able to have these discussions without resorting to "I think" statements.  If your claim is that a client might, under different circumstances, be coerced into making a claim that it controlled a key that it did not in fact control, that's an extraordinary claim requiring extraordinary evidence.

I totally see how a client might be tricked into using the wrong key in some different protocol - even in HTTP if there truly is a MitM - but that doesn't provide anything other than a denial of service.  The MitM is more than capable of causing that to happen without resorting to trickery though.