Re: [Wpack] On double-hashing (was: Re: About content-based origins)

[Martin Thomson <[e-mail]>]

Slowly crawling out from a giant pile of email...

I will try to get to your longer email later.

On Thu, Mar 26, 2020, at 10:03, Devin Mullins wrote:
> In light of my comment about racing the Sec-CO request, a colleague 
> pointed out a potential hole in the double-hash scheme. There may be 
> flaws in below; I haven't thought about it too much. <trite 
> tone=apologetic>It may be worth more clearly defining the threat 
> model.</trite>

I didn't have time to write this down, but I don't think that we need to worry so much about your attack.

My threat model is similar to that of CORS.  That is, the origin that is accepting - in this case content and state, in CORS a request - something should not be ignorant of what it is accepting.

The reason I ended up at double-hashing was that a hash of the content is all that is really available.  Having the server demonstrate that it is willing to accept a bundle without it being susceptible to making mistakes.  After all, the bundle gets to write into the origin (and potentially exfiltrate from it after the transfer occurs).  For something like a bundle, which encompasses a lot of things, having the server indicate that it knows the exact bundle is likely the best way to achieve some indication that it knows what it is getting into and consents to that.  With a hash, you can split it, share part of it, and ask for the remainder.  Or double-hash like a one-time password.

If a bundle were signed, proof of ownership of the signing key might also work.

In the end, if the bundle and origin want to collude I am of the opinion that that is fine.  An origin that is willing to cooperate with the bundle is intentionally exposing itself to attacks on the integrity of its own state.  Going to the extremes you describe is taking great care to aim your footgun. So it's not really worth stopping in my view.

(I don't think that for a secure hash you can do anything like what you describe with fixpoints.  Such a thing would seem to lead to trivial collision attacks.  What seems more likely to me is that the bundle is constructed using some very precise canonicalization scheme such that it can be reconstructed from within and then hashed.  That might be quite restrictive, but I don't see why it wouldn't work.)