Subject: A different way to do key signing parties.

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 2 Apr 2019 00:40:49 +0100

One of the challenges I have set for myself with the Mesh is to get as much security as possible with zero user effort or less. Users won’t make any effort for security, the sooner we realize this and decide to live with it, the sooner we can start delivering useful security.

I believe that CAs do have a role in supporting end-to-end email security, just not the one that they are assigned in the S/MIME ecosystem. WebPKI CAs deliver a useful and important function in authenticating organizations. Applying that model to individuals doesn’t work.

The PGP Web of Trust model doesn’t really work either. Not at Internet scale with four billion users. The Moore bound and the Sybyl attack cause trust to decay rapidly over distance.

So why am I suggesting key signing parties? And why post this to the IETF list rather than a security list? 

It turns out that if you combine the Web of Trust model with the CA model, you can achieve higher trust metrics than in either model on its own. Particularly if you have an append only log involved that allows you to notarize and timestamp the trust assertions from time to time.

I won’t go into the details of that model here, I have a draft with the details for those interested.

At one time, the IETF used to hold PGP key signing parties. Well here is the first problem, OpenPGP is only one app. We really need to secure SSH as well, that is the technology used to access GIT repos. We should probably take rather more care than we do with confidentiality of communications between IETF participants than we do, but integrity attacks almost always dominate.

So let us imagine that we are all root of our own personal PKI and this allows us to sign keys for all the applications on all the devices that we need to use to be secure. That is the purpose of the Mathematical Mesh.

Now imagine that this personal PKI is designed so that my personal root key need never expire. Or at least not until I do. So now let's take a fingerprint of that key. And let's imagine that I provide that fingerprint to the IETF during registration ‘somehow’ (add encryption to taste).

So at this point, I am attending a conference at non-trivial expense (typically $2,500) at which I am well known to most people and will be registering by presenting ID. Surely there is some way we can leverage that to gain a useful endorsement of my key fingerprint for at least IETF purposes. Not least when for IETF purposes, it is the identity that you know me as for IETF purposes that matters, not any of the other identities I might have held over an eventful life.

The simplest approach would be to simply enroll the fingerprint and the credentials I presented in an append only hash chain but that does not get us to binding of identity.

We could use the fact I am carrying a device (phone) connected to my Mesh profile and potentially running an app that can present and/or scan QR codes to create a stronger binding and possibly streamline registration.

I will elide the cryptography, but assume I am using plenty. The user experience I am looking at right now would have the conference present a QR code on a screen that changes every 30 seconds or so or each time it is scanned. That presents a domain name and a cryptographic challenge. When scanned using the app, the challenge is put through a one way function to obtain the locator for a document giving the rest of the information needed to complete the registration. 

So now my app is saying ‘do you want to pick up your IETF badge’ or whatever and I click yes and that causes the app to post my Mesh fingerprint to a URI indicated in the document and that causes the desk to get a note to look for phill’s badge and also tells my conference scheduling app to load the IETF material. [Quite possibly customized to include my Directorate etc. private events]

So then I may or may not present government ID to pick up my badge (depending on conference policy). But this could at least in practice be captured as part of the same process (or not). And then of course we throw the resulting assertion in a blockchain (or whatever we decide to call them after the BitCoin crash).

Now imagine we have been doing this sort of thing for five years. At this point, we have a pretty solid binding of identity. It is not perfect but it has a very very high work factor and if the attacker hasn’t planned the attack in advance, they kinda need a time machine.

It is possible that it is worth while IETF doing this for our own consumption but of course the real point is to establish a model that can be applied at all sorts of conferences and in universities and eventually in high schools and churches, etc.

To be clear, this approach addresses one particular set of validation concerns but does not serve every purpose. If Alice is a government official and I am emailing her in that capacity, what is important to me is that I am interacting with a duly authorized government official, not ‘Alice’. And once you get into strong identity assertions you start to find pretty quickly that you need pseudonymity modes, even for government officials, or maybe especially. Yes, I got that one too but like I said, I am eliding the crypto because that isn’t the important part, if we can specify the requirements, the crypto is merely a math problem.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Apr 2019 22:33:57 -0400

Phillip Hallam-Baker <[email-masked]> wrote:
    > Now imagine that this personal PKI is designed so that my personal root
    > key need never expire. Or at least not until I do. So now let's take a
    > fingerprint of that key. And let's imagine that I provide that
    > fingerprint to the IETF during registration ‘somehow’ (add encryption
    > to taste).

Do we need to involve the IETF secretariat, or can we do this some other
indirect way?  I can put any text on my badge that I like.

    > I will elide the cryptography, but assume I am using plenty. The user
    > experience I am looking at right now would have the conference present
    > a QR code on a screen that changes every 30 seconds or so or each time
    > it is scanned. That presents a domain name and a cryptographic
    > challenge. When scanned using the app, the challenge is put through a
    > one way function to obtain the locator for a document giving the rest
    > of the information needed to complete the registration.

okay.

    > So now my app is saying ‘do you want to pick up your IETF badge’ or
    > whatever and I click yes and that causes the app to post my Mesh
    > fingerprint to a URI indicated in the document and that causes the desk
    > to get a note to look for phill’s badge and also tells my conference
    > scheduling app to load the IETF material. [Quite possibly customized to
    > include my Directorate etc. private events]

That's interesting.

    > Now imagine we have been doing this sort of thing for five years. At
    > this point, we have a pretty solid binding of identity. It is not
    > perfect but it has a very very high work factor and if the attacker
    > hasn’t planned the attack in advance, they kinda need a time machine.

Someone who has attended 15 IETF meetings (3*5) is probably whomever their
badge says, regardless of who the government says they are ;-)

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: tom petch <[email-masked]>
Date: Tue, 2 Apr 2019 08:51:21 +0000

----- Original Message -----
From: "Phillip Hallam-Baker" <[email-masked]>
To: "IETF Discussion Mailing List" <[email-masked]>
Sent: Tuesday, April 02, 2019 12:40 AM

One of the challenges I have set for myself with the Mesh is to get as
much security as possible with zero user effort or less. Users won’t
make any effort for security, the sooner we realize this and decide to
live with it, the sooner we can start delivering useful security.

<tp>
Around me, commercial radio stations are now carrying public service
advertisements on the damage that can occur with a weak password and are
broadcasting advice on how to make passwords more secure.

The advice is sound so clearly the powers that be think that they can
get end users to make a greater effort to save themselves from attack.
How effective this will be I cannot tell nor, I suspect, will the
advertisers be able to.

At least they have stopped telling people that a padlock on the web page
means that they are safe - I have tackled that head-on with zero effect.

Tom Petch

I believe that CAs do have a role in supporting end-to-end email
security, just not the one that they are assigned in the S/MIME
ecosystem. WebPKI CAs deliver a useful and important function in
authenticating organizations. Applying that model to individuals doesn’t
work.

The PGP Web of Trust model doesn’t really work either. Not at Internet
scale with four billion users. The Moore bound and the Sybyl attack
cause trust to decay rapidly over distance.

So why am I suggesting key signing parties? And why post this to the
IETF list rather than a security list?

It turns out that if you combine the Web of Trust model with the CA
model, you can achieve higher trust metrics than in either model on its
own. Particularly if you have an append only log involved that allows
you to notarize and timestamp the trust assertions from time to time.

I won’t go into the details of that model here, I have a draft with the
details for those interested.

At one time, the IETF used to hold PGP key signing parties. Well here is
the first problem, OpenPGP is only one app. We really need to secure SSH
as well, that is the technology used to access GIT repos. We should
probably take rather more care than we do with confidentiality of
communications between IETF participants than we do, but integrity
attacks almost always dominate.

So let us imagine that we are all root of our own personal PKI and this
allows us to sign keys for all the applications on all the devices that
we need to use to be secure. That is the purpose of the Mathematical
Mesh.

Now imagine that this personal PKI is designed so that my personal root
key need never expire. Or at least not until I do. So now let's take a
fingerprint of that key. And let's imagine that I provide that
fingerprint to the IETF during registration ‘somehow’ (add encryption to
taste).

So at this point, I am attending a conference at non-trivial expense
(typically $2,500) at which I am well known to most people and will be
registering by presenting ID. Surely there is some way we can leverage
that to gain a useful endorsement of my key fingerprint for at least
IETF purposes. Not least when for IETF purposes, it is the identity that
you know me as for IETF purposes that matters, not any of the other
identities I might have held over an eventful life.

The simplest approach would be to simply enroll the fingerprint and the
credentials I presented in an append only hash chain but that does not
get us to binding of identity.

We could use the fact I am carrying a device (phone) connected to my
Mesh profile and potentially running an app that can present and/or scan
QR codes to create a stronger binding and possibly streamline
registration.

I will elide the cryptography, but assume I am using plenty. The user
experience I am looking at right now would have the conference present a
QR code on a screen that changes every 30 seconds or so or each time it
is scanned. That presents a domain name and a cryptographic challenge.
When scanned using the app, the challenge is put through a one way
function to obtain the locator for a document giving the rest of the
information needed to complete the registration.

So then I may or may not present government ID to pick up my badge
(depending on conference policy). But this could at least in practice be
captured as part of the same process (or not). And then of course we
throw the resulting assertion in a blockchain (or whatever we decide to
call them after the BitCoin crash).

Now imagine we have been doing this sort of thing for five years. At
this point, we have a pretty solid binding of identity. It is not
perfect but it has a very very high work factor and if the attacker hasn
’t planned the attack in advance, they kinda need a time machine.

It is possible that it is worth while IETF doing this for our own
consumption but of course the real point is to establish a model that
can be applied at all sorts of conferences and in universities and
eventually in high schools and churches, etc.

To be clear, this approach addresses one particular set of validation
concerns but does not serve every purpose. If Alice is a government
official and I am emailing her in that capacity, what is important to me
is that I am interacting with a duly authorized government official, not
‘Alice’. And once you get into strong identity assertions you start to
find pretty quickly that you need pseudonymity modes, even for
government officials, or maybe especially. Yes, I got that one too but
like I said, I am eliding the crypto because that isn’t the important
part, if we can specify the requirements, the crypto is merely a math
problem.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 2 Apr 2019 08:58:16 -0400

> indirect way?  I can put any text on my badge that I like.

Not necessarily.

I think it very important that I can paint a 'zero-effort' scenario that
could be realized with minimal impact on the conference organizers. But as
far as IETF roll out goes, it doesn't need to be perfect on day one. It is
not a typical audience, people are likely to use a scheme in the hope of a
future version one day being viable.

>     > include my Directorate etc. private events]

There is more info on the scheme here:
http://mathmesh.com/Documents/draft-hallambaker-mesh-udf.html

As always, there are multiple ideas. but one of the more interesting ones
is Encrypted Authenticated Resource Locators. Here is an example:

udf://example.com/ED3O-CIJB-M57X-LCGZ-RAIX-K4KK-2WIU-XE

This is simply a domain name with an encryption key bodged on the end.
Assume that we present this as a QR code and you scan it. The URI is now
handed off to the UDF application.

To resolve this URI we take the fingerprint of the key and present at twice
the precision of the key:

MAQJ-VVJB-TKX5-BNL6-7WPI-UEU4-QJVZ-GV2C-XUOJ-5QHC-YGBS-BKE7-76U3-RHNU

Now add the domain and DNS Web Service Discovery for the mmm-udf scheme and
we get:
https://example.com/.well-known/mmm-udf/MAQJ-VVJB-TKX5-BNL6-7WPI-UEU4-QJVZ-GV2C-XUOJ-5QHC-YGBS-BKE7-76U3-RHNU

The target data is encrypted under the key ED3O-CIJB-...

So here we have a scheme that provides us with a means of resolving compact
QR code to securely return a data object of any size.

We can use the QR code as a lightweight bearer token. Many business
processes are driven by movement of paper documentation for good reason -
the charts move round with the patient for example.

The basic scheme is 100% symmetric. So we could make it Quantum
Cryptanalysis Resistant by expanding the key from 140 bits to 240 or so.

> badge says, regardless of who the government says they are ;-)

Precisely. The only concern is that if we then publish the data we need to
make note of the fact that no credentials were checked so that people don't
carelessly depend on it for authentication the way that people now
carelessly depend on domain validated certs for TLS transactions requiring
accountability as Tom mentioned.

This is obvious if the name is something like "Psychotic Wizard". Less
obvious if the name John Smith is used.

We can delegate the job of writing up processes for checking credentials to
CABForum. I don't think we need the credentials to be validated according
to process but we probably would for a professional or academic conference.
We would want to be able to use this for registering Continuing Education
Credits.

Let us imagine that we wanted to create a Wikipedia like scheme for an
academic specialty. We would face many of the problems we face in IETF, we
want to be open but not so open a wrecker can break the process. The
scientists don't want to end up debating flat earthers or paid climate
change denial trolls. A rule where you get to vote in the appeals process
if you have checked in at three conferences in the past five years becomes
useful.

-- 
Website: http://hallambaker.com/