Subject: Re: [Trans] On the worthiness of DNSSEC and PKI (Re: DNSSEC also needs CT)

From: Nico Williams <[email-masked]>
Date: Fri, 9 May 2014 18:50:53 -0500

On Fri, May 9, 2014 at 6:27 PM, Tao Effect <[email-masked]> wrote:
> Thank you Nico for at least noting it. ;-)

That's all I'll do for now.  I don't have time to engage your position
at this time.  Surely others already have anyways.

> This list is about making CT happen, and here I come saying that CT is a

Right.

> horrible and insecure protocol.

Maybe.

> Such a civil reply is almost unexpected. ^_^

By "noted" I meant to say that yes, I took note of your position but I
don't want to discuss that topic in the context of "DNSSEC needs CT"
-- the two matters are separable.  To discuss your response in the
same thread would just create noise.  At any rate, I don't have time
to address it separately anyways.  Feel free to educate us though.

Nico
--

---

From: Tao Effect <[email-masked]>
Date: Fri, 9 May 2014 19:31:41 -0500

On May 9, 2014, at 6:50 PM, Nico Williams <[email-masked]> wrote:
> at this time.

As you say, noted.

> Surely others already have anyways.

Actually not really, this email, and the randombit thread that I linked to (which didn't get a reply), has been about it.

Part of the reason, I think, is because I haven't really spelled out in detail what the problems with CT are, just alluded to them, which may make it easy for folks to dismiss the comments as "he doesn't know what he's talking about."

It's something I just need to find the time to do.

> to address it separately anyways.  Feel free to educate us though.

The fact that the folks on this list are supposed to be CT specialists makes it easier for me to write very brief critiques (without having to explain the details of how CT works).

CT is X.509 on steroids, and I mean that in the most negative of ways possible.

The crux is just this then:

CT makes X.509 even more complicated than it already is. This inherently makes it less secure than even today's already totally insecure X.509 system (more moving parts).
CT does not prevent Man-in-the-Middle (MITM) attacks. Given that the purpose of CT is supposedly to protect from such attacks, this is embarrassing and shameful.
Expanding on 2: CT takes today's PKI and divides it up into "The Server" (the NSA), "The CA" (the NSA), and "The Log Server" (the NSA). This is how MITM works, it doesn't matter if the NSA doesn't actually own those servers because they effectively do by controlling the network itself.
Clients have no way of detecting a MITM attack because the RFC gives them no such powers. If this complicated system were implemented perfectly, then most of the security rests not on the log servers, but on the "gossip protocols" that the RFC alludes to but does not describe. These protocols are supposed to be described in other documents, but as far as I'm aware they do not exist. Nor is any hint given as to their feasibility or to how the gossip channels themselves will be protected from MITM.
CT centralizes security into the hands of a limited amount of CAs and Log Servers that must be trusted by everyone on the internet. It explicitly excludes support for self-signed certificates, ensuring lots and lots of $$$$ for those that run those servers, making todays pay-for-insecurity system even worse than it is. It effectively takes the security of the entire internet for ransom and puts it into the hands of government intelligence agencies and anyone else with MITM capabilities.
CT does not actually care about preventing MITM attacks and places the burden of detecting such attacks squarely on the shoulders of domain owners and individuals. Attacks will happen successfully CT explicitly takes no steps to stop them as they happen.
CT's very existence distracts the internet from real solutions that actually prevent MITM attacks, are far simpler, and provide security to everyone for ~$0. This alone makes it a significant threat to global security.

Maybe I'll post a more detailed version of this later (with citations, illustrations, etc.). But seeing as this is a technical list, I hope it will do for now.

Cheers,
Greg Slepak

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

---

From: Melinda Shore <[email-masked]>
Date: Fri, 09 May 2014 19:08:06 -0800

On 5/9/14 4:31 PM, Tao Effect wrote:
> Maybe I'll post a more detailed version of this later (with citations,
> illustrations, etc.). But seeing as this is a technical list, I hope it
> will do for now.

Hi, Greg:

This mailing list is to support the work of the trans working
group rather than for general discussion of CT, and this
discussion is starting to skirt the edges of what we're doing.
Right now there's a proposal to look at the possibility of
applying CT to DNSSEC.  A general discussion of "the worthiness of
DNSSEC and PKI" doesn't really go to that proposal.

We kept the [email-masked] mailing list around for discussions
of just this nature, and I'd be grateful if you could keep the
discussion here focused on the applicability of CT to DNSSEC and
take the more general discussion over there.

Thanks,

Melinda

---

From: Tao Effect <[email-masked]>
Date: Fri, 9 May 2014 22:37:01 -0500

Hi Melinda,

> DNSSEC and PKI" doesn't really go to that proposal.

Understood! (FTR, I didn't come up with that subject title. ^_^)

> take the more general discussion over there.

Pointing out security and design flaws in CT is off-topic, noted, thanks.

Kind regards,
Greg

---

From: Melinda Shore <[email-masked]>
Date: Fri, 09 May 2014 19:47:17 -0800

> Pointing out security and design flaws in CT is off-topic, noted, thanks.

Yes and no.  We produce documents.  There's a working group
draft in development, and if there are problems with that
draft there's no time like the present for starting a discussion
and proposing text.  There's also the beginnings of a discussion
about whether or not to take on the development of a document
on CT for DNSSEC.  If there are specific issues those need to be
brought up as well.  But we've got another mailing list for
higher-level discussions of how to deal with certificate
misissuance and it's a good place for CT discussions that don't
directly address the working group's products.

Melinda

---

From: Tao Effect <[email-masked]>
Date: Fri, 9 May 2014 23:07:58 -0500

On May 9, 2014, at 10:47 PM, Melinda Shore <[email-masked]> wrote:
> and proposing text.

... OK, I think I did Step 1: "starting a discussion" about the problems in CT.

Is Step 2: "proposing a modification to the RFC that fixes those problems"?

What do I do if the problems are fundamental to the design of CT and the solution is to do something else?

Is there an IETF process in place for "The work we're doing would harm the Internet so maybe we should stop?"

> But we've got another mailing list for

Wasn't the point of CT precisely to "deal with certificate misissuance"?

That is to be discussed in a list that is not specific to CT though?

Apologies for all these questions. I'm just confused by the rules of this list.

---

From: Melinda Shore <[email-masked]>
Date: Fri, 09 May 2014 20:37:23 -0800

> ... OK, I think I did Step 1: "starting a discussion" about the problems

Right.  That's actually off-topic - if there are specific
problems in the working group draft, that's a great place
to start a discussion.  More general discussion of problems
with CT would be on-topic for [email-masked].

Also, to be clear, we are not going to rathole on this.

Melinda

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 10 May 2014 10:52:17 -0400

Ø  What do I do if the problems are fundamental to the design of CT and the solution is to do something else?

Write up your own document and circulate it.  I'll be happy to give you some pointers to the second part, once you have the first part.

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz

---

From: Tao Effect <[email-masked]>
Date: Sun, 11 May 2014 23:23:22 -0500

Thank you Rich for answering that, and it's kind of you to offer your help.

I'll look into this as soon as time allows.

Kind regards,
Greg

On May 10, 2014, at 9:52 AM, Salz, Rich <[email-masked]> wrote:

Write up your own document and circulate it.  I’ll be happy to give you some pointers to the second part, once you have the first part.

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]; Twitter: RichSalz

_______________________________________________
Trans mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/trans