Subject: [Trans] draft-linus-trans-gossip-ct-01 doesn't work

From: Watson Ladd <[email-masked]>
Date: Thu, 26 Mar 2015 07:56:33 -0700

Dear all,

Suppose I can consistently redirect a client C to a masquerading
server M. The proposed gossip mechanism will not detect this, as SCTs
are only ever sent back to the server they are received from. This
should be fixed by having clients gossip constantly about STHs, thus
ensuring that if any honest server is contacted, the MITM is detected.

Sincerely,
Watson Ladd

---

From: Paul Wouters <[email-masked]>
Date: Thu, 26 Mar 2015 11:49:30 -0400 (EDT)

> ensuring that if any honest server is contacted, the MITM is detected.

First of all, this is very unlikely and consumes a lot of resources.

Second, the webserver <-> webclient is not the only path for gossip.
Please have a look at the diagram on page 6 of the gossip presentation
from last Monday:

http://www.ietf.org/proceedings/92/slides/slides-92-trans-3.pdf

Paul

---

From: Nico Williams <[email-masked]>
Date: Thu, 26 Mar 2015 10:59:08 -0500

> First of all, this is very unlikely and consumes a lot of resources.

For mobile devices that do roam, and not always on the same wireless
provider, it's probably true that it's unlikely, but in all other
cases it seems likely that an MITM can continue being present
indefinitely.

A client could gossip with the user's other devices, but gossiping
with anyone else complicates things, including security
considerations.

> http://www.ietf.org/proceedings/92/slides/slides-92-trans-3.pdf

Slide 7, I think you mean.  Yes, but this won't always happen, and for
a client that can be MITMed continuously we have to consider that the
MITM may MITM the auditor as well.

CT is a step forward, but it's not a miracle.  We have TTPs; all we
can do is make it a bit harder for them to behave badly, particularly
by increasing the likelihood that they will be caught doing so.

Nico
--

---

From: Tom Ritter <[email-masked]>
Date: Thu, 26 Mar 2015 11:06:20 -0500

> ensuring that if any honest server is contacted, the MITM is detected.

If you are able to isolate a client from a resource _forever_ then
yes, you can win. You can also stop the client from receiving browser
updates, from contacting a client's trusted auditor (if they have
one), from receiving operating system updates, trust root updates, and
so on.

An attacker who can isolate a client from a resource once and forever
is exceptionally difficult to defend against.  It's not clear (to me
at least) what a browser could even do in that situation except refuse
to work at all.  (And I'll note that unless I'm mistaken, every
browser chooses to go the other way and actually fail _open_, removing
security mechanisms if it's been unable to update for a long time.)

-tom