Subject: Draft Minutes of OpenPGP

From: Derek Atkins <[email-masked]>
Date: Thu, 04 Aug 2005 10:46:36 +0200

Attached are the draft minutes for the OpenPGP meeting.  In short:

1) 2440bis should go to WGLC later this month
2) new milestones were proposed by the chair and no objections noted
3) there appears to be interest in adopting new work: the message-header

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Thomas Roessler <[email-masked]>
Date: Thu, 4 Aug 2005 11:31:39 +0200

On 2005-08-04 10:46:36 +0200, Derek Atkins wrote:

>                         Thomas ? - two formats - with and w/o tag
>			 - please elimiate the tag version.

I was asking to remove the untagged version, not the tagged one.

Regards,
-- 
Thomas Roessler, W3C   <[email-masked]>

---

From: Ian Grigg <[email-masked]>
Date: Thu, 4 Aug 2005 12:08:15 +0100

On Thursday 04 August 2005 09:46, Derek Atkins wrote:

>  [Jon]  - Wants support to plain inline text - kill mime and only use plain text as a personal preference.

I'd agree with this.  OpenPGP needs to support a
basic mechanism to use open text channels in the
most robust fashion.  The ascii-armouring has passed
the test of time in this fashion.

I don't think it is necessary to "kill mime" but I don't
have much hope for its survival.  As it only works
when the other client also understands the format,
it is facing an uphill battle.  ascii-armouring works
much better as the user becomes the fallback.

OpenPGP needs to think in terms of email being
a lesser and lesser influence.  IMO, email is dying.
That's debateable, but what is clear is that the star
of IM is on the ascendancy, and the email thing is
losing that battle.

Currently, IM is mostly unsecured (there is this thing
to do with SSL to the server, but as the threat is on
the node, that's ignorable).  The way to approach
securing chat (IMHO) is to layer OpenPGP over the
top in a transparent fashion.

That means ascii-armouring for the moment.

Other systems will have similar engineering demands.
Trying to integrate two disparate systems together is
hard.

iang
-- 
Advances in Financial Cryptography, Issue 2:
   https://www.financialcryptography.com/mt/archives/000498.html
Mark Stiegler, An Introduction to Petname Systems
Nick Szabo, Scarce Objects
Ian Grigg, Triple Entry Accounting

---

From: Jon Callas <[email-masked]>
Date: Thu, 4 Aug 2005 07:09:58 -0700

> much better as the user becomes the fallback.

Thank you, Ian.

Nor do I want to "kill mime." I don't want to kill MIME. That 
mischaracterizes what I said.

All I want is not to be forced to do MIME. Unfortunately, it appears 
that there are a lot of people who denigrate text, and think that if 
you say, "Hey, I like text!" then that means you want to kill MIME.

	Jon

---

From: Len Sassaman <[email-masked]>
Date: Wed, 10 Aug 2005 09:47:09 -0700 (PDT)

> top in a transparent fashion.

OpenPGP has a lot of characteristics that one wouldn't particularly want
in an IM privacy protocol. You might want to take a look at the "Off The
Record Messaging" system designed by Goldberg and Borisov. Their WPES
paper addresses the rationale behind ditching the OpenPGP threat model.

http://www.cypherpunks.ca/otr/#docs

(More generally, I agree with the sentiment that ASCII-armored OpenPGP is
important for use with other protocols besides email, and should be the
canonical format for OpenPGP, email and otherwise.)

---

From: Ian G <[email-masked]>
Date: Thu, 11 Aug 2005 16:04:44 +0100

Len Sassaman wrote:
> in an IM privacy protocol.

Sure, it's a very general comment (and more specifically,
I note that my own secure IM protocol doesn't as yet
enjoy OpenPGP).

 > You might want to take a look at the "Off The

Ah, now IMHO they bungled the threat model.  Normally
this wouldn't be an issue (I encourage all crypto
experiments, even ones I think suck!), but the authors
then go on to suggest that the user can repudiate and
is protected because no-one can prove the messages were
sent.

The threat is on the node, and this includes your
other party.  If your other party says you sent the
messages, then your silence, or your claim that it
can't be proven, are inadequate.  You actually have
to say you didn't send the messages.  So this means
that the property of repudiability is only available
if you lie, which is not only a contradictory
approach, but also extraordinarily dangerous and
in practice useless in court or in any adversarial
setting.

That is, OTR only works when it doesn't matter.

This is taking crypto into the real world and not
realising the real world has an ability to do things
too.  In practice, if any one tried the OTR approach
in court, they would quite rightly be screwed.

I think we are drifting off the OpenPGP charter
though.

> canonical format for OpenPGP, email and otherwise.)

Cool!

iang

---

From: Len Sassaman <[email-masked]>
Date: Thu, 11 Aug 2005 08:14:27 -0700 (PDT)

> I think we are drifting off the OpenPGP charter

I'll try to bring this back to OpenPGP for a minute. The problem, as I see
it, is that if Alice uses OpenPGP to sign and encrypt his messages, she's
actually facing a worse situation in court than if she hadn't been using
OpenPGP, should the other party turn against her. There now exists
cryptographic signature data to establish, beyond the word of the other
party, that Alice definitively send the messages in question.

OTR allows is users to have strong authentication of encrypted messages
without the *additional risk* that normal digital signatures introduce.
Alice is no better off in the court scenario that you describe, using OTR
vs. not using anything, but this way she can use an encryption system that
doesn't expose her to greater potential danger, should the other party
defect.

--Len.

---

From: Ian Brown <[email-masked]>
Date: Thu, 11 Aug 2005 16:24:27 +0100

> doesn't expose her to greater potential danger, should the other party

Adam Back and I suggested a way of doing this with OpenPGP at Usenix in 
1998: http://www.cs.ucl.ac.uk/staff/i.brown/nts.htm

---

From: Ian G <[email-masked]>
Date: Thu, 11 Aug 2005 19:09:07 +0100

Len Sassaman wrote:
> I'll try to bring this back to OpenPGP for a minute.

Well, seeing as there is another thread on
the relationship of signing to encryption,
let's carry on :)

 > The problem, as I see

Right but this needs to be integrated into the
real world.  Firstly, what does that signature
mean?  What was it doing there?  Because this
question is unanswered, and I'd say, unanswerable,
most people (in my experience) don't use signed
email.  They simply encrypt.

Secondly, the way court works is that if one
party tables a message, it's generally accepted
at face value.  In practice, the mere presence
of the message is its own authentication.

Only if the other party were to repudiate it
would there be any question and then the notion
of digsigs could be brought in.  But even then,
it is (IMHO) rather unlikely that any opinion
would turn on such issues, as courts have their
own ways of dealing with such things already.
In general practice, people do not lie about
documents in court, neither forging documents
nor repudiating ones they themselves authored.

And this is before any consideration of digsigs
or OTR.  So while your argument might be logical,
it's relevance to actual practice is not clear.

> without the *additional risk* that normal digital signatures introduce.

Turn it around and ask how important strong
authentication is?  When was the last time you
needed it in email or IM?  I suggest it is something
that we inherited from some military threat model
that isn't really relevant to our environment.

Once that disappears, there isn't really much point
in OTR, and you may be better off just sending
totally unauthenticated messages.  With PFS, if
you like.  Others disagree of course.

> doesn't expose her to greater potential danger, should the other party

I fear it is the other way around?

As a minor issue, if OTR's claim is that it
encourages Alice to repudiate, and that were
brought up in court, Alice might be in a
strictly worse position.  On the one hand,
she is being dared to lie to the judge,
and on the other, she's been seen to use a
tool that has a sole advantage of repudiation.

What is she going to do?  Lie about the message,
but accept the fact that she uses a tool that
encourages her to lie about messages?

This problem is a really difficult one, and I
do like the fact that they attacked the problem.
I've been toying with legal ways around this for
years and have never yet came across a way that
was worth it.

I think it's really important to move towards
PFS as a standard part of the crypto makup, for
this and other reasons.  But short of making
messages disappear from your machine, I've yet
to think of a way to make this happen in a strict
p2p environment.

iang

---

From: Len Sassaman <[email-masked]>
Date: Thu, 11 Aug 2005 12:06:00 -0700 (PDT)

> email.  They simply encrypt.

Right. I'm one of those people. This does, however, leave one open to MITM
attacks -- which are probably not that large of a threat in the general
case, but when dealing with centralized, proprietary IM systems, could
very well be a realistic problem. (This is why Trillian's SecureIM
solution fails my sniff test.)

> of the message is its own authentication.

Actually, rules of evidence are a lot more complicated, particularly in
criminal proceedings. It's pure speculation on my part to assume a
non-reputable signature on a message would lessen doubt about tampering
when presented to a third party, but I think it's reasonable speculation,
and a problem worth avoiding.

> that isn't really relevant to our environment.

I can't agree with this, particularly in the IM environment. It would be
trivial for one of the large IM service providers to intercept encrypted,
but unauthenticated traffic through their systems. If you don't trust the
IM service provider, it is essential that you have end-to-end encryption
and authentication.

> tool that has a sole advantage of repudiation.

I'd hardly say that OTR's sole advantage is repudiation. Transparent
encryption, perfect forward secrecy, and a quickly growing user-base are
also significant advantages. OTR is a privacy tool. Avoiding the
non-repudiation trap is a form of privacy.

Simply put, users shouldn't be forced to make non-repudiatable attestations
in order to achieve privacy for their communications.

--Len.

---

From: Ian G <[email-masked]>
Date: Fri, 12 Aug 2005 10:39:26 +0100

> On Thu, 11 Aug 2005, Ian G wrote:

(Does anyone want us to take this offline?  Just
shout...)

> solution fails my sniff test.)

Right.  That's an interesting point.  So GAIM
uses AIM which is a proprietary IM system.  Now,
if that was all it was, *and* one assumed that
MITM in AIM was a real threat, then this would
be plausible logically, but still weak in terms
of validation.

The node threats are well documented:  they are
the viral and spyware threats on each party's
nodes, and the party defection threat (your wife
takes you to court, your boss grabs all your
messages from others).  So even in the face of an
attacker who could conduct an MITM at AIM level,
he still has better opportunities in keyloggers
and so forth on your or your counter party's
machine, and he's much more likely to go for an
attack he can blame on someone else than to drag
in AOL into an active attack.  AFAIK, the TLAs
will happily insert viruses and keyloggers into
your PC, but they won't do an MITM.

So why bother to defend against an unvalidated
MITM attack and ignore the validated attacks
that the user is actually having to deal with?

In short, ignore MITM, or slot it later on.  Look
at what PRZ's new VoIP product does - sets up a
chain of hashes.  Why?  Because he's been thinking
about unprotected email and PGP email for the last
15 years, and he can see that MITM, if it exists,
is a very very specialised threat that does not
effect the 99.99% of the body net.

(anyone found any doco on that btw?)

> and a problem worth avoiding.

Of course.  I'm speaking from the small experience
of having seen several (digitally) signed
documents being presented in a couple of civil
forums so it's an empirical observation, and there
simply isn't enough experience to deal with this
question.

But in sum, the digsigs were considered "mostly
harmless".  At least, whatever view we techies
have for digsigs was not matched by the way they
were received.

One of the reasons
is that neither side dared to question the
authenticity of a document that was tabled,
signed or unsigned.  That's because the risk
of being shown to be wrong was extraordinarily
high, so what tended to happen was that both
sides said "they had not seen that document"
which shifts the attention to whether the doc
was seen by both parties, something that the
digsig doesn't cover.

> IM service provider, it is essential that you have end-to-end encryption

No, this is all based on conjecture.  Normal
rational users, if they don't trust the IM
service provider either switch to another,
guard their talk such that it doesn't matter,
or use nyms.

And, practically speaking, the cost to the
IM service provider in challenging that trust
is way way higher than any plausible benefit
that users could lose if they were MITM'd.

It's just not a threat that matters that much,
even though it is trivial to show that it is
possible.  Covering the MITM is as relevent as
a bullet-proof pocket protector.  Nice for geeks
to own, but not a fashion accessory that users
are likely to go for.

> encryption, perfect forward secrecy,

Those are very valuable.

> and a quickly growing user-base are

No, this is to assume that dig sigs are indeed
non-repudiable attestations.  It's very easy
to repudiate a digital signature.  You just say
you are using some proxy tool and you have no
idea what it does.  The non-repudiable digsig
is a mistake by the crypto community, best off
being totally expunged from the language.

Don't try and repair such a badly broken tool,
remove it from the toolbox and throw it away.

It's complications like these that mean that we
recommend that you should never sign using digsigs
unless you know what it means.  And also why the
protocols have moved over to using secure MACs,
as they don't carry the same stigma as having
any meaning outside the protocol.

iang

---

From: Richard Laager <[email-masked]>
Date: Fri, 12 Aug 2005 11:23:08 -0500

> be plausible logically, but still weak in terms

Gaim (please not GAIM) supports a variety of protocols besides AIM, so
that does change the threat model a bit. It'd be significantly easier to
do a MITM attack on more documented and decentralized protocols.

I'll admit that MITM attacks are rare and sophisticated, but if you're
not guarding against them, the only take you prevent is casual snooping
on the wire. If you're only going to worry about casual snooping, you
could just as well use rot13 as your "encryption". (Granted, I'm
exaggerating a little, but why bother with something as complex and
secure as OpenPGP to prevent casual snooping.) Your points about
keyloggers, etc. are very valid.

Richard Laager

---

From: Ian G <[email-masked]>
Date: Fri, 12 Aug 2005 19:52:25 +0100

Richard Laager wrote:
> Gaim (please not GAIM) ...

I took that one offline, as everyone here knows 'the story.'

For the patient, here's a link I came across today on
OpenPGP's web of trust.  Nice graphs!

http://www.cs.uu.nl/people/henkp/henkp/pgp/pathfinder/plot/

And here's today's emailtapping news.  The court of appeals
reversed a ruling, and said that ISPs could not copy and
read emails.  Meanwhile a survey found that small firms were
failing to copy and escrow emails as instructed.  And companies
can now bring in massive eavesdropping tech to catch insiders
doing bad things.

E-mail wiretap case can proceed, court says
http://news.com.com/E-mail+wiretap+case+can+proceed,+court+says/2100-1028_3-5829228.html?tag=nefd.top
Study Finds Small Securities Firms Still Fail To Comply With SEC E-mail Archiving Regulations
http://www.compliancepipeline.com/showArticle.jhtml?articleID=168601153
When E-Mail Isn't Monitored
http://itmanagement.earthweb.com/secu/article.php/3526881

iang

---

From: Ben Laurie <[email-masked]>
Date: Sun, 14 Aug 2005 16:42:19 +0100

> keyloggers, etc. are very valid.

I wish we could kill this myth that MitM is "rare and sophisticated". On 
wireless networks, they are common and trivial.

On wired networks they are easy for the network admins to mount. The 
practice is sufficiently commonplace that many corps have their own CA 
keys in employees' browsers so they can forge X509 certs.

Keylogging is a _much_ harder attack to mount.

Cheers,

Ben.

-- 
 >>>ApacheCon Europe<<<                   http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Ian G <[email-masked]>
Date: Sun, 14 Aug 2005 18:00:30 +0100

Ben Laurie wrote:
> 
> Richard Laager wrote:
> 
>> I'll admit that MITM attacks are rare and sophisticated,...
> 
> 

I don't think there is any myth that it is sophisticated
or trivial - it gets done many times at conferences of
hackers.  The claim that is made is that it is expensive.

As to whether it is common - the myth is easy to dispel
by presenting some facts.  Most times I've seen it claimed
it has turned out to be something else.

Got any?  Facts, not claims that is....  It would be an
enourmous service to the developers to know how much
weight to put on MITM.  Right now, theory says none
because there is no case history.

> keys in employees' browsers so they can forge X509 certs.

Hmmm.  Is that the sole reason?  Or one of many reasons?

And how often do they conduct this attack?

> Keylogging is a _much_ harder attack to mount.

Doesn't seem to slow down the phishers much...

iang

---

From: Konrad Rosenbaum <[email-masked]>
Date: Mon, 15 Aug 2005 07:38:58 +0200

> And how often do they conduct this attack?

There are web-proxies on the market which do this in order to be able to 
track HTTPS connections of employees. This is illegal or at least of 
doubtful legality in most European countries, so I can't provide you with 
examples of companies who do this.

	Konrad