Subject: [perpass] Bruce Schneier - A different approach?

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 10 Sep 2013 22:02:57 +0300

Hi all,

as I replied to Dave about the scope of the discussions at the next IETF 
meeting I was wondering about the following issue.

Bruce Schneier asked the IETF for help and, as we have noticed in the 
discussions there are certain limits to what we can do in the IETF (as a 
standardization body).

The wider Internet community, however, has somewhat different options 
and we have in other cases reached out to that community to impact the 
deployment of Internet technologies. A recent example is the IPv6 day.

Why should we turn around and ask the Internet community to help us out 
with some of the issues we cannot solve alone, such as those related to 
the deployment of various security extensions.

I am sure many open source developers are at this moment trying to 
figure out what they should be improving but they may not have the same 
level of expertise as we have.

Needless to say that we first have to figure out what we want to ask for 
and this requires some investigation in what is currently available 
(like Yaron did for S/MIME and Jim Gettys did for his DNSSEC case).

What do you think?

Ciao
Hannes

---

From: Marc Blanchet <[email-masked]>
Date: Tue, 10 Sep 2013 15:13:22 -0400

my take on this debate is that there is much more to do _not in the protocols specifications_ than enhancing what our protocol specs. Deployment, implementations, etc... shall be more targetted to be enhanced.  Therefore I agree with your idea.  And opensource is just one market.

Marc.

Le 2013-09-10 à 15:02, Hannes Tschofenig <[email-masked]> a écrit :

> Hi all,
> 
> as I replied to Dave about the scope of the discussions at the next IETF meeting I was wondering about the following issue.
> 
> Bruce Schneier asked the IETF for help and, as we have noticed in the discussions there are certain limits to what we can do in the IETF (as a standardization body).
> 
> The wider Internet community, however, has somewhat different options and we have in other cases reached out to that community to impact the deployment of Internet technologies. A recent example is the IPv6 day.
> 
> Why should we turn around and ask the Internet community to help us out with some of the issues we cannot solve alone, such as those related to the deployment of various security extensions.
> 
> I am sure many open source developers are at this moment trying to figure out what they should be improving but they may not have the same level of expertise as we have.
> 
> Needless to say that we first have to figure out what we want to ask for and this requires some investigation in what is currently available (like Yaron did for S/MIME and Jim Gettys did for his DNSSEC case).
> 
> What do you think?
> 
> Ciao
> Hannes
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 10 Sep 2013 22:30:52 +0300

Open source is certainly only one market, although important in the 
security context when I think about all the libraries.

Needless to say that many products are not open source and we would want 
to encourage them to get better as well (as we did with the IPv6 day).

Maybe we need a "Crypto Day".

On 10.09.2013 22:13, Marc Blanchet wrote:
> Le 2013-09-10 à 15:02, Hannes Tschofenig<[email-masked]>  a écrit :
>
>> Hi all,
>>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Sep 2013 15:37:04 -0400

> Maybe we need a "Crypto Day".

My proposal is to turn 'PRISM-Proof' into a marketing seal for products and
services that can demonstrate that they are free from intercept
capabilities.

-- 
Website: http://hallambaker.com/

---

From: Mark Townsley <[email-masked]>
Date: Tue, 10 Sep 2013 21:41:56 +0200

Critical aspects of the World IPv6 Day/Launch activity were clear goals as to what it meant to be "in", as well as independent measurement of those that signed up (at first AAAAs in the DNS, later 1% traffic from an ISP as measured by a set of content providers). The nature of what's being considered here might make this tricky (e.g., monitoring of techniques that themselves are aimed at averting the ability to monitor!). In any case, if we try and do something like this and want to follow the World Day/Launch model, I'd encourage thinking about what the metrics and analysis should be.

- Mark

PS. As someone working to see IPv6 deployed, increased use of SSL is a boost as https leads to more global IPv4 address demand and more need for IPv6. Go crypto.

On Sep 10, 2013, at 9:30 PM, Hannes Tschofenig wrote:

> Open source is certainly only one market, although important in the security context when I think about all the libraries.
> 
> Needless to say that many products are not open source and we would want to encourage them to get better as well (as we did with the IPv6 day).
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 10 Sep 2013 23:00:15 +0300

Hi Mark,

you are certainly right on the clear goals and metrics.

Just as one example consider a topic like "HTTPS everywhere". We had 
this IAB technical plenary about Web Security not too long ago (IETF#83) 
and Ekr gave a talk with the title "How do we get to
TLS Everywhere?". On slide 5 of his talk (see 
http://www.ietf.org/proceedings/83/slides/slides-83-iab-9-technical-plenary.pdf) 
he quotes Cullen.

Even with such a topic there would already be enough work (such as 
guidelines for how to get certificates, how to configure various Web 
servers and use different hosting providers), etc.

The good thing about such a topic is that we are not the first group to 
look at it. There is also EFF and others.

There the goal could be to get from the current 1% TLS usage to 
something like 10% in 3 years (or so).

Measuring the TLS usage is also easier (as a number of projects, like 
EFF with their SSL Observatory demonstrated).

Is that would you roughly had in mind (of course with much more detail)?

Ciao
Hannes

On 10.09.2013 22:41, Mark Townsley wrote:
>
> Critical aspects of the World IPv6 Day/Launch activity were clear
> goals as to what it meant to be "in", as well as independent
> measurement of those that signed up (at first AAAAs in the DNS, later
> 1% traffic from an ISP as measured by a set of content providers).
> The nature of what's being considered here might make this tricky
> (e.g., monitoring of techniques that themselves are aimed at averting
> the ability to monitor!). In any case, if we try and do something
> like this and want to follow the World Day/Launch model, I'd
> encourage thinking about what the metrics and analysis should be.
>
> - Mark
>
> PS. As someone working to see IPv6 deployed, increased use of SSL is
> a boost as https leads to more global IPv4 address demand and more
> need for IPv6. Go crypto.
>
>
>> Needless to say that many products are not open source and we would
>> want to encourage them to get better as well (as we did with the
>> IPv6 day).
>>
>>> my take on this debate is that there is much more to do _not in
>>> the protocols specifications_ than enhancing what our protocol
>>> specs. Deployment, implementations, etc... shall be more
>>> targetted to be enhanced.  Therefore I agree with your idea.  And
>>> opensource is just one market.
>>>
>>> Marc.
>>>
>>> Le 2013-09-10 à 15:02, Hannes
>>> Tschofenig<[email-masked]>   a écrit :
>>>
>>>> Hi all,
>>>>
>>>> as I replied to Dave about the scope of the discussions at the
>>>> next IETF meeting I was wondering about the following issue.
>>>>
>>>> Bruce Schneier asked the IETF for help and, as we have noticed
>>>> in the discussions there are certain limits to what we can do
>>>> in the IETF (as a standardization body).
>>>>
>>>> The wider Internet community, however, has somewhat different
>>>> options and we have in other cases reached out to that
>>>> community to impact the deployment of Internet technologies. A
>>>> recent example is the IPv6 day.
>>>>
>>>> Why should we turn around and ask the Internet community to
>>>> help us out with some of the issues we cannot solve alone, such
>>>> as those related to the deployment of various security
>>>> extensions.
>>>>
>>>> I am sure many open source developers are at this moment trying
>>>> to figure out what they should be improving but they may not
>>>> have the same level of expertise as we have.
>>>>
>>>> Needless to say that we first have to figure out what we want
>>>> to ask for and this requires some investigation in what is
>>>> currently available (like Yaron did for S/MIME and Jim Gettys
>>>> did for his DNSSEC case).
>>>>
>>>> What do you think?
>>>>
>>>> Ciao Hannes _______________________________________________
>>>> perpass mailing list [email-masked]
>>> _______________________________________________ perpass mailing
>>> list [email-masked]
>> _______________________________________________ perpass mailing
>> list [email-masked]
> _______________________________________________ perpass mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/perpass

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 10 Sep 2013 23:01:53 +0300

On 10.09.2013 22:37, Phillip Hallam-Baker wrote:
>
>
>
> On Tue, Sep 10, 2013 at 3:30 PM, Hannes Tschofenig
> <[email-masked] <mailto:[email-masked]>> wrote:
>
> My proposal is to turn 'PRISM-Proof' into a marketing seal for products
> and services that can demonstrate that they are free from intercept
> capabilities.

I have no expertise with designing seals. What specifically would that 
mean? Would a Webpage or a smart phone app show such a seal? Who would 
verify it? Would there be some assessment? If so, by whom? Who would pay 
for it?

Ciao
Hannes

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 10 Sep 2013 18:22:53 -0400

> verify it? Would there be some assessment? If so, by whom? Who would pay

Me either.
ISTM that you need to convince the NSA to give out these seals. :-)

	Thanks,
	Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Sep 2013 18:29:46 -0400

On Tue, Sep 10, 2013 at 4:01 PM, Hannes Tschofenig <
[email-masked]> wrote:

>> <[email-masked] <mailto:hannes.tschofenig@gmx.**net<[email-masked]>>>
>> wrote:
>>

Step one would be to establish a set of standards that PRISM-Proof tech
would have to meet.

For example a PRISM-Proof email scheme would have to meet the key
generation criteria that I outlined and support S/MIME message format with
some new key discovery mechanism with Certificate Transparency properties
(spec to follow).

The composition of a board to decide on the properties etc. is secondary
since any such set of specs would have to meet the usability criteria and
at least some of the tin foil hat criteria.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Sep 2013 18:34:15 -0400

> ISTM that you need to convince the NSA to give out these seals. :-)

Anyone who could show that there was a vulnerability should be listened to.

But as I pointed out to my government contacts, at this point it is clear
that the NSA has completely failed at its mission to protect US government
secrets. They have lax internal controls and people like Snowden have
access way above their rank and need to know.

So I would bet the information assurance side of NSA is actually quite
interested in fixing their problem and the intercept side is going to be in
so much confusion and disarray that they are unlikely to be in a position
to influence matters for many years.

---

From: Dan Wing <[email-masked]>
Date: Tue, 10 Sep 2013 16:17:19 -0700

> The wider Internet community, however, has somewhat different options and we have in other cases reached out to that community to impact the deployment of Internet technologies. A recent example is…

Self-selection, like was done by ISOC for World IPv6 Launch, http://www.worldipv6launch.org/participants/?q=1, and grade the hosts by the quality of their TLS handshake for their entire web page.  Forward secrecy is something we might want to measure, for example.  An example of a grade is what ssllabs does.  See for example 
  https://www.ssllabs.com/ssltest/analyze.html?d=www.ietf.org
  https://www.ssllabs.com/ssltest/analyze.html?d=www.nsa.gov).

-d

---

From: Yoav Nir <[email-masked]>
Date: Tue, 10 Sep 2013 23:18:32 +0000

On Sep 11, 2013, at 1:34 AM, Phillip Hallam-Baker <[email-masked]>
 wrote:

> But as I pointed out to my government contacts, at this point it is clear that the NSA has completely failed at its mission to protect US government secrets. They have lax internal controls and people like Snowden have access way above their rank and need to know.

Agree. This is especially disturbing considering that this is only 3 years after Pfc Manning turned out to have access to a huge pile of documents.

> So I would bet the information assurance side of NSA is actually quite interested in fixing their problem and the intercept side is going to be in so much confusion and disarray that they are unlikely to be in a position to influence matters for many years. 

I wish I shared your optimism. I don't think the NSA is in any disarray.

Yoav