Subject: [Ilc] Talk announcement: Internet-Level Consensus is Practical

From: David Mazieres <[email-masked]>
Date: Thu, 09 Mar 2017 14:07:03 -0800

I'll be giving the following 30-minute talk during the saag session at
the upcoming IETF meeting in Chicago, likely followed by a "bar bof" on
Internet-level consensus that evening.

		Internet-Level Consensus is Practical

			    David Mazières

		      Security Area Open Meeting
		 Thursday March 30, 2017 15:20-17:20
			    Zurich D room
				   
Consensus is the problem of agreeing on a valid input value among
members of a distributed system.  Internet-level consensus extends the
concept to global agreement, despite the fact that the Internet has no
meaningful notion of membership.  This talk will report on the Stellar
consensus protocol (SCP), an existence proof that secure consensus
does not require well-defined membership.  SCP's key idea is for
individual participants to decide for themselves which other
participants they cannot afford to diverge from.  SCP guarantees
agreement so long as there is transitive overlap in these
dependencies.  SCP is in production use by the Stellar payment
network, but has broader potential applications ranging from secure
package distribution to key management in end-to-end email encryption.

---

From: David Mazieres <[email-masked]>
Date: Thu, 30 Mar 2017 11:46:41 -0700

For those interested in further discussion of Internet-level Consensus
(ILC) following my talk at the SAAG open meeting, let's meet at 7:30pm
at Amuse, the bar inside Swissotel right near the lobby.

David

---

From: David Mazieres <[email-masked]>
Date: Thu, 30 Mar 2017 22:20:16 -0700

Just a brief follow-up to the bar BoF.  We talked about several
potential applications of ILC, including enhanced versions of
certificate transparency, pseudonymous reputation systems, and
software/package transparency.

The application that stood out as the most compelling was binary
transparency of firmware updates for IoT devices.  There's a good chance
that powerful actors will attempt to compromise such devices' firmware
on a large scale.  Merely requiring updates to be digitally signed could
prove insufficient if the manufacturer is compromised.  By contrast,
publicly logging any updates in some data structure checkpointed by all
of the world's log authorities would require a far higher level of
complicity by the manufacturer and greatly increase the chances of
exposing nefarious firmware.

We also thought that it might be best to include transparency from the
start in any standard for authenticating firmware updates.  If we try to
add some kind of transparency to an existing firmware update standard,
it seems unlikely to get as widespread adoption as if transparency is an
integral part of any update standard from day one.

David