Subject: [therightkey] DNSNMC deprecates Certificate Authorities and fixes HTTPS security

From: Tao Effect <[email-masked]>
Date: Fri, 13 Dec 2013 23:56:29 -0500

Hi list,

Was referred here from another IETF-related list. Just announced a project that combines several technologies that address the security issues with TLS to "NSA-proof" the web.

Here is an excerpt from the paper (link to paper below it):

DNSNMC fixes the authentication problems previously described, and it addresses all of the problems that with the previously mentioned proposals. It does this first by combining DNS with Namecoin (NMC), and then by encouraging a “trust only those you know” policy.5

“Namecoin is an open source decentralized key/value registration and transfer system based on Bitcoin technology”.[16] Namecoin “squares Zooko’s Triangle”, meaning, it makes it possible to have domain names (and other types of identifiers) that are:

Authenticated: users can be certain that they are not speaking to an impostor

Decentralized: there is no central authority controlling all the names

Human-readable: names look just like today’s domain names

However, by itself, Namecoin does not provide the means by which ordinary users can take advantage of the features it provides. Using Namecoin is far too cumbersome for the vast majority of internet users, even those with years of computer expertise. For one, it cannot be used on mobile devices (like iPhones) in its current state because of its network requirements.

DNSNMC provides the missing “glue” to the Namecoin blockchain that makes it immediately accessible to clients of all types with zero configuration. A network administrator need only enter the IP address of a DNSNMC-compliant DNS server to instantly make the information within the blockchain accessible to all of the users that she (or he) provides internet access to. 

Paper: http://okturtles.com/other/dnsnmc_okturtles_overview.pdf

Cheers,
Greg Slepak
--
Please do not email me anything that you are not comfortable also sharing with the NSA.

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 14 Dec 2013 12:51:01 -0500

"The first project, DNSNMC, deprecates today's insecure and fraudulent1 public
key infrastructure (PKI) by gracefully transitioning DNS from its
hierarchical design, to one that is based on a globally distributed,
peer-to-peer network that successfully "squares Zooko's triangle""

I think you have lost me already. If you want to get anywhere with a
proposal probably not a good idea to accuse the people who might implement
it as being 'fraudulent'.

"We use the term “meaningful security” to refer to the security provided by
protocols that employ all of these features for communication between
individuals."

Have you paused to consider the reasons why the market has not adopted the
security mechanisms then embody those principles to date? Designing a spec
that provides more security if used is trivial. The hard part is proposing
something that is secure and usable.

And for someone who is accusing others of being 'fraudulent', not a good
move to start off repeating figures already exposed as bogus like the oft
repeated but still untrue claim of 600 CAs.

Tying the notary log to namecoin seems to be completely pointless to me,
unless the real objective is to promote namecoin. Why hook into namecoin
rather than the market leader?

Given the success of the US government in shutting down eGold type schemes
I am very skeptical about the stability of 'namecoin'. If we accept the
purported scenarios that motivate the scheme then namecoin won't last very
long.

The fact that BitCoin has survived this long is rather surprising. We have
already seen a huge robbery of over $200 million in bitcoin (from a drug
dealer). And now we have people trying to de-anonymize the system to stop
the coins being spent (!)

When the feds moved on the e-Gold crowd they started off by rolling up the
small guys and created a crisis of confidence in the big ones. What would
be the effect on the price of Bitcoin if the feds shut down namecoin using
the same tactics they used against mega-upload? I don't think it would take
much to start a run.

---

From: Ben Laurie <[email-masked]>
Date: Sat, 14 Dec 2013 19:12:14 +0000

On 14 December 2013 04:56, Tao Effect <[email-masked]> wrote:
> Hi list,
>
> Was referred here from another IETF-related list. Just announced a project
> that combines several technologies that address the security issues with TLS
> to "NSA-proof" the web.
>
> DNSNMC fixes the authentication problems previously described, and it
> addresses all of the problems that with the previously mentioned proposals.
> It does this first by combining DNS with Namecoin (NMC), and then by
> encouraging a “trust only those you know” policy.5
>
> “Namecoin is an open source decentralized key/value registration and
> transfer system based on Bitcoin technology”.[16] Namecoin “squares Zooko’s
> Triangle”, meaning, it makes it possible to have domain names (and other
> types of identifiers) that are:
>

If it is based on bitcoin, that is untrue. Or even if not. See
http://www.links.org/files/decentralised-currencies.pdf.

> However, by itself, Namecoin does not provide the means by which ordinary
> users can take advantage of the features it provides. Using Namecoin is far
> too cumbersome for the vast majority of internet users, even those with
> years of computer expertise. For one, it cannot be used on mobile devices
> (like iPhones) in its current state because of its network requirements.
>
> DNSNMC provides the missing “glue” to the Namecoin blockchain that makes it
> immediately accessible to clients of all types with zero configuration. A
> network administrator need only enter the IP address of a DNSNMC-compliant
> DNS server to instantly make the information within the blockchain
> accessible to all of the users that she (or he) provides internet access to.
>
> _______________________________________________
> therightkey mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/therightkey
>

---

From: Ali-Reza Anghaie <[email-masked]>
Date: Sat, 14 Dec 2013 14:25:06 -0500

On Sat, Dec 14, 2013 at 12:51 PM, Phillip Hallam-Baker <[email-masked]> wrote:
> Given the success of the US government in shutting down eGold type schemes I
> am very skeptical about the stability of 'namecoin'. If we accept the

Aside from the tactful / lack thereof issues in the delivery - this is
a key point not addressed in the proposal. Adoption requires not only
a State unwilling to quash it but ISPs and other providers willing to
support it. This isn't just a US issue, it's quite prevalent an issue
in every moderately to well connected State.

I see nothing in this proposal as of now that I could see any major
provider getting behind in a major way.

> the coins being spent (!)

I'm not sure I agree here - I think it has a lot of believers but also
as importantly it has a lot of power brokers perfectly happy to let it
thrive in the niche area where it can be corralled into easily
identified groups. This tactic will fail the State with other Bitcoin
derivatives but the initial runup (which we're still in) somewhat
reflects a normal permissive environment with the hopes of
criminalization benefits to the State.

-Ali

---

From: Leif Johansson <[email-masked]>
Date: Sun, 15 Dec 2013 11:21:03 +0100

> in every moderately to well connected State.
Its still interesting to consider distributed proof-of-work systems
_like_ bitcoin as a basis for public ledger systems. I realize that this
isn't exactly what this proposal is about.

I also see quite a few challenges with this proposal. For instance I
don't see how running and trusting your own DNSNMC server is
significantly different (or easier) than running and trusting your own CA.

However, distributed systems like this should not be dismissed offhand
as inherently un-deployable by using, what are essentially
guilt-by-association arguments.

        Cheers Leif

---

From: Tao Effect <[email-masked]>
Date: Sun, 15 Dec 2013 20:50:26 -0500

> And for someone who is accusing others of being 'fraudulent', not a good move to start off repeating figures already exposed as bogus like the oft repeated but still untrue claim of 600 CAs.

I thought the EFF was a reputable source.

There has been no update or correction to their post: https://www.eff.org/deeplinks/2011/10/how-secure-https-today

If this information is incorrect please provide a link with more details. If the EFF is wrong about this, then I'll make sure to update the paper.

> Tying the notary log to namecoin seems to be completely pointless to me, unless the real objective is to promote namecoin. Why hook into namecoin rather than the market leader? 

What market leader?

> Given the success of the US government in shutting down eGold type schemes I am very skeptical about the stability of 'namecoin'. If we accept the purported scenarios that motivate the scheme then namecoin won't last very long.

What eGold scheme are you comparing Namecoin to?

Are you sure you know what you're talking about here...? ;-)

Cheers,
Greg

On Dec 14, 2013, at 12:51 PM, Phillip Hallam-Baker <[email-masked]> wrote:

> "The first project, DNSNMC, deprecates today's insecure and fraudulent1 public key infrastructure (PKI) by gracefully transitioning DNS from its hierarchical design, to one that is based on a globally distributed, peer-to-peer network that successfully "squares Zooko's triangle""
> 
> I think you have lost me already. If you want to get anywhere with a proposal probably not a good idea to accuse the people who might implement it as being 'fraudulent'.
> 
> 
> "We use the term “meaningful security” to refer to the security provided by protocols that employ all of these features for communication between individuals."
> 
> Have you paused to consider the reasons why the market has not adopted the security mechanisms then embody those principles to date? Designing a spec that provides more security if used is trivial. The hard part is proposing something that is secure and usable.
> 
> 
> And for someone who is accusing others of being 'fraudulent', not a good move to start off repeating figures already exposed as bogus like the oft repeated but still untrue claim of 600 CAs.
> 
> Tying the notary log to namecoin seems to be completely pointless to me, unless the real objective is to promote namecoin. Why hook into namecoin rather than the market leader? 
> 
> 
> Given the success of the US government in shutting down eGold type schemes I am very skeptical about the stability of 'namecoin'. If we accept the purported scenarios that motivate the scheme then namecoin won't last very long.
> 
> The fact that BitCoin has survived this long is rather surprising. We have already seen a huge robbery of over $200 million in bitcoin (from a drug dealer). And now we have people trying to de-anonymize the system to stop the coins being spent (!)
> 
> When the feds moved on the e-Gold crowd they started off by rolling up the small guys and created a crisis of confidence in the big ones. What would be the effect on the price of Bitcoin if the feds shut down namecoin using the same tactics they used against mega-upload? I don't think it would take much to start a run. 
> 
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 15 Dec 2013 21:21:39 -0500

On Sun, Dec 15, 2013 at 8:50 PM, Tao Effect <[email-masked]> wrote:

> There has been no update or correction to their post:
> https://www.eff.org/deeplinks/2011/10/how-secure-https-today
>

Which kind of calls their credibility into question. HALF the 'CAs' in
their graph are from the DFN root. You can check that out for yourself, it
is a German CA that issues certs to higher education institutions. As has
been demonstrated (and agreed by the EFF people), DFN do not sign certs for
key signing keys they do not hold.

You can't calculate the number of CAs the way the EFF tried to. An
intermediate certificate does not equate to a CA. Pretending it does to
peddle an alternative PKI scheme calls into question their veracity.

I have tried to get members of the EFF board to look into this but they
never get back. Too much trouble to get it right.

> rather than the market leader?

I was under the impression that Bitcoin was the preferred currency of
libertopia. It is the only one that gets mention in the mainstream press.
It is not clear to me how namecoin can be part of BitCoin and another
currency.

> What eGold scheme are you comparing Namecoin to?

Gold Age, eGold, Liberty Reserve. All the ones that were taken apart by the
Feds.

> Are you sure you know what you're talking about here...? ;-)

I must admit that I find the scheme completely confused and assumes that I
know a lot that I do not.

I might be a little more inclined to make an effort if you hadn't attacked
me as being 'fraudulent' in your opening.

-- 
Website: http://hallambaker.com/

---

From: Leif Johansson <[email-masked]>
Date: Mon, 16 Dec 2013 07:32:26 +0100

> 16 dec 2013 kl. 03:21 skrev Phillip Hallam-Baker <[email-masked]>:
> 
> 
> 
> 
> Which kind of calls their credibility into question. HALF the 'CAs' in their graph are from the DFN root. You can check that out for yourself, it is a German CA that issues certs to higher education institutions. As has been demonstrated (and agreed by the EFF people), DFN do not sign certs for key signing keys they do not hold.
> 

yep, DFN is a 'private' sub-CA under tight control but it could still be attacked the way diginotar was and though I believe their secuity is a lot better than their less fortunate Dutch cousins, a successful attack would be just as bad.

> You can't calculate the number of CAs the way the EFF tried to. An intermediate certificate does not equate to a CA. Pretending it does to peddle an alternative PKI scheme calls into question their veracity.
> 
> I have tried to get members of the EFF board to look into this but they never get back. Too much trouble to get it right.
> 
> 
> I was under the impression that Bitcoin was the preferred currency of libertopia. It is the only one that gets mention in the mainstream press. It is not clear to me how namecoin can be part of BitCoin and another currency.
> 
>  
> Gold Age, eGold, Liberty Reserve. All the ones that were taken apart by the Feds.
> 
>  
> I must admit that I find the scheme completely confused and assumes that I know a lot that I do not.
> 
> I might be a little more inclined to make an effort if you hadn't attacked me as being 'fraudulent' in your opening.
>  
> 
> --

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 16 Dec 2013 09:31:28 -0500

On Mon, Dec 16, 2013 at 1:32 AM, Leif Johansson <[email-masked]> wrote:

> yep, DFN is a 'private' sub-CA under tight control but it could still be
> attacked the way diginotar was and though I believe their secuity is a lot
> better than their less fortunate Dutch cousins, a successful attack would
> be just as bad.
>

That does not excuse

1) Failing to examine the issue when the DFN root accounted for half of the
purported '600 CAs'

2) Continuing to count the DFN as 300 CAs when they know it is one.

Putting out sloppy research and then failing to correct it when a mistake
is committed is the problem. If someone publishes a flawed study I expect
them to withdraw it when the errors are pointed out. I don't expect them to
say that they are going to continue to publish a number they know is out by
a factor of at least 2 because getting a correct number would be too much
work.

If people are going to make pointed accusations about the trustworthiness
of others then they had better not continue to knowingly publish false data.

As with the 'Al Gore claimed to invent the internet' lie, this has become a
zombie lie that is repeated to make a political point by people who don't
really care if what they are saying is true or not.

I think that is a problem. And I am going to continue to point out that the
EFF is peddling a lie until they withdraw it.

---

From: Leif Johansson <[email-masked]>
Date: Mon, 16 Dec 2013 15:54:49 +0100

On 2013-12-16 15:31, Phillip Hallam-Baker wrote:
>
>
>
> On Mon, Dec 16, 2013 at 1:32 AM, Leif Johansson <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>
>     16 dec 2013 kl. 03:21 skrev Phillip Hallam-Baker <[email-masked]
>     <mailto:[email-masked]>>:
>
>>
>>
>>
>>     On Sun, Dec 15, 2013 at 8:50 PM, Tao Effect
>>     <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>>         And for someone who is accusing others of being
>>>         'fraudulent', not a good move to start off repeating figures
>>>         already exposed as bogus like the oft repeated but still
>>>         untrue claim of 600 CAs.
>>
>>         There has been no update or correction to their
>>         post: https://www.eff.org/deeplinks/2011/10/how-secure-https-today
>>
>>
>>     Which kind of calls their credibility into question. HALF the
>>     'CAs' in their graph are from the DFN root. You can check that
>>     out for yourself, it is a German CA that issues certs to higher
>>     education institutions. As has been demonstrated (and agreed by
>>     the EFF people), DFN do not sign certs for key signing keys they
>>     do not hold.
>>
>
>     yep, DFN is a 'private' sub-CA under tight control but it could
>     still be attacked the way diginotar was and though I believe their
>     secuity is a lot better than their less fortunate Dutch cousins, a
>     successful attack would be just as bad.
>
>
>
> That does not excuse 
>
> 1) Failing to examine the issue when the DFN root accounted for half
> of the purported '600 CAs'
>

agree

>
> Putting out sloppy research and then failing to correct it when a
> mistake is committed is the problem. If someone publishes a flawed
> study I expect them to withdraw it when the errors are pointed out. I
> don't expect them to say that they are going to continue to publish a
> number they know is out by a factor of at least 2 because getting a
> correct number would be too much work.
>
> If people are going to make pointed accusations about the
> trustworthiness of others then they had better not continue to
> knowingly publish false data.
>
>
> As with the 'Al Gore claimed to invent the internet' lie, this has
> become a zombie lie that is repeated to make a political point by
> people who don't really care if what they are saying is true or not.
>
> I think that is a problem. And I am going to continue to point out
> that the EFF is peddling a lie until they withdraw it.
>
> --

---

From: Rob Stradling <[email-masked]>
Date: Mon, 16 Dec 2013 15:06:08 +0000

On 16/12/13 14:31, Phillip Hallam-Baker wrote:
<snip>
> That does not excuse
>
> 1) Failing to examine the issue when the DFN root accounted for half of
> the purported '600 CAs'
>
> mistake is committed is the problem. If someone publishes a flawed study
> I expect them to withdraw it when the errors are pointed out. I don't
> expect them to say that they are going to continue to publish a number
> they know is out by a factor of at least 2 because getting a correct
> number would be too much work.

FWIW, I suggested to Mozilla a few months ago that they could survey the 
CAs in order to find out the correct number (or, at least, a rather more 
accurate approximation!)

They seemed interested.

The conversation was somewhere in the middle of this thread...
http://mozilla.6506.n7.nabble.com/SSL-TLS-and-HTTPS-in-a-Post-Prism-Era-td294842.html

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 13:44:35 -0500

> I have tried to get members of the EFF board to look into this but they never get back. Too much trouble to get it right.

OK, in order for me to correct this in the paper I need the following information:

1. A link to who "DFN" is.
2. A 'yes' or 'no' as to whether DFN is a root cert that browsers are shipped with (and details about this, like, do all 3 major browsers include DFN?)
3. A link to a paper, a blog post, or an article somewhere that describes in detail your side of the argument

Let me emphasize that none of this ultimately matters to the points that were made in the paper.

Whether the number is 600+ or 300+, it's still an insecure, broken mess.

> I was under the impression that Bitcoin was the preferred currency of libertopia. It is the only one that gets mention in the mainstream press. It is not clear to me how namecoin can be part of Bit…

I'll be happy to clear this up:

- Bitcoin is not the "market leader" of distributed DNS systems. Namecoin is.
- Namecoin and Bitcoin are designed with completely different goals in mind. They are not competitors.
- Namecoin is not intended to be a bitcoin replacement, nor the other way around. It is not like "litecoin" or any of the other bitcoin competitors, because it is not a competitor to bitcoin.

> Gold Age, eGold, Liberty Reserve. All the ones that were taken apart by the Feds.

I'll be happy to clear this up too:

None of these are comparable to Bitcoin or Namecoin.

Neither "Gold Age", nor "eGold", nor "Liberty Reserve" were truly decentralized, distributed currencies.

- "Gold Age" was not a currency: https://en.wikipedia.org/wiki/Gold_Age
- eGold: Centralized currency with no "reliable user identification" (not a problem with Bitcoin or Namecoin)
- Liberty Reserve: Centralized currency https://en.wikipedia.org/wiki/Liberty_Reserve#Background

People who are standing back and scratching their heads, wondering why Bitcoin is still around after years of being used to purchase illegal drugs, murder-for-hire, and weapons (continuing to this day btw), simply don't understand what Bitcoin is.

> I might be a little more inclined to make an effort if you hadn't attacked me as being 'fraudulent' in your opening.

Do you represent a company that sells SSL certs? It seems like you might:

During twelve years as Principal Scientist at VeriSign Inc.,

Perhaps the paper is a bit harsh (and I welcome suggestions to improve its language), but the critiques it levies against companies that sell SSL certs are completely valid:

Companies that sell SSL certificates usually claim that their certificates provide customers with “security.” Customers are led to believe that these certificates protect browser-server communication from eavesdropping and tampering. As elaborated in this paper, this simply isn’t true today.

I have to say, that among the cert companies websites that I looked at, VeriSign's homepage makes the fewest claims about the security protections it provides.

The words "usually claim" leaves room for exceptions. I could not find, on the customer-facing pages on VeriSign's site, any claims that VeriSign's SSL certs "protect browser-server communication from eavesdropping and tampering."

Some close calls are:

In short, when it comes to securing online transactions, safeguarding customer information, and protecting business reputation, you're only as safe as the Certificate Authority you choose.
https://www.symantec.com/ssl-certificates-advantages

Customers Gain Confidence with the Green Address Bar: Online shoppers recognize the green address bar as an easy and reliable way to verify the site identity and security.
https://www.symantec.com/verisign/ssl-certificates/secure-site-pro-ev?fid=ssl-certificates

VeriSign's SSL certificates do not provide websites with meaningful protection as defined in the DNSNMC paper because they cannot be securely authenticated in the face of a fraudulent certificate that's presented to customers by a MITM.

If your certs can simply be replaced by any of the other CAs out there, then *all* of the security they provide is thrown out the window.

Furthermore, because VeriSign is a random third-party, not the company that user's visit when they visit a site using VeriSign's certificate, the protection offered by that certificate is inherently inferior to a securely authenticated self-signed certificate.

This is simply mathematics, and not a point that's up for debate.

When trust is distributed across more parties, that trust is diluted because it now depends on the least secure of those parties.

Sidenote:

It seems like I was sent "to the sharks" so to speak (perhaps as a practical joke?).

So far almost half of the replies to this thread have come from representatives of SSL companies.

The hostility is therefore no surprise.

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 16:31:08 -0500

Hey Ben,

> http://www.links.org/files/decentralised-currencies.pdf.

Thank you for the link to this paper.

I needed to find the time to actually read this and get back to you. I've now done this.

You've posted this reply to a number of lists that we're both subscribed to, so I'm going to send this reply to each one:

My reply can be summarized (mostly) by Vladimir's response to your paper here:

https://bitcointalk.org/index.php?topic=25760.msg372591#msg372591

For the list's sake, here are the salient points Sir Vladimir makes:

Than, first of all, he is trying to solve a non-problem and fails to see that issue he is trying to solve is not a bug but a feature.

This is in reference to your criticism of proof-of-work. Here's the rest of his comment on that particular point:

There is no problem with energy consumption, it is a very low price to
pay for getting rid of all the middlemen leaching a few percent from
every money transfer. Moreover, energy spent by miners on securing the
bloc chain is rather negligible in comparison to energy spent on other
ways to do money, when you consider, for example energy, required to
haul all the cash and gold in armoured trucks, smelting gold bullions,
coining coins, smelting metal for the bank vaults and so on...

Second criticism of your paper is as follows (again, I'll just copy Vlad's comments here):

Second of all, his "efficient solution" is very weak. Essentially, he
is proposing to replace voting weighted by pure computational power
(surely not very energy efficient way) to voting weighted by a number
of clients plugged into the network, without proposing any viable way
(since it is impossible) to ensure that this number of clients is not
faked. Therefore, he is effectively shifting proof-of-work concept
from doing lots of sha-256 calculations to opening lots of ports on
lots of IP's simultaneously. This could solve a problem of quick
propagations and wide distribution of information, but surely not a
problem of "double spending". Total epic fail!

Somehow, you seem to have completely missed the point of Bitcoin's proof-of-work. It's right there in the original paper:

The proof-of-work also solves the problem of determining representation in majority decision making. If the majority were based on one-IP-address-one-vote, it could be subverted by anyone able to allocate many IPs. Proof-of-work is essentially one-CPU-one-vote.

Vladimir made one final comment (not too important though, but I'll include it anyway):

He also has completely missed economic part of the system where
initial bitcoin inflation serves the purpose of subsidy to enable
quick growth of the network and making it secure from 50% attacks.

However, all of these points made by Vladimir do not destroy the point your paper makes entirely. They just badly bruise it.

IMO, the only legitimate criticism of Bitcoin contained in your paper is the following:

If, for example, 1% of the total power available7 is used to produce Bitcoins at present (in fact, the amount is far less than that), then at any point someone could come along with a further 1.1% of the total power and use this to define their own consensus8 , thus invalidating all the work, and all the money, of the initial group, and instead take possession of the entire currency for themselves.

This is referring to (or at least should be referring to) the idea of an attacker making their own "fake fork" that they control through superior-CPU power.

The strength of your argument (IMO) rests on this one issue: Whether or not there exists an attacker with the computational power necessary to take over the network.

This is a legitimate question, and combined with the observations made by Vladimir, it implies two takeaway points:

1. Your suggestion for an "efficient alternative" to Bitcoin appears to be inferior to Bitcoin because it appears to be based on one-IP-one-vote (rejected in the original paper).

2. Bitcoin's legitimacy and trustworthiness depends on whether or not there exists (or can exist) an entity with more horsepower than all more than 50% of the nodes on the network. This is old news.

The Bitcoin community has been discussing the 51% attack for a while and appears to be working on addressing the issue:

https://en.bitcoin.it/wiki/Proof_of_blockchain_fair_sharing

In case it's of interest to someone, here are two sites about known attacks on Bitcoin:

http://codinginmysleep.com/bitcoin-attacks-in-plain-english/
https://en.bitcoin.it/wiki/Double-spending

Cheers,
Greg

---

From: Ben Laurie <[email-masked]>
Date: Mon, 16 Dec 2013 22:00:49 +0000

On 16 December 2013 21:31, Tao Effect <[email-masked]> wrote:
> You've posted this reply to a number of lists that we're both subscribed to,
> so I'm going to send this reply to each one:

Fun though it is to debate the merits of bitcoin, the question at hand
is whether we should form a WG.

If you want to propose a bitcoin based protocol, go right ahead.

My difficulties with bitcoin as a whole are on record. I may have more
to say about a specific I-D.

P.S. I think you're criticising a different paper. For example, this
one doesn't even mention IP addresses.

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 17:12:59 -0500

> If you want to propose a bitcoin based protocol, go right ahead.

Though this thread is more of an announcement, it can also be considered a first draft of a proposal for DNSNMC.

Paper was linked to in the first post, here it is again:

http://okturtles.com/other/dnsnmc_okturtles_overview.pdf

> My difficulties with bitcoin as a whole are on record.

OK... and so are the replies to your paper.

> one doesn't even mention IP addresses.

What are you mentioning then? What does this paragraph refer to, if not IP addresses?

Next we have to agree who should get the coin. This is not particularly hard. First we use efficient unbounded agreement to number the current participants11 sequentially. We then use it to agree a consensus random number. This could be done, for example, by agreeing a commitment for each participant, and then revealing the value they committed to, adding them all together and taking the modulo of that total, which would randomly designate a participant.

Cheers,
Greg

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 16 Dec 2013 22:25:09 +0000

Hiya,

(As list moderator)

On 12/16/2013 10:12 PM, Tao Effect wrote:
> Next we have to agree who should get the coin.

I don't want to shut this down too quickly but I will point
out that designing protocols via one-by-one mail messages
to an IETF list is not really something that works out so
please let's not go that route.

I'd say if a bunch of folks are interested in this proposal
then better would be to go and get together and work on it
some more and if you're interested in pursuing it in the
IETF then writing an Internet-draft is the way to go. I
assume that interested people will contact Greg and then
self-organise.

If anyone wants to do that and needs help/hints, mail me
offlist.

Thanks,
S.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 16 Dec 2013 22:31:36 +0000

On 16 December 2013 22:12, Tao Effect <[email-masked]> wrote:
> Next we have to agree who should get the coin. This is not particularly
> hard. First we use efficient unbounded agreement to number the current
> participants11 sequentially. We then use it to agree a consensus random
> number. This could be done, for example, by agreeing a commitment for each
> participant, and then revealing the value they committed to, adding them all
> together and taking the modulo of that total, which would randomly designate
> a participant.

For anyone following along: there's little chance you'll understand
this paragraph without reading the paper. Sorry. But it doesn't refer
to IP addresses.

Once more: this is not the forum for debating the merits of bitcoin.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 16 Dec 2013 17:37:08 -0500

When you make an assertion in a paper then you are accepting the burden of
proof.

If the source for the '600' claim was lying then the claim has to be taken
off the table completely. The DFN root issue demonstrates that the
methodology is bogus rather than just being a single inaccurate data point.

If you want to make assertions about the number of CAs then the most
accurate measure currently available is still the number of roots in the
commonly used browsers. While there are a handful of CAs using roots cross
certified by another CA, such CAs now have to have a full audit statement
and meet all the acceptance criteria in their own right. So there would be
little point in not applying to have the root entered in independently.

Since the 600 number is inaccurate and not particularly necessary, why
bother to quote it at all?

On Mon, Dec 16, 2013 at 1:44 PM, Tao Effect <[email-masked]> wrote:

> 2. A 'yes' or 'no' as to whether DFN is a root cert that browsers are
> shipped with (and details about this, like, do all 3 major browsers include
> DFN?)
> Whether the number is 600+ or 300+, it's still an *insecure*, *broken*mess.
>
> - Namecoin is not intended to be a bitcoin replacement, nor the other way
> around. It is not like "litecoin" or any of the other bitcoin competitors,
> because it is not a competitor to bitcoin.
>
> *None of these are comparable to Bitcoin or Namecoin.*
>
> - eGold: *Centralized currency* with no "reliable user identification"<https://en.wikipedia.org/wiki/E-gold#Aftermath> (not
> a problem with Bitcoin or Namecoin)
> - Liberty Reserve: *Centralized currency*
> https://en.wikipedia.org/wiki/Liberty_Reserve#Background
>
> People who are standing back and scratching their heads, wondering why
> Bitcoin is still around after years of being used to purchase illegal
> drugs, murder-for-hire, and weapons (continuing to this day btw), simply
> don't understand what Bitcoin is.
>
> *During twelve years as Principal Scientist at VeriSign Inc.,*
>
>
> Perhaps the paper is a bit harsh (and I welcome suggestions to improve its
> language), but the critiques it levies against companies that sell SSL
> certs are completely valid:
>
> Companies that sell SSL certificates usually claim that their certificates
> provide customers with “security.” Customers are led to believe that these
> certificates protect browser-server communication from eavesdropping and
> tampering. As elaborated in this paper, this simply isn’t true today.
>
>
> I have to say, that among the cert companies websites that I looked at,
> VeriSign's homepage makes the fewest claims about the security protections
> it provides.
>
> The words "usually claim" leaves room for exceptions. I could not find, on
> the customer-facing pages on VeriSign's site, any claims that VeriSign's
> SSL certs "protect browser-server communication from eavesdropping and
> tampering."
>
> Some close calls are:
>
> *In short, when it comes to securing online transactions, safeguarding
> customer information, and protecting business reputation, you're only as
> safe as the Certificate Authority you choose.*
> *Customers Gain Confidence with the Green Address Bar: Online shoppers
> recognize the green address bar as an easy and reliable way to verify the
> site identity and security.*
>
> VeriSign's SSL certificates do not provide websites with *meaningful
> protection* as defined in the DNSNMC paper because they cannot be
> securely authenticated in the face of a fraudulent certificate that's
> presented to customers by a MITM.
>
> If your certs can simply be replaced by any of the other CAs out there,
> then ****all** of the security they provide is thrown out the window.
>
> Furthermore, because VeriSign is a random third-party, not the company
> that user's visit when they visit a site using VeriSign's certificate, the
> protection offered by that certificate is inherently inferior to a securely
> authenticated self-signed certificate.
>
> When trust is distributed across more parties, that trust is diluted
> because it now depends on the least secure of those parties.
>
> *Sidenote:*
>
>> Given the success of the US government in shutting down eGold type
>> schemes I am very skeptical about the stability of 'namecoin'. If we accept
>> the purported scenarios that motivate the scheme then namecoin won't last
>> very long.
>>
>>

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 17:48:39 -0500

On Dec 16, 2013, at 5:37 PM, Phillip Hallam-Baker <[email-masked]> wrote:
> 
> Since the 600 number is inaccurate and not particularly necessary, why bother to quote it at all?

Dude, how did you manage to ignore that entire email?

>> 3. A link to a paper, a blog post, or an article somewhere that describes in detail your side of the argument

You cannot just say "the EFF is lying", throw your hands in the air, and leave it at that.

Unlike you, the EFF provided sources and proof for their claim.

The then wrote a widely cited blog post containing their claim and their evidence for it.

Where is your blog post? Where is your evidence that the EFF is lying?

These emails of yours don't cut it. Heck, I'd even post a link to an archived email of yours if you provided the necessary information in it.

- Greg

On Dec 16, 2013, at 5:37 PM, Phillip Hallam-Baker <[email-masked]> wrote:

> When you make an assertion in a paper then you are accepting the burden of proof. 
> 
> 
> If the source for the '600' claim was lying then the claim has to be taken off the table completely. The DFN root issue demonstrates that the methodology is bogus rather than just being a single inaccurate data point.
> 
> If you want to make assertions about the number of CAs then the most accurate measure currently available is still the number of roots in the commonly used browsers. While there are a handful of CAs using roots cross certified by another CA, such CAs now have to have a full audit statement and meet all the acceptance criteria in their own right. So there would be little point in not applying to have the root entered in independently.
> 
> Since the 600 number is inaccurate and not particularly necessary, why bother to quote it at all?
> 
> 
> 
>

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 17:54:01 -0500

Oh, sorry, I just saw (after sending that email), that I didn't answer your question.

Why bother quoting it at all? Because whether the number is 600+ or 300+, it still serves to support the point that browsers will take the word of any one of over a hundred potentially untrustworthy strangers as "proof" that a connection to a website is secure.

- Greg

---

From: Paul Lambert <[email-masked]>
Date: Mon, 16 Dec 2013 16:53:00 -0800

More of a marketing announcement than a technical proposal … perhaps I missed the URL, but is there any technical specification?
Seem like the charter of this group could provide a more generic worked out solution.

Paul

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 20:59:18 -0500

> More of a marketing announcement than a technical proposal … perhaps I missed the URL, but is there any technical specification?  

he basic idea is already be explained in the paper.

A detailed specification will be published to Github soon.

You're welcome to comment on what's already suggested in the paper (here or in the corresponding Namecoin thread).

Cheers,
Greg

---

From: Tao Effect <[email-masked]>
Date: Mon, 16 Dec 2013 21:00:19 -0500

> he basic idea is already be explained in the paper.

*The basic idea is already touched on in the paper.

---

From: Ralph Holz <[email-masked]>
Date: Tue, 17 Dec 2013 11:40:16 +0100

Hi,

> attacked the way diginotar was and though I believe their secuity is a
> lot better than their less fortunate Dutch cousins, a successful attack
> would be just as bad.

That is true for any CA, sub-* or not. The important point is where the
private key is kept.

In the case of the DFN, the 'many subCAs' are actually RAs without
signing capacity. I'd be much more worried about some resellers of the
very popular CAs. Anyone remember Comodo's InstantSSL reseller?

Ralph

-- 
Ralph Holz
I8 - Network Architectures and Services
Technische Universität München
http://www.net.in.tum.de/de/mitarbeiter/holz/
Phone +49.89.289.18043
PGP: A805 D19C E23E 6BBB E0C4  86DC 520E 0C83 69B0 03EF

---

From: Tao Effect <[email-masked]>
Date: Tue, 17 Dec 2013 15:35:13 -0500

The list moderator asked a few participants (including myself) to let this issue go, but I just want to mention that I've posted a minor update to the PDF, and have included a link to this thread in it, as well as a footnote next to the 600+ figure, mentioning that, "Phillip Hallam-Baker disputes the EFF’s figure on [therightkey] mailing list, but did not provided citable references for his claims."

URL remains the same, but it should say Version 1.1 in the lower-left of the cover page:

---

From: Jacob Appelbaum <[email-masked]>
Date: Mon, 23 Dec 2013 18:29:24 +0000

Phillip Hallam-Baker:
> Which kind of calls their credibility into question.

No, I don't think so, actually.

> HALF the 'CAs' in

Their count isn't off simply because you want to reduce a large number
of keys into a single entity.

> peddle an alternative PKI scheme calls into question their veracity.

I disagree strongly. I have an intermediate certificate. I am as
powerful CA as a result.

Please also see these estimates which are even higher:

https://zakird.com/slides/durumeric-https-imc13.pdf

"Identified 1,832 CA certificates  belonging to 683 organizations"
"311 (45%) of the organizations were provided certificates by
German National Research and Education Network (DFN) "

http://link.springer.com/chapter/10.1007%2F978-3-642-39884-1_28

"More than 1200 root and intermediate CAs can currently sign
certificates for any domain and be trusted by popular browsers."

> never get back. Too much trouble to get it right.

I've cc'ed Seth Schoen from the EFF - I'd be surprised if he had no
response.

> 1) Failing to examine the issue when the DFN root accounted for half of the

Other estimates appear to be much higher than the EFF count. What is
your qualification for what counts as a CA? For example - Debian
GNU/Linux ships with one set of ca-certificates, Chrome on Windows ships
with another, heck Microsoft even adds new CA certs dynamically, right?
So what is your metric exactly?

> 2) Continuing to count the DFN as 300 CAs when they know it is one.

The number matters because it isn't just an issue of control over a
single signing key. I'd be interested to hear how many of those
CAs/sub-CAs are able to sign leaf certificates.

All the best,
Jacob

---

From: Ralph Holz <[email-masked]>
Date: Fri, 27 Dec 2013 11:06:23 +0100

Hi,

[The EFF's count]

> German National Research and Education Network (DFN) "

I was there at IMC and spoke with Zakir. He was not aware of the fact
that the private keys to all the intermediate certificates are held by
the central DFN Verein, not the RAs themselves. In the case of DFN, the
intermediate certs only identify the RAs. The RAs do not carry signing
power.

It is the same at TUM, where I work, BTW.

Ralph

---

From: Rob Stradling <[email-masked]>
Date: Tue, 31 Dec 2013 14:31:43 +0000

<snip>
> I disagree strongly. I have an intermediate certificate. I am as

Jake, you're only that powerful if you control the intermediate private key.

<snip>
> So what is your metric exactly?

I would prefer to count the number of distinct organizations that 
control at least 1 private key that is associated with at least 1 
non-Name-Constrained root or intermediate certificate that chains to (or 
is) a root in the Microsoft, Mozilla and/or Apple root store and which 
can issue certs that are trusted for Server Authentication.

It's not possible to measure this purely by examining the body of 
root/intermediate certificates that are known to exist (although this 
body of certificates is of course useful for cross-referencing).

> CAs/sub-CAs are able to sign leaf certificates.

All of the DFN Sub-CAs are able to sign leaf certificates, but it is 
_only_ DFN that controls the private keys that would be used to sign 
these leaf certificates.  The various German universities are 
essentially only RAs, even though they are named as the Subjects of the 
intermediate certificates.

Many Sub-CA certificates issued by major commercial Root CAs exist 
purely for branding reasons.  i.e. the Subject is at most an RA, and 
sometimes only a Reseller.

On the other hand, if there are still any RAs/Resellers that control 
root or intermediate private keys, then by my metric they should be 
counted as CAs.

My gut feeling is that the real number (by my metric) is likely to be a 
lot nearer to 60 than to 600.