🚀 go-pugleaf

In article <HUGHES.92Sep25140100@soda.berkeley.edu> hughes@soda.berkeley.edu (Eric Hughes) writes:
>In article <1992Sep25.074808.17798@cactus.org> ritter@cactus.org
>(Terry Ritter) writes:
>
>> If you try to validate your keys by email, you will be foiled if:
>> a) your home node is subverted, OR  b) all nodes your node uses
>> for email delivery are subverted.  And you cannot tell whether
>> (a) or (b) are true either.
>
>Forgive me for just not knowing what you are referring to.  What do
>you mean by subversion here, Terry?  Do you mean any of the following?
>
>1. All communication channels are monitored and filtered.
>2. Your private keys are known to the adversary.
>3. All public keys have be spoofed by an interposer, both yours and other's.

I doubt that he means 2.  1. and 3. are pretty strongly implied.

Let's look at PK encryption for a minute:

There are 2 keys.  The private, and the public.

The "subversion" methods are different for the two;

If someone knows the private key that shouldn't, then the system can't
be trusted.  Correspondingly, if you can't trust that I can keep my
private key private, then you can't trust my signatures.  Trust IS
necessary, at some level.

If someone gets a hold of my private key, then my system is rather
compromised.  Of course, they have to be a LITTLE careful as to how
they use that private key.  They COULD forge messages from me; but
I'd probably eventually figure that out. 

The BEST use of a stolen private key is to merely READ the mail;
leaving me and everyone else convinced that the key is still private.

The situation with the public key is quite different;

Spoofing at that level will involve subverting the communications
channels COMPLETELY.  The spoofer would have to substitute his
communications for mine.

In effect, if I'm TRYING to talk to you, then the spoofer would have
to spoof BOTH of us.  He'd have to intercept ALL mail between you and
I; unpack it, repack it using the two "fake" keys, and he'd have to
make sure that there was NO way that I could check the key some other
way, such as by getting a copy of your public key, encrypted by
someone else that might NOT be spoofed.

And our "friend" Spoofie would have to be able to ensure that I have
no alternative method of checking your key; he'd have to subvert the
network SO well that if I fingered you, Spoofie's software would
translate the key in your .plan file into Spoofie's "fake" key.  And
if we happened to do a "chat", Spoofie would have to be able to
subvert the chat, with any possible encryption method that might get
put on the key there.  (I could always run "crypt" on the key, and
send it over, with some password that you and I agreed on "on the
fly."  Spoofie would have to subvert THAT in real time.)

None of these methods of avoiding spoofing are PERFECT; but I suspect
that they can make it arbitrarily difficult to spoof communications.

Unfortunately, if you can't trust me to keep my private key private,
then there's still no privacy...
-- 
Christopher Browne
cbbrowne@csi.uottawa.ca
University of Ottawa
Master of System Science Program