Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are we self-sovereign PKI yet?

buffrr.dev

Post reply on HN
Print view View original

81–90 of 92 posts

Re: Are we self-sovereign PKI yet?

#81

Post by akerl_ »

lrvick wrote: post #76
akerl_ wrote: post #74

Earlier quoted context omitted.

There's like, a whole section on https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#th... that's specifically recommendations. The only ones that are "corporate" are chat (where PGP's UX and security model are absolutely horrendous in ways that both prevent mass adoption and make it comically easy to screw up, and where most of those problems are nearly impossible to resolve in a federated system) and I guess…

Ah yes. That post. People send it to me all the time. It is my favorite. It proposes that dissidents and security researchers from all countries from a wide range of backgrounds and beliefs on privacy, should all just accept the terms of service of their pick of two US based surveillance capitalism mega-corporations, trust they do not have any insiders or vulns, then reveal their identity to cell carriers in most cou…

Holy moving goalposts, Batman.

Re: Are we self-sovereign PKI yet?

#82

Post by lrvick »

akerl_ wrote: post #80
lrvick wrote: post #78

Earlier quoted context omitted.

So you are saying that the solution is that we go to the majority of active and reputable PGP keyholders, Linux maintainers, and tell them to stop signing the binaries that run the internet, and just yolo, because that worked so well for NPM? I really hope I am misunderstanding you.

Yes, you’re misunderstanding me. I’m saying several things, but since you’re really focused on Linux package signing, I’m saying about that: PGP is a bunch of theatre there and distros should use minisign instead. Linux package signing is a great example of where PGP is goofy. Users of Linux distros get their root of trust by downloading a keyring from the exact same place they download the distro ISO. To a rounding…

> PGP is a bunch of theatre there and distros should use minisign instead.

Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot sign commits or code reviews with minisign because non standard, so i guess use ssh keys for those, and then maintain multiple keychains for each person.

Minisign is strictly worse in every way. Your camp will never convince Linux maintainers to switch with this pitch.

Many of us actually do verify the web of trust, extensively. I have many Linux maintainers in my own keychain independent from their usage in linux distros. Minisign has no such key distribution and accountability system.

Re: Are we self-sovereign PKI yet?

#83

Post by akerl_ »

lrvick wrote: post #82
akerl_ wrote: post #80

Earlier quoted context omitted.

Yes, you’re misunderstanding me. I’m saying several things, but since you’re really focused on Linux package signing, I’m saying about that: PGP is a bunch of theatre there and distros should use minisign instead. Linux package signing is a great example of where PGP is goofy. Users of Linux distros get their root of trust by downloading a keyring from the exact same place they download the distro ISO. To a rounding…

> PGP is a bunch of theatre there and distros should use minisign instead. Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot s…

> Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot sign commits or code reviews with minisign because non standard, so i guess use ssh keys for those, and then maintain multiple keychains for each person.

Yes, all of that.

Re: Are we self-sovereign PKI yet?

#84

Post by lrvick »

akerl_ wrote: post #83
lrvick wrote: post #82

Earlier quoted context omitted.

> PGP is a bunch of theatre there and distros should use minisign instead. Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot s…

> Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot sign commits or code reviews with minisign because non standard, so i gues…

At this point I can only conclude you are a troll, but if you are actually serious, I challenge you to prove it. I put in the work in the community for my side of this debate.

I would suggest you pick one of the mainline Linux distros that relies on PGP and make a detailed RFC with a plan to downgrade their security to your non standard minisign/ssh solution with private keys exposed in system memory as you propose, and make a convincing case why it is worth it and what advantages they get for doing so.

Let me know if you do. I am sure it will be a great case study.

Re: Are we self-sovereign PKI yet?

#85

Post by akerl_ »

lrvick wrote: post #84
akerl_ wrote: post #83

Earlier quoted context omitted.

> Okay so drop the IETF standard, web of trust, smartcard support, and external key discovery mechanisms to prove the whole keychain was not swapped out with a fake one, and just have everyone generate minisign keys exposed to system memory with no trust link backwards, and then sign things with probably the same algorithms. But then we cannot sign commits or code reviews with minisign because non standard, so i gues…

At this point I can only conclude you are a troll, but if you are actually serious, I challenge you to prove it. I put in the work in the community for my side of this debate. I would suggest you pick one of the mainline Linux distros that relies on PGP and make a detailed RFC with a plan to downgrade their security to your non standard minisign/ssh solution with private keys exposed in system memory as you propose,…

Thankfully OpenBSD did my work for me:

https://www.openbsd.org/papers/bsdcan-signify.html

Re: Are we self-sovereign PKI yet?

#86

Post by lrvick »

akerl_ wrote: post #85
lrvick wrote: post #84

Earlier quoted context omitted.

At this point I can only conclude you are a troll, but if you are actually serious, I challenge you to prove it. I put in the work in the community for my side of this debate. I would suggest you pick one of the mainline Linux distros that relies on PGP and make a detailed RFC with a plan to downgrade their security to your non standard minisign/ssh solution with private keys exposed in system memory as you propose,…

Thankfully OpenBSD did my work for me: https://www.openbsd.org/papers/bsdcan-signify.html

So 0.1% of the internet is protected by Ed25519 signatures because of this move. Meanwhile PGP has had Ed25519 support for years, with hardware security key support.

OpenBSD does fantastic work, but you and I both know it will never have any significant adoption on the web at this point.

Try to convince an actual Linux distro running any significant portion of the web they should stop using Ed25519 via PGP smartcards and use Ed25519 via signify exposing their keys to system memory (and thus malware) instead, with no key discovery protocol, for unspecified reasons.

Would love to see a threat modeling case for that.

At this point you have shown your hand. You hate PGP so much you would make security for everyone worse to get rid of it. There is no reasonable threat model to support your position.

Re: Are we self-sovereign PKI yet?

#87

Post by deepsun »

irq-1 wrote: post #6

> The same key, in every app, for every recipient. Not assignable to anyone else, not revocable, not subject to suspension. Yours forever. This is impractical and the opposite of what we want. It's a required ID to use the internet, monitored by governments, tracked by corporations, and forever unchanging. What we need is a system that allows people to easily create new IDs, that updates contacts that people choose.…

> Not assignable to anyone else

I can foresee there will be valid use cases to re-assign a number (e.g. stolen, mistyped, wrongly assigned etc). One thing I learned about a real-world database for human information -- there will be a valid use case to do _anything_.

Re: Are we self-sovereign PKI yet?

#88

Post by buffrr »

lxgr wrote: post #2

Great concise description of the problem. As for the solution, it seems to explicitly not address recovery of lost keys/identities, which is however exactly the part that makes this hard for regular users. That, and general name confusion attacks, I suppose: "I'm lxgr17@key, yeah, don't ask about the first 16. Oh also make sure 'key' is not the one with the Georgian lowercase e in the middle, that one's an impostor.…

> not address recovery of lost keys/identities

Key loss is hard but not insurmountable. Social recovery / split-key custody seem like the right direction. Apple uses "recovery contacts" if you have advanced data protection enabled. A friend holds one share, Apple holds another but neither can recover alone. that's social recovery + split-key shipping to hundreds of millions of devices today

> That, and general name confusion attacks, I suppose: "I'm lxgr17@key...

pre-registering the obvious typo neighbors (lxrg, 1xgr ... etc) and it's cheap since handles batch-issue off-chain under a fixed 32-byte root, and strict ascii only charset ... etc could help mitigate some of this.

Re: Are we self-sovereign PKI yet?

#89

Post by buffrr »

merelydev wrote: post #59
tptacek wrote: post #33

Earlier quoted context omitted.

It's not "hard" for regular users; it's a complete non-starter for regular users. Every "non-custodial" or "self-sovereign" system of trusted identities founders on this issue: account recovery is the hardest problem in identity, and if you don't have a solution for it, your system is going to be a niche at best. People have been coming up with these schemes for decades, and for that entire time, the near-universal d…

Yes, the UI/UX of decentralized systems is so difficult for users that it creates demand for centralized systems to manage it for them, Coinbase, Gmail, Github, Twitter, The Pirate Bay.

there's nothing wrong with a keychain or password manager holding your keys. passkeys already work exactly this way, completely transparent to the user. it's fine for most users.

Re: Are we self-sovereign PKI yet?

#90

Post by buffrr »

NoahZuniga wrote: post #9

The entire premise of this article is wrong! > Signal ships safety numbers because the platform might one day be compelled or compromised, and the architecture is meant to let you catch that. But almost nobody verifies We have a solution to this! Wa and Signal both have key transparency. This uses cryptography to make it possible to verify that everyone is getting the same data[1]. Now your phone can check the keys l…

I have addressed key transparency in the post :) Key transparency does help with detection (still requires trusting third parties or having to check yourself) but the proposed protocol makes it not possible to forge the mapping to begin with.

> This is better! Because essentially no clients (phones) have a local copy of the bitcoin chain, so you still have to trust a server to tell you what was posted in the bitcoin block.

Not quite :) also addressed in the post. look at the end of "The CA of all CAs " section.

Post reply on HN