The POV I am really arguing against is the one that defines identity to be a key, that states that in communicating with a key you are by definition communicating with the person you have in mind. The man in the middle attack does not exist because from your point of view the entity at the other end of the communication channel is just the MITM plus the person you think you are talking to. This idea has been expressed many times by other people in this discussion, and it is this which I think is fundamentally flawed and even dangerous because it encourages the use of untested keys. In fact it seems to define away the question of whether a key is real or fake.

Hal

Suppose you have Alice, Bob, and Mallet. (Mallet is the convention for the MITM, right?) Suppose Alice and Bob are communicating privately. Suppose that Mallet is one of Bob's personalities, because he suffers from multiple personality disorder. How is this different from where Mallet is actually Bob's ISP? Even if Alice & Bob were talking in person, privately, Alice doesn't know that she is also talking to Mallet. My point is that given no other context, there is *no way* to know for certain that you are communication with the person you have in mind. Or suppose that Bob is a drug user doing a plea bargain. He agrees to have his communications monitored via MITM attack to get a lesser sentence. He buys drugs from Alice and Alice gets caught. The thing I am emphasizing here is the necessity to have some sort of -context- when addressing MITM. In a situation without context, MITM is not an issue. In a situation -with- context, MITM is an issue. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer@c2.org

sameer <sameer@c2.org> writes:

In the situation you cite, Bob doesn't know Alice apart from their email correspondence?

Right. My goal is to have a system in which two individuals who have never met can communicate securely. This is not too radical a notion, I trust. In fact, I would go so far as to say that to a considerable extent it is the whole point of public key cryptography.

In this case the ISP is acting as extension-of-alice. Bob thinks he is talking to Alice but he is talking to ISP+Alice. What difference does it make, if Bob has no knowledge of Alice outside their email discussion, that Bob is talking to ISP+ Alice rather than just alice. From Bob's perspective, Alice is really an alias for ISP+Alice. (The same goes for Alice in the other direction.)

What difference does it make? I'll tell you. It means that their conversation is not private! It means that their cryptography is useless, that it has failed. It means they have an unsecure channel. I don't know how I can put it more plainly than this. I wrote a long article a few days ago arguing that they almost might as well not use cryptography if they're going to adopt this stance. Let anyone eavesdrop, and from Bob's point of view when he thinks he is talking to Alice he is actually talking to eavesdroppers+Alice. From his point of view, Alice is just an alias for eavesdroppers+Alice. Etc., etc.

In tim's words, from alice's point of view "Bob the key" == "BOB the person and Bob's ISP". From Bob's point of view "Alice the key" == "Alice the person & Bob's ISP".

This is not a useful or appropriate way to think of the world, IMO. If you do this, then from your perspective people become bafflingly unreliable. I wrote all about this before.

The MITM attack only matters if there is a context outside the email correpondence. (Say, perhaps, a drug deal which involves real physical goods.)

Try to think of it not in relativistic or epistemological terms, but rather look at it in terms of reality. The real world exists, and in it exist real people. We can agree on this much, right? Two of these people want to communicate securely. That is not such a stretch of the imagination, is it? By "communicate securely" I mean they exchange information in such a way that other people don't receive it. Now surely it is clear that with this definition of the problem, approaches which redefine people to mean people+eavesdroppers are not responsive. Perhaps the motivation to do so is simply the belief that the problem is not solvable as stated. If so, I'd like to hear someone say this. Hal

Hal writes:

Try to think of it not in relativistic or epistemological terms, but rather look at it in terms of reality. The real world exists, and in it exist real people. We can agree on this much, right? Two of these people want to communicate securely. That is not such a stretch of the imagination, is it? By "communicate securely" I mean they exchange information in such a way that other people don't receive it.

Now surely it is clear that with this definition of the problem, approaches which redefine people to mean people+eavesdroppers are not responsive. Perhaps the motivation to do so is simply the belief that the problem is not solvable as stated. If so, I'd like to hear someone say this.

This whole issue is a philosophical one. The issue is the "ontology" of electronic relationships. The argument presented is analogous to the "Turing test" for artificial intelligence. The MITM is relevant only where two commuicating parties share no channels which the MITM doesn't control, otherwise they exchange one secret over such a channel and Mitch is hosed (with probability 1/2^h, where h is the entropy of the secret). Now, if Alice communicates with an entity she knows as "Bob", which in "reality" is Bob filtered by Mitch, I think we can readily agree that Alice probably cannot communicate securely with Bob. She *can*, however, communicate in perfect secrecy with "Bob" -- the amalgamation of Bob and Mitch. The ontological issue comes about when we ask who it is with whom Alice *wants* to communicate. I'd maintain that Bob has no ontological status with Alice. She knows nothing of Bob, only of "Bob". Therefore, she must be intending to communicate with "Bob", and her communication is secure. An entity cannot have a meaningful ontological status until some communication occurs. The status which results from the communication is "the entity, calling itself Bob, with whom I communicated over channel X". When a second communication occurs, we may have "the entity, calling itself Bob, with whom I communicated over channel Y". If the second communication contains an authenticating transaction, then we can note that the two entities are the same. This is what we really mean by authentication, anyway. As long as Mitch is successful in his MITM attack, then Bob is not an entity with respect to Alice. If Alice finds a key that purports to belong to Bob, about whom she previously knows nothing, what possible relevance can it have whether it really belongs to Bob or to "Bob" --- there is nothing in Alice's mind to distinguish the two. If Alice finds a key that purports to belong to Carol, about whom she knows something, then she must execute an authentication protocol with the new key to verify that the entity with whom it permits communication is actually Carol, and not "Carol". Identifying the key with the person is entirely reasonable, if the key is what introduced the person to you (and thus ontologically created the entity). If the introduction happens prior to receiving the key, then authentication becomes necessary to avoid MITM.

hfinney@shell.portal.com writes:

...

just alice. From Bob's perspective, Alice is really an alias for ISP+Alice. (The same goes for Alice in the other direction.)

What difference does it make? I'll tell you. It means that their conversation is not private! It means that their cryptography is useless, that it has failed.

But if by all means available Bob and Alice satisfy themselves that their conversation *is* secure, then (until they're proven wrong) it might as well be. They have satisfied themselves *at least* that their messages are in fact encrypted at some point, just as if they walked into a room, looked around, and satisfied themselves that there are no hidden microphones. I don't see how you can ever do any better than this if you're willing to imagine arbitrary powerful men-in-the-middle.

This is not a useful or appropriate way to think of the world, IMO. If you do this, then from your perspective people become bafflingly unreliable. I wrote all about this before.

Gee, in my reality people already *are* bafflingly unreliable. (You must not be watching enough afternoon trash talk shows.)

Try to think of it not in relativistic or epistemological terms, but rather look at it in terms of reality. The real world exists, and in it exist real people. We can agree on this much, right? Two of these people want to communicate securely. That is not such a stretch of the imagination, is it? By "communicate securely" I mean they exchange information in such a way that other people don't receive it.

What, however, is the real difference between the MITM scenario in a purely electronic relationship, and a "phony personality in the middle" attack on a "flesh" relationship? You *think* you're working with a realtor to buy a house, but in fact it's a con artist that betrays your trust and rips you off. You *think* you've found the love of your life, but in reality it's just somebody who wants to use you for sex. There are no guarantees. Let me ask this: how do you *guarantee* that you're having a truly private in-the-flesh correspondence with a person? And, having done that, how do you *guarantee* that the other person will behave in an absolutely trustworthy fashion?

Now surely it is clear that with this definition of the problem, approaches which redefine people to mean people+eavesdroppers are not responsive. Perhaps the motivation to do so is simply the belief that the problem is not solvable as stated. If so, I'd like to hear someone say this.

I certainly don't know how to solve it, but I wouldn't trust me if I were you :-) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5@tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mike McNally writes:

aba@atlas.ex.ac.uk writes:

...

Now the puzzling stuff is people who appear to be arguing that MITM is unimportant

Hal said this same thing in a recent note. For myself, I've never meant to argue that the MITM threat is unimportant. I've simply contended that you're no more vulnerable to it in the key-as-True-Name scenario than with a certificate-bound key-to-name relationship system. If you assume an MITM could thwart the establishment of trust in the first case, then I guess I posit that the same energies could with equivalent hope for success be directed in an attack on a more "traditional" certificate scheme.

I disagree. The MITM is foiled by one successful communication. The reason for certificates is to isolate and limit the number of authentication transactions which are not automated. When you get your key certified you go through some sort of very-hard-to- subvert process. The exact process is irrelevant, as it merely affects the trustworthiness of the certifier. Let's assume for the sake of argument that the key is certified by the same organization (DMV/MVA/DPS/whatever) that issues drivers licences, and on the same identification criteria. When you have your key certified, you also get a copy of the KCA's key. You now have enough information to authenticate to roughly the same level as presentation of a state issued ID card. After the first transaction, you can accept any key *signed* by the KCA under the same circumstances you'd accept the id card. But you can get KCA signed keys from almost *anywhere*, without the overhead associated with that level of authentication. The expensive authentication happens once, followed by a nearly unlimited number of cheap ones.

...

Perhaps the view is based on the fact that there are plenty of situations where you don't care what an entities name is, and hence the attribute which should be under discussion is credit worthiness, or reliability, but still you need to protect against MITM, using whatever channels and means available. I don't see how this alters the argument.

And this is where I start to think we're all in agreement even though there's an argument going on! Yes, I think you need to protect against MITM attacks by whatever means are available. I think that no matter what you do, if you're strictly relying on communications systems over which you ultimately have no control (if at some point somebody you simply have to trust on faith inevitably gets his hands on your bits), then you have to put up with a non-zero probability of being victimized by a MITM attack. If you're willing on blind faith to trust certificates granted by some authority, you're fooling yourself (I claim). If you only trust that authority because it fits into an established web, then I don't see why there's any need for a certificate binding a public key to some "True Name" constant; what's the point? (How do you know the alleged True Name has any meaning in the first place?)

I also posit that this is not really any different than the problems of social interaction homo sapiens have been dealing with ever since they grunted their way into cooperative tribal life.

I think we're still "arguing past each other." One side seems to argue "people have keys, and we need a way to authenticate them". The other seems to argue "there are situations where we don't care about the people behind the keys." Both are correct. As I said before, authentication is the correlation of entities with whom you've communicated over different channels. The notion that "people have keys" sort of implies that you know something about the "people". This really means you've communicated with them out-of-band --- even if you've just heard about them, it's a few bits of information. When you finally communicate in-band, you need an authentication protocol to correlate the entity on the other end of the current channel with the entity you have in mind.

Mike McNally writes

Scott Brickner writes:

...

I disagree. The MITM is foiled by one successful communication.

I'm going to need some clarification of this; what is meant by "successful"? If you mean "a communication without a MITM participating", and presuming also that that communication would involve a key validation, then I suppose it's true. However, I don't see how this success can be evaluated if the parties do not have nearly complete control over the communications substrate.

By "successful" I mean communicating without the MITM *interfering*. Either the parties need to exchange a symmetric key without the MITM eavesdropping, or exchange asymmetric keys without the MITM modifying them. The chance of failure is minimized by diversity in the channels used to try to bypass the MITM. The issue becomes one of risk management. If you can't afford a failure, you *do* need a channel over which you have nearly complete control. The simplest such channel is a physical meeting, during which you exchange public keys. If the MITM threat is from your ISP, you are likely to bypass his control with the telephone network. Any single success is adequate.

It occurs to me that perhaps I have been missing a point here when people argue that having a "man in the middle" is not that different from various forms of secure communication, such as where Bob has multiple personalities or is a committee. I have been taking this to mean that we should therefore not worry about MITM attacks, which seems crazy to me. Instead perhaps this was meant as a "reductio ad absurdum" argument for why MITM attacks cannot be prevented in the scenario where people have no out-of-band contact. Anything which could detect and prevent MITM attacks could, by this analogy, detect whether Bob had multiple personalities. Since the latter is obviously impossible, the former must be as well. Hence the problem has no solution and we should not waste much time on it. I don't fully agree with this but at least it is not as bizarre as the first interpretation. Hal

Hence the problem has no solution and we should not waste much time on it.

Exactly. If a public key ONLY has an existence in cyberspace (as per Pr0duct Cipher) then it is impossible to prove that they aren't surrounded by a MITM cloud which is also seeing everything they see without them knowing it. It is important to be aware of this. However the importance is perhaps mitigated by the following considerations: 1. Surrounding someone with such an MITM cloud is so hard as to be impossible for practical purposes. This will be more true if the person trying to establish a cyberspace identity can prove that they move around physically and use different service providers at different times [but then again perhaps if you do that you cease to be a purely cyberspace entity]. 2. If the other end of the communication is a purely cyberspace entity then you can't possibly establish the sort of relationship which would enduce you to send them anything really secret. The possibility that there might be a baddy playing MITM is infinitesimal compared to the probability that the other end is itself a baddy. The time you will want to deal with a cyberspace entity is where you are taking no risks and they are taking all the risks. This will hopefully be the case when we are a seller and they are the buyer. As long as we get the digital cash we don't care who they are. Apart from that we will always want some certificate that links the public key to something in the real world. The point of the key-centric approach is that that doesn't have to be a name or something that contains a name. If we want to make sure the key belongs to the person you were talking to last night then maybe you'd like some biometric data: "five foot two, eyes of blue,...". And of course the certificate is useless unless it is signed by a key that we trust for that purpose. Bob Smart P.S. I hope my earlier posting were not interpreted as being critical of the IPSEC effort. I strongly support it. It would be silly to go to them and say "hold everything I think we need a whole new security architecture". That is something for the future that we are only just starting to think about. However I think the IPSEC work confirms the difficulties of the current "name first then key" approach. Whenever it is incorporated in any protocol from network layer to application it makes the protocol at least twice as complex and at least twice as hard to manage.

"Never underestimate the effort your opponent will expend on cryptanalysis." -- Robert Morris, Sr., speaking at Crypto '95 If a MITM attack would be useful, then there will be times when one will be mounted. It might take 30 law enforcement officers to do it, but it has been demonstrated that the FBI will use that many people for a year or more on some cases. The CIA and NSA can be presumed to be willing to spend more time and effort to get certain results. Bob Smart wrote: | Exactly. If a public key ONLY has an existence in cyberspace (as per | Pr0duct Cipher) then it is impossible to prove that they aren't | surrounded by a MITM cloud which is also seeing everything they | see without them knowing it. | | It is important to be aware of this. However the importance is | perhaps mitigated by the following considerations: | | 1. Surrounding someone with such an MITM cloud is so hard as to | be impossible for practical purposes. This will be more true | if the person trying to establish a cyberspace identity can | prove that they move around physically and use different service | providers at different times [but then again perhaps if you -- "It is seldom that liberty of any kind is lost all at once." -Hume