Tails

#5 Updated by jvoisin 2015-10-01 03:23:17

Yup, no problem.

#7 Updated by intrigeri 2016-02-09 11:48:05

Proposed a date.

#10 Updated by jvoisin 2016-12-20 23:33:06

I think that the scheme is currently being deployed, can someone please link the process on the ticket, and then close it?

#11 Updated by intrigeri 2016-12-21 08:17:09

> I think that the scheme is currently being deployed,

Only the revocation scheme is being deployed (#7700 which is private).
But our plan for dealing with such events has more to it :)

#13 Updated by cypherpunks 2017-01-08 08:05:13

intrigeri wrote:
> > I think that the scheme is currently being deployed,
>
> Only the revocation scheme is being deployed (#7700 which is private).
> But our plan for dealing with such events has more to it :)
For what reason is it private? The lack of transparency is disturbing, for a few reasons:

• Shannon’s maxim: The enemy knows the system. If an adversary will be able to defeat a cryptographic key revocation scheme just by knowing how it works, the scheme is fundamentally broken. Unless I’m fundamentally misunderstanding why #7700 was made private, then the reason was that it was perceived that access to that information would break or weaken the scheme.
• Kerckhoffs’ principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. Tails in general, and any relevant cryptosystems in particular, should operate under complete transparency, with everything in the system available to the public except the private keys.
• Linus’ law: Given enough eyeballs, all bugs are shallow. Giving only a few people access to the scheme prevents people from suggesting improvements or providing feedback. If only a few people have access, then the more resourced adversaries will be at an advantage.

If I have not misunderstood the reasons behind making #7700 private, then please reconsider its private status. The only things which should ever be secret information in a scheme like this are the secret key material.

I would also like to note that marking a ticket as private directly contradicts the social contract draft, which explicitly states:

> Our entire bug report database is and will stay open for public view at all times. Reports that are filed here will promptly become visible to others.

Does this not apply to reports that are filed by devs who wish the reports not to be public? Additionally:

> As Tails is created in a transparent manner, anyone is encouraged to participate, review it and point out problems.

I am unable to participate, review, or point out problems. How many other tickets related to the security of the Tails ecosystem am I not able to engage in? Either the draft needs revision, or the policy of secrecy does.

I’m uncomfortable using Tails, and giving Tails to my family, when neither I nor others in the security community are allowed to review the revocation scheme being deployed. Until the scheme is solid enough that Tails developers feel comfortable with it being public, I can’t help but think of it as snake oil at best, and providing a false sense of security at worst.

Please reconsider this policy which neglects so many desiderata of cryptography.

#14 Updated by intrigeri 2017-01-08 09:15:42

> For what reason is it private?

That other ticket is private because some input fed into the revocation certificate distribution mechanism must be secret. But the design has been published a while ago: https://tails.boum.org/doc/about/openpgp_keys/signing_key_revocation/.

I think that most of what you wrote after this line was based on the incorrect assumption that the design of that mechanism was kept private, and is thus irrelevant once this has been clarified (and actually I agree with most of what you wrote, thanks for caring about this important topic :)

If you still feel the need to discuss this secrecy topic any further, please do that on a new, dedicated ticket, or even better, on the tails-dev mailing list: discussing topics on unrelated tickets is also a problem wrt. welcoming participation, 3rd-party review, etc., in a similar way to how secrecy is problematic: it adds barriers for potential contributors to find and participate in discussions they are interested in. Thanks!

> I would also like to note that marking a ticket as private directly contradicts the social contract draft, which explicitly states:

>> Our entire bug report database is and will stay open for public view at all times. Reports that are filed here will promptly become visible to others.

Then that might be a bug in the social contract. I’ll try to keep this in mind when I review that document, although you can answer the call for feedback yourself on the tails-project@boum.org mailing list to ensure this is taken into account :)

#15 Updated by sajolida 2017-01-10 17:47:43

And your feedback is welcome on Feature #10022 if you are an expert and want to review the scheme.

#18 Updated by intrigeri 2019-03-07 15:31:25

Happy to work on this again once Feature #15097 is done, if it shows that this is one of the areas where we should focus first.