Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (1.0)
From: Eric Voskuil <eric@voskuil.org>
In-Reply-To: <57750EAB.3020105@jonasschnelli.ch>
Date: Thu, 30 Jun 2016 14:27:30 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <426C2AA3-BFB8-4C41-B4DF-4D6CC11988B2@voskuil.org>
References: <87h9cecad5.fsf@rustcorp.com.au>
	<1E86A00F-0609-4DBC-9543-94AE04CC13C9@voskuil.org>
	<577234A4.3030808@jonasschnelli.ch>
	<360EF9B8-A174-41CA-AFDD-2BC2C0B4DECB@voskuil.org>
	<20160629111728.GO13338@dosf1.alfie.wtf>
	<2981A919-4550-4807-8ED9-F8C51B2DC061@voskuil.org>
	<57750EAB.3020105@jonasschnelli.ch>
To: Jonas Schnelli <dev@jonasschnelli.ch>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] BIP 151
Precedence: list


> On Jun 30, 2016, at 2:20 PM, Jonas Schnelli <dev@jonasschnelli.ch> wrote:
>=20
>=20
>> Yes, this is exactly what I meant. The complexity of the proposed constru=
ction is comparable to that of Bitcoin itself. This is not itself prohibitiv=
e, but it is clearly worthy of consideration.
>>=20
>> A question we should ask is whether decentralized anonymous credentials i=
s applicable to the authentication problem posed by BIP151. I propose that i=
t is not.
>>=20
>> The core problem posed by BIP151 is a MITM attack. The implied solution (=
BIP151 + authentication) requires that a peer trusts that another is not an a=
ttacker.
>=20
> BIP151 would increase the risks for MITM attackers.
> What are the benefits for Mallory of he can't be sure Alice and Bob may
> know that he is intercepting the channel?

It is not clear to me why you believe an attack on privacy by an anonymous p=
eer is detectable.

> MITM is possible today, it would still be possible (though under higher
> costs) with BIP151.
>=20
> With BIP151 we would have the basic tool-set to effectively reduce the
> risks of being MITMled.
>=20
> IMO we should focus on the risks and benefits of BIP151 and not drag
> this discussion into the realm of authentication. This can and should be
> done once we have proposals for authentication (and I'm sure this will
> be a heated debate).
>=20
> The only valid risk I have on my list from you, Eric, is the false sense
> of security.
>=20
> My countermeasure for that would be...
> - deploy BIP151 together with the simplest form of authentication
> (know_hosts / authorized_keys file, no TOFU only editable "by hand")
> - make it more clear (in the BIP151 MOTIVATION text) that it won't solve
> the privacy/MITM problem without additional authentication.
>=20
> Or could you elaborate again =E2=80=93 without stepping into the realm of
> authentication/MITM (which is not part of the BIP or possible already
> today) =E2=80=93 why BIP151 would make things worse?
>=20
> </jonas>
>=20