Message-ID: <54D07ADF.8060809@voskuil.org>
Date: Mon, 02 Feb 2015 23:38:07 -0800
From: Eric Voskuil <eric@voskuil.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: Brian Erdelyi <brian.erdelyi@gmail.com>
References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com>
	<54CE3816.6020505@bitwatch.co>
	<68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com>
	<CALkkCJbk0czFj5mdMB6_0+Umw5V-fo-4tdBHgvg92zhyRZWiYQ@mail.gmail.com>
	<CANEZrP0QjPm+TTgV9Fh84vt2zLaGp0R2Wt2ZL2ZXYhxzOFPHVA@mail.gmail.com>
	<CALkkCJYuM_T=_nfBOCF4S8XhVecUZA0ug==Y_n+qdFpb-F628g@mail.gmail.com>
	<CANEZrP1QZqP6wSxcNJt81c4=xXLJsEsPF-CN71NZzwdOFSpB2A@mail.gmail.com>
	<57186618-F010-42E6-A757-B617C4001B5B@gmail.com>
	<F4C9E954-6A29-4A31-B09B-7F0B62270EF8@voskuil.org>
	<4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com>
In-Reply-To: <4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA"
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 02/02/2015 11:58 AM, Brian Erdelyi wrote:>
>>Confusing or not, the reliance on multiple signatures as offering
>>greater security than single relies on the independence of multiple
>secrets. If the secrets cannot be shown to retain independence in the
>>envisioned threat scenario (e.g. a user's compromised operating
>>system) then the benefit reduces to making the exploit more difficult
>>to write, which, once written, reduces to no benefit. Yet the user
>>still suffers the reduced utility arising from greater complexity,
>>while being led to believe in a false promise.
>
>Just trying to make sure I understand what you=E2=80=99re saying.  Are y=
ou
>eluding to that if two of the three private keys get compromised there
>is no gain in security?  Although the likelihood of this occurring is
>lower, it is possible.

No, that's not it. Sorry for not being clear. Independence of control is
the central issue in the analysis of a multiple factor system. If an
attack compromises one factor there must be no way for that attack to
reduce the difficulty of obtaining the other factors.

Some factors (secrets), like a fingerprint, aren't very secret at all.
But getting someone's fingerprint doesn't also help the attacker get a
PIN. That factor must be attacked independently. But if the PIN is
encrypted with the fingerprint in a public store, then the PIN is not
independent of the fingerprint and there is really only one secret.

If multiple factors are coincident (located within the same security
perimeter) they are compromized coincidentally. Coincidence has the same
effect as dependence. Consider a credit card with a "security code"
printed on the back. A successful attack on the leather wallet yields
both secrets.

Individual environments can be compromised with some difficulty (e.g.
desktop malware, fingerprint lift, dictionary attack, brute force PIN,
etc.). For the sake of simplicity, let that chance of successful
independent attack on any factor be 1 in 2 and the resulting probability
of successful concurrent attack on any n factors be 1 in 2^n. If m
factors are dependent/coincident on others the relation becomes 1 in
2^(n-m).

Any multi-factor web wallet that handles the user's keys in the browser
and authenticates the user in the browser to authorize service signing
is effectively single factor. One attack may be launched by an insider,
or externally, against the web app, executing in the browser, gaining
coincident access to two secrets. Browser/desktop malware can accomplish
the same. The difficulty is 1 in 2 vs. the expected 1 in 4.

>As more malware targets bitcoins I think the utility is evident.
>Given how final Bitcoin transactions are, I think it=E2=80=99s worth try=
ing to
>find methods to help verify those transactions (if a user deems it to
>be high-risk enough) before the transaction is completed.  The balance
>is trying to devise something that users do not find too burdensome.

I'm not questioning the motive, I agree it's worth trying. But trying is
not succeeding. Increasing user (and/or system) complexity without
increasing integrity or privacy is a poor trade, and worse if the user
is misled.

e


--OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJU0HrfAAoJEDzYwH8LXOFOm7wH/3Le7NkDCCuw740bIdxLQWjg
Vk1eMXJSFaChc1cfpwTNqFJwbU+um5ZZtB6JRQMtrQnP85lwQoy1SQxEsbq/QUj/
AGLFw4sdFlhCQRW6qr8TLdS0KnZoKYUCbFbJ/6Q4Q+6DWpXELm5mUpTYH2l5Dk4o
yVA3sMEZNU8vtTmghM/4c46zm1w3NvMM9XanVS9xFh9/BMkNCvhdq2dbtt/ioXEj
gPM7Jqtv1GPUFbkWiB+0yUmmUKhNlKjh3J9RcPzDa/UXjBJGMqNcEEhnBEjkDNfI
jh4MImTSkux5qrXZ35C8f+aCE0M12BXSXyfWOLlMofChUb2d4pX1Wy8pi30oY64=
=xRqh
-----END PGP SIGNATURE-----

--OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA--