Re: Family specifications (was: Re: perfect-privacy.com, Family specifications, etc)

[Scott Bennett <bennett@xxxxxxxxxx>]

     Oh.  My.  Goodness.  Gracious!  I go to sleep for a few hours, and the
discussion descends into total confusion because a number of participants,
including some tor developers, did not bother to read the proposal by Bruce
from perfect-privacy.com.  He did *not* propose, for example, any equivalent
to #include statements.  He did *not* propose, for example, any method of
allowing a node to specify other members of a Family.
     Let's see if we can get the discussion back on track.  Please read
below carefully.
     On Thu, 20 May 2010 10:44:44 -0400 Andrew Lewman <andrew@xxxxxxxxxxxxxx>
wrote:
>On Thursday May 20 2010 09:39:00 Flamsmark wrote:
>> On 20 May 2010 07:44, <andrew@xxxxxxxxxxxxxx> wrote:
>> > If Mallory lists Alice
>> > and Bob, but neither Alice nor Bob list Mallory, it's not a valid
>> > Family.  Otherwise, Mallory could list every node in the network and
>> > screw everyone.

     That was not Bruce's proposed method.  Please go back and read it
carefully.
>> 
>> Why would this screw everyone?
>
>If only one side could declare a valid family that clients honored, you can 
>control the paths clients choose. Eventually, some large percent of the 
>network will find your declaration and be unable to build paths because they 
>are all in the one-sided MyFamily declaration.  Or, worse off, you run three 
>nodes, let's call them TheMan0, TheMan1, and TheMan2.  All three nodes list 
>every other node in the network, except your three TheMan# nodes.  Now as 
>clients find your MyFamily declaration, they can only build paths through 
>TheMan0, TheMan1, and TheMan2.  Now you've won.

     Bruce's proposal prevents any such possibility because it does not allow
specification of any nodes by Nickname, key fingerprint, or any other method.
Rather, it allows a node to identify a Family by some Family name or other
label of which it itself is a member.
     Alice runs nodes A1, A2, and A3.  In the torrc file of each would be a
line like

MyFamily We'reOff

Bob runs nodes B1, B2, B3, and B4.  Each of his nodes' torrc files contains
a line like

MyFamily toSee

Carol runs nodes C1 and C2.  Both of these nodes' torrc files contain the
following line.

MyFamily theWizard

     Now, Dave has a client that downloads the descriptors for all of Alice's,
Bob's, and Carol's nodes.  Seeing the Family name each node says it belongs
to, the client groups Alice's nodes into one Family, Bob's nodes into another
Family, and Carol's nodes into a third Family.  Dave's client then chooses
routes for circuits that will use no more than one node from each Family, just
as clients do now.
     If Ed comes along and fires up a node E1 that says, "I'm in toSee Family",
then if Dave's client chooses E1 for a route, it will not choose any of Bob's
nodes for other positions in the same route.  Likewise, if Dave's client
chooses any of Bob's nodes for a circuit, Ed's E1 node will not be used for
other positions in the same circuit.  Ed, however, has no way to force Dave's
client to choose Ed's nodes for circuit routes.
>
>This is one reason why the MyFamily declaration has to be the same on both 
>sides in order for clients to honor it.  Tor clients do not trust the Tor 
>network by design.  There are flaws in the MyFamily scheme, as we're seeing 
>with perfect-privacy.  It's a pain in the ass if you run a lot of nodes, so 
>you just don't bother.  It also assumes an honest relay operator will list all 
>of all the nodes that should be in a MyFamily declaration.
>
     Again, that is completely inapplicable and irrelevant to Bruce's proposed
method.  To reiterate, his method enables each node to tell clients, "I'm in
Family xyz.  Don't use more than one of us in a circuit."  It does not allow
any node to specify other nodes.  A node simply specifies the name of a Family
to which it belongs.  Jeesh.  It's really not very difficult, and no, it is
not vulnerable to the sort of attack you, Roger, and Sebastian have now
misdirected the discussion.  Sigh.


                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:       bennett at cs.niu.edu                              *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/