Fixing trust on the Internet

Tom Marble <tmarble@info9.net>

Meta

This presentation is already online!

https://info9.net/trust

Software Freedom & Trust

Software Freedom is essential to trust the core infrastructure that supports our health, safety, and democracy.

"We need to have confidence in our software, be able to audit it and be able to repair it when we detect vulnerabilities or unwanted functionality like surveillance."

– Karen Sandler 1

Evolution of using software

When we gave each computer a name

$ tar zxf code.tar.gz && ./configure && make install

When we configured computers automatically

PXE boot, puppet, apt-get install my-favorite-package

When we moved to the cloud

Use this prebuilt image

When we started using containers

Make slight modifications to a prebuilt image

Now we are considering lambda functions

There isn't an OS image anymore: just a function

Most software is installed from the app store

Just accept the EULA and device permissions

Copyleft isn't enough

Network services software is not conveyed

Our FLOSS licenses (including copyleft licenses) depend on conveyance.

AGPL

AGPL "fixes" this network loophole, but hasn't been adopted for wide use in practice other than proprietary relicensing.

What about AI "algorithms"?

What is the preferred form of modification when software is derived from data (e.g. machine learning)?

No one picks a license anyway

We haven't taught developers to care 2

Most software is installed from the app store

We haven't taught end users to care

The fifth freedom

Freedom 4: The right to deploy your software on someone else's server

"Even if you had the source code today you don't know how to increase other people's freedoms by letting them modify your website at runtime. All you have is a bag of tricks that let's people modify your source code and gives them no way to deploy it on your infrastructure."

– r0ml's LCA keynote 3

Essential infrastructure requirements

Energy

  • We need energy for computing, yet energy is centralized.
  • Smart meters have an API for the utility, not for end users

Communications

  • Why isn't there a free phone? It's the proprietary baseband processor.
  • Potential in unlicensed spectrum, Software Defined Radio, Cognitive Radio

Money

  • Digital forms of money (often) have surveillance opportunities
  • Anonymous transactions (e.g. cash) are increasingly difficult








Peer to peer energy 4

p2p

Mobile apps

Dont-trust-your-apps.jpg 5

Where is trust now?

centralized.jpg 6

Shape of the solution (part 1/2)

Network service trust API

☙ Federated corroboration of assertions

Harder to corrupt

☙ Make and query assertions at the app level

libtrust.so, libtrust.js

☙ Transitive with personal vantage point

  • Deb asserts the software is Free and reproducible
  • Chris trusts Deb to certify software
  • I trust Chris' software certification assessments
  • ⇒ I am comfortable installing this software

☙ Quick transactions

You think you know what I'm going to say now…

13

tm13.png

12

tm12.png

11

tm11.png

10

tm10.png

9

tm09.png

8

tm08.png

7

tm07.png

6

tm06.png

5

tm05.png

4

tm04.png

3

tm03.png

2

tm02.png

1

tm01.png

GPG WoT

nah :(

The GPG Web of Trust asserts identity

  • The trustdb is private
  • Keyservers are not designed for other data

Using PGP is tricky for us

  • Choosing algos and signature strengths
  • Protecting key material
  • Not getting fooled by EVIL-32 7

Impossibly difficult for end users

  • Sharing public keys
  • Configuring applications properly

You think you know what I'm going to say NOW…

Bitcoin

bitcoin.svg

In Satoshi Nakamoto we trust! 8

Hyperledger

logo_hl_new.png

It's hosted by the Linux Foundation. That means it's community friendly… rite? 9

Ethereum

ethereum.png

Companies use it for smart contracts! 10

Zcash

zcash-logo-gold.png

Zooko and Matthew Green 11

DogeCoin

dogecoin.png

That's the MEME! 12

nah :(

Wait, why NOT blockchain tech?

centralized – in effect

Domination by huge mining pools

bandwidth limited

Time to process transactions long and variable

transaction fees

Start to look like PayPal fees

a waste of energy

Brute forcing hashes is bad 13 for the environment 14

Great barrier reef

not fake news reef-death.jpg 15

What we need is..

What's the essential thing the blockchain solves

non-repudiation

Learn by example

mall_logo1_medium-300x286.png

Certificate Transparency

Use append-only logs to record certificate signatures 18

  • Early detection of misissued certificates, malicious certificates, and rogue CAs.
  • Faster mitigation after suspect certificates or CAs are detected.
  • Better oversight of the entire TLS/SSL system.

Browser support

  • Chrome 19
  • Firefox 20

Ongoing concerns and discussion 21

  • RFC 6962 22

Append-only logs

Merkle Trees 23

Tree of hashes, provides log(n) performance

eXtended Merkle Signature Scheme (XMSS) 24

Requires maintaining state (not portable)

SPHINCS 25

Stateless 26

Generic use of append-only logs

Trillian 27

Merkle tree based

Cothority 28

Multi-party cryptographic signatures to avoid backdoors

Codehash 29

A simple oracle that answers a simple question: is this software safe to install and run? 30

Challenges

Toxic Data

  • Allow deletion? Possible vulnerabilities in allowing log altering
  • Prohibit deletion? Permanent toxicity: no way to be forgotten

Spam

  • Open log with arbitrary input data?
  • vs. CT only allowing root authorities?

Astroturfing

  • Can the network be overwhelmed?
  • vs. Is the personal vantage point immune?

Writing crypto safe code is difficult

Best Practices

Free Software with Complete and Corresponding Source

Code review

  • Avoid the OpenSSL problem

Reproducible builds

Automated, Continuous integration

  • static analysis (ASAN)
  • coverage
  • fuzzing
  • tests against threats

As a developer you do NOT want to be a target

  • want to do be right by your users
  • the checks & balances keep developers from being vulnerable

Shape of the solution (part 2/2)

Research similar work

  • append-only log alternatives
  • Application Transparency
  • Binary Transparency 31

Address the Challenges

Use Best Practices

Under the umbrella of a fiscal sponsorship organization

  • Governance review

Software Freedom Conservancy

Why you should support Conservancy:

🌲 supports diversity and is home to Outreachy 32

🌲 helps hackers: ContractPatch 33

🌲 is a 501(c)3 charity supported by individuals 34

Please join today!

https://sfconservancy.org/

disclaimer: I'm on the Conservancy Evaluation Committee

Possible first use case: Debian

Protect against compromised repositories

On package publication (by the Debian project)

  • put package signature into an append-only log

On package installation (by the user, via apt-get plugin)

  • verify package signatures with the log
  • publish suspicious checksum to an auditor
  • option to not install mismatched packages

Why talk trust at LibrePlanet?

Because of the people in this room!

  • We understand the tech
  • We understand why trust matters to end users
  • We are the peer reviewers

Need to reach more than just developers…

  • User experience experts
  • Lawyers: How to reprise the "hack on copyright" to protect network services
  • Activists: Help end users understand and care!

Q/A & Where we go from here

Call to action: Join the [trust-api] mailing list

http://lists.info9.net/mailman/listinfo/trust-api

Cuddles asks a question??? 35

Cuddles

References

Footnote references (press 's' for scrollbars)

  1. https://sfconservancy.org/blog/2016/dec/29/software-freedom-after-trump/
  2. See 48:35 in r0ml's talk on how the minority of GitHub projects actually have a license: https://www.youtube.com/watch?v=i3nJR7PNgI4&feature=youtu.be&t=2915
  3. https://www.youtube.com/watch?v=i3nJR7PNgI4
  4. https://www.nytimes.com/2017/03/13/business/energy-environment/brooklyn-solar-grid-energy-trading.html
  5. http://www.usatoday.com/story/tech/news/2017/03/06/mapping-software-routing-waze-google-traffic-calming-algorithmsi/98588980/
  6. https://archive.fosdem.org/2014/schedule/event/network_freedom/
  7. https://evil32.com/
  8. https://bitcoin.org/en/
  9. https://www.hyperledger.org/
  10. https://www.ethereum.org/
  11. https://z.cash/
  12. http://dogecoin.com/
  13. http://www.abc.net.au/news/2015-10-06/quiggin-bitcoins-are-a-waste-of-energy/6827940
  14. https://www.bitcoinmining.com/is-bitcoin-mining-waste-electricity/
  15. http://www.news.com.au/technology/environment/natural-wonders/before-and-after-great-barrier-reef-photos-expose-shocking-realities-of-coral-bleaching/news-story/527d7599f160532474b27f1ca26fdbfc
  16. Security Now, Epsiode #599 https://www.grc.com/securitynow.htm
  17. https://jhalderm.com/pub/papers/interception-ndss17.pdf
  18. https://www.certificate-transparency.org/
  19. https://www.thesslstore.com/blog/google-chrome-certificate-transparency-2017/
  20. https://www.thesslstore.com/blog/firefox-certificate-transparency/
  21. https://www.ietf.org/mailman/listinfo/trans
  22. https://datatracker.ietf.org/doc/rfc6962/
  23. https://en.wikipedia.org/wiki/Merkle_tree
  24. https://eprint.iacr.org/2011/484.pdf
  25. https://sphincs.cr.yp.to/
  26. https://cryptoservices.github.io/quantum/2015/12/08/XMSS-and-SPHINCS.html
  27. https://github.com/google/trillian
  28. https://boingboing.net/2016/03/10/using-distributed-code-signatu.html
  29. https://github.com/rootkovska/codehash.db
  30. https://secure-os.org/pipermail/desktops/2016-November/000143.html
  31. https://github.com/FreeBSDFoundation/binary-transparency-notes
  32. https://www.gnome.org/outreachy/
  33. https://sfconservancy.org/blog/?tag=ContractPatch
  34. https://sfconservancy.org/supporter/
  35. cuddles: Copyright © 2017 Tom Marble, CC-by-sa 4.0

/

← →