<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div apple-content-edited="true"><div>On Sep 27, 2014, at 11:52 AM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Sat, Sep 27, 2014 at 11:07 AM, Bear <span dir="ltr"><<a href="mailto:bear@sonic.net" target="_blank">bear@sonic.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">Once Mallory has published his "alice" key, he has absolutely no way to get Alice to use it.<br></blockquote><div><br></div><div>This is a *naming* system. Other people are trying to map a name to a key, not the other way around. Mallory is trying to trick other people who are trying to talk to alice into using the wrong key, while making it appear to Alice that the correct key is published.</div></div><div><br></div><div>Meanwhile a MitM can show Alice a forked block chain where her key appears legitimate, and in the process poison any new entries which are added to the block chain with MitMed keys.</div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div><br></div><div>There is only a tiny window where this could happen, making it unlikely to happen in the first place.</div><div><br></div><div>That window is before Alice has registered her name in the blockchain.</div><div><br></div><div>The attacker would have to somehow anticipate the instant when Alice goes to register her name or domain name in the blockchain and replace it with a fake one, while showing Alice the one Mallory created in the fake fork, and then doing that for perpetuity, following Alice as she goes from Wifi to Wifi, and still Alice will likely detect the attack as per the previous discussion.</div><div><br></div><div>Completely. Different.</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div><div><br></div></div></div></div><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></body></html>