<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On Sep 27, 2014, at 9:20 AM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:</div><div><br></div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_extra">1) Alice wants to register the name "alice" with a NameCoin like system. Mallory wants to MitM her</div><div class="gmail_extra">2) Alice claims the name. Mallory intercepts her claim and produces a forked, poison block chain that contains the name "alice" with her key. Mallory registers the name "alice" with a poison key, and puts that in the "real" block chain</div><div class="gmail_extra">3) Bob tries to communicate with "alice" and looks up the poison data Mallory left in the block chain</div><div><br></div><div>A similar attack that would require a similar level of attacker capabilities.</div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div><br></div><div>This attack is not similar for the following reasons:</div><div><br></div><div>- Here, the attacker would need to continue to MITM the connection between Alice and Bob indefinitely, and that would incidentally require mining blocks for the *sole purpose* of MITMing Alice.</div><div>- This attack is trivially detectable by Alice. The second Alice checks a node/service that is not being MITM'd by the attacker (like blockchain.info), or speaks with Bob over some other channel, Alice would know she was being attacked.</div><div><br></div><div>In CT:</div><div><br></div><div>- The attack is not trivially detected once it is over.</div><div>- It does not require any extra efforts (like mining) other than issuing a fraudulent cert and using it to MITM.</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div></div></div></div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></body></html>