Extended Cryptographic Canaries #10

New Issue

phryk · 2022-05-04T00:11:51Z

phryk commented

2022-05-04 00:11:51 +00:00

We want granular cryptographic assurances, with layered signatures
so one person can issue an assurance and others can publicly verify
its veracity.

A good bit of time was already wasted on this in deadhand as GnuPG is awful.
Wait for sequoia-sop python bindings to be completed, fix up deadhand and
implement a script for sending assurances and their verifications as well as
integrating display of those into xmpp-site.

We will want separate canaries to assure:

System not being compromised
Not having received a warrant/request for info by $state_agency
- possibly with one canary per major agency
- possibly by timeframe (i.e. not received a warrant from 2023-05-05 - 2032-13-12)
Not having complied with a warrant/request for info
- 1:1 mapping for receival concerning agencies and timeframes.
Not being under pressure/duress/targetted surveillance

We will also need (internal?) policies or guidelines on what to do
when an expected assurance or verification isn't coming in.

We want granular cryptographic assurances, with layered signatures so one person can issue an assurance and others can publicly verify its veracity. A good bit of time was already wasted on this in [deadhand] as GnuPG is awful. Wait for [sequoia-sop] python bindings to be completed, fix up [deadhand] and implement a script for sending assurances and their verifications as well as integrating display of those into [xmpp-site]. [deadhand]: https://rnd.phryk.net/phryk-evil-mad-sciences-llc/deadhand [sequoia-sop]: https://gitlab.com/sequoia-pgp/sequoia-sop [xmpp-site]: https://rnd.phryk.net/phryk-evil-mad-sciences-llc/xmpp-site We will want separate canaries to assure: * System not being compromised * Not having received a warrant/request for info by $state_agency * possibly with one canary per major agency * possibly by timeframe (i.e. not received a warrant from 2023-05-05 - 2032-13-12) * Not having *complied* with a warrant/request for info * 1:1 mapping for *receival* concerning agencies and timeframes. * Not being under pressure/duress/targetted surveillance We will also need (internal?) policies or guidelines on what to do when an expected assurance or verification isn't coming in.

phryk added the

enhancement

security

labels 2022-05-04 00:11:52 +00:00

Sign in to join this conversation.