1. This thread pertains specifically to the use of P2P/DHT models
2. to replace traditional email as we know it today. There was
3. a former similarly named thread on this that diverged... from the
4. concept and challenge of P2P/DHT handling the transport and
5. lookups... back to more traditional models. This thread does not
6. care about those antique models, please do not take it there.
7.  
8. In short, we're attempting to examine and develop some form
9. of new transport that looks somewhat like a mix between secure
10. anonymous networks, string@pubkey node addressing, massive
11. decentralized dht-like scaling and finally a user facing daemon that
12. moves messages into and out of local spools for use by normal
13. user/system tools.
14.  
15. Pasting in a very rough and unflowing thread summary to date
16. for interested people to pick up and discuss, draft, etc.
17.  
18. =====
19. grarpamp...
20. > [pgp/smime email encryption, etc]
21. > What is the gap we have to close to turn this on by default?
22.  
23. How many times has this been rehashed the last six months?
24. You can't fix email as we know it today using todays bolt-ons,
25. protocols and corporate stakeholders/services trying to profit from it.
26. The only way to have any real global seamless success is to go
27. ground up with a completely new model. IMO, that will be some
28. form of p2p message system where every address is a crypto key,
29. masked for grandma by her contact list, decrypted out your p2p
30. daemon and piped into your local mail processing (MUA/filter/lists)
31. and filesystem (encryption). At least that way your local mail tools
32. will still work (no one will give those up anyway).
33.  
34. The problem is the antique centralized backend, it needs bypassed.
35. You've got neat stuff like Tor, bittorrent, bitcoin, etc already... so
36. boost email into the 2020's the same way. Then let the old world
37. email services try to keep up, and slowly die like everything else.
38. =====
39. grarpamp...
40. On Mon, Nov 25, 2013 at 1:01 AM, ianG <iang@iang.org> wrote:
41. > On 23/11/13 15:30 PM, Ralf Senderek wrote:
42. >> On Sat, 23 Nov 2013, David Mercer wrote:
43. >>
44. >>> But of course you're right about actual current usage, encrypted email
45. >>> is an
46. >>> epic fail on that measure regardless of format/protocol.
47. >>
48. >> Yes, but it's about time we do something about that. Do we *exactly know
49. >> why* it is such a failure?
50. >
51. > It's an interesting question, and one worth studying for pedagogical
52. > motives.  From my experiences from both sides, it is clear that both sides
53. > failed.  But for different reasons.
54. > Hence, I've concluded that email is unsecurable.
55.  
56. Obviously. It will never be able to escape the non-body
57. header content and third party routing, storage and analysis with
58. any form of patching over today's mail. And it's completely
59. ridiculous that people continue to invest [aka: waste] effort in
60. 'securing' it. The best you'll ever get clients down to is exposing
61. a single 'To:' header within an antique transport model that
62. forces you to authenticate to it in order to despam, bill, censor
63. and control you.
64.  
65. That system is cooked, done and properly fucked. Abandon it.
66. What the world needs now is a real peer to peer messaging
67. system that scales. Take Tor for a partial example... so long
68. as all the sender/recipient nodes [onions] are up, any message
69. you send will get through, encrypted, in real time. If a recipient
70. is not up, you queue it locally till they are... no third party ever
71. needed, and you get lossless delivery and confirmation for free.
72. Unmemorable node address?, quit crying and make use of your
73. local address book. Doesn't have plugins for current clients?,
74. so what, write some and use it if you're dumb enough to mix
75. the old and new mail.
76.  
77. The only real problem that still needs solved is scalability...
78. what p2p node lookup systems are out there that will handle
79. a messaging world's population worth of nodes [billions] and
80. their keys and tertiary data? If you can do that, you should
81. be able to get some anon transport over the p2p for free.
82.  
83. Anyway, p2p messaging and anonymous transports have
84. all been dreamed up by others before. But now is the
85. time to actually abandon traditional email and just do it.
86. If you build it, they will come.
87. =====
88. fabio...
89. I'm strongly against most the ideas to abbandon current email systems,
90. because the results will be to create wallet garden.
91.  
92. We need something interoperable with existing systems or the system will
93. just be used by a bunch of paranoid people or fostered by the marketing
94. of few cryptography company acquiring customers, not user.
95. =====
96. grarpamp...
97. It would be interoperable with current end user interfaces/tools, but not
98. directly with you@some.dotcom.
99. As with everything else, today's seeds grow into tomorrows garden, sometimes
100. you just have to thorougly plow under last year's chaff first, that's by design.
101. =====
102. viktor...
103. E-mail is basically business correspondence.
104.  
105.     - E-mail is stored.
106.     - E-mail is sent to many people outside your personal social network.
107.     - Business recipients of email are often subject to corporate and/or
108.       regulatory policy constraints that are in conflict with end-to-end
109.       encryption.
110.  
111. The above list of features can be greatly expanded, and the
112. consequences elaborated, but I doubt may on this list truly need
113. to be re-educated about email.
114.  
115. So I will confidently predict that end-to-end secure email will
116. remain a niche service used by a tiny minority.
117. ...
118.  
119. Even businesses that one might expect to implement at least encryption
120. to the "gateway", are in many cases choosing to out-source their
121. gateway to 3rd-party providers (anti-spam and anti-virus offerings
122. only work with un-encrypted email, and in many cases the provider
123. also operates the entire mail store).
124. ....
125. [and others also said: tls, dane, skype, smime, ca's, smtp, etc]
126. =====
127. Jerry...
128. Medical, Financial
129. =====
130. grarpamp...
131. Nothing here changes, only the backend transport between nodes.
132. Once your node decrypts the message to your local system pipes,
133. you can do all this and more with it. Including running a 'business' node
134. and doing whatever you want with the plaintext after your node daemon
135. passes it to you. This is not about those ancient protocols. It's also
136. about 'messaging' not strictly 'email'... those lines are already well
137. blurred, no need to distinguish between them anymore. A 'light'
138. messaging client could simply ignore the non transport email headers,
139. or use your standard msg@nodekey address.
140. Please do not continue to talk about antique tradional centralized
141. systems in this thread, except of course to bash and route around them.
142. The speed of a real P2P/DHT replacement at scale is a research challenge.
143. =====
144. coderman...
145. this would make an interesting bet!  i too believe this to be
146. impossible given the constraints.
147. =====
148. grarpamp...
149. I'm not so sure about this, look at all the global resources being poured
150. into traditional email, and attempts to 'fix' it. Now redirect fractional 1%
151. of those resources and put them into a P2P replacement. That's ftw.
152. =====
153. natanael...
154. Say hello to Bote mail on I2P.
155.  
156. I2P provides encrypted anonymizing networking, Bote mail provides DHT
157. based serverless encrypted mailing with public crypto keys as
158. addresses (ECDSA or NTRU).
159.  
160. http://i2p2.de and i2pbote.i2p (if you don't have I2P installed, add
161. .us to visit it via an inproxy).
162.  
163. There is also I2P Messenger that is encrypted P2P IM within I2P also
164. using public keys as addresses.
165. =====
166. cane...
167. You may have a look of "I2P Bote" it is severless, encrypted mail
168. system, address is the public key, P2P based... nice tool.
169.  
170.   https://en.wikipedia.org/wiki/I2P#E-mail
171. =====
172. grarpamp...
173. > You may have a look of "I2P Bote" it is severless, encrypted mail
174. > system, address is the public key, P2P based... nice tool.
175.  
176. As in another post of mine, I'll be looking at that again.
177. My first take was that it stores the messages in the DHT,
178. which didn't seem scalable or reliable at all. I may be
179. wrong as I read more later.
180.  
181. > Afterwards you can add the "I2P Bote plugin", the serverless mail
182. > system. SMTP- and POP3 support was on the ToDo list some times ago, I
183.  
184. I think that's working now. And is the general idea, create a strong
185. overlay network with a frontend MUA's can speak to.
186.  
187. As an aside: If you can make that overlay net present an IPv6 tunnel
188. interface on the local host, that lets you use any IPv6 enabled
189. app over it. I'm doubting the world needs a dozen application
190. specific overlay networks. More like just a few classes of network.
191. - message based store and forward
192. - low latency IPv6 transport
193. - data storage and retrieval
194. =====
195. natanael...
196. Bote mail doesn't have to be used for it's anonymous properties, for
197. me that is just a bonus. For many people it is more than enough to be
198. able to know that it is impossible for anybody else than the intended
199. recipient to read the message thanks to public key addressing.
200. Guaranteed end-to-end security if you can verify the address.
201. I don't think anything that doesn't fundamentally rely on public key
202. addressing is the (long term) future. There will inevitably issues
203. otherwise, including more issues of the type we have with CA:s today.
204. For those who want to make it more user friendly, nothing stops you
205. from adding a transparent "address translation layer" where servers
206. are involved. When you want to send a message to a person with a human
207. readable address at a server, then the server could then reply with
208. the public key based address to the mail client, and the user would
209. have the option to see what that address is. It could even be logged
210. by the client, with TOFU/POP style trust system that reduces the
211. amount of trust you have to place in the server. No need to trust
212. anybody with plaintext.
213. =====
214. grarpamp...
215. I suggest such interfacing with the current legacy system will only prolong
216. it's long past due extinction. Build a better system and let them come to you,
217. not the other way around. And bolting in exits will only make it harder to
218. do correctly and optimally what you need to do as a P2P system. Please,
219. just forget about interfacing with the legacy transport system. If you really
220. need that you can run your own p2p daemon node that acts as your
221. automated gateway between the two. This is mostly about design of
222. the p2p side, not that.
223. =====
224. james...
225. It is my understanding of the proposed replacement for email.  Magic
226. email addresses that in fact correspond to an identifier of a public
227. key, for example the hash of a rule that identifies the public key,
228. and which result in your message not in fact being passed along by
229. email protocols.
230. =====
231. grarpamp...
232. If you're not going to send directly to the very long account@nodepubkey, then
233. yes, you'll need to create another layer on top to hold your h(key). However,
234. the key must still be obtainable behind that since that is what the messages
235. will ultimately be encrypted and routed to. It's not much of a stretch beyond
236. that to ensure userland mail tools can handle say 8k long addresses. I'm not
237. against such a [vanity/shorthash] layer.
238. =====
239. natanael...
240. Bote mail and I2P messenger are two pieces of serverless software that
241. ALREADY is public key addressed within I2P. Have you tried them? You
242. need to add the public keys of the recipients to be able to send a
243. message to start with, although the DHT based search system Seedless
244. allow you to publish Bote mail addresses to the network.
245.  
246. (IMAP support for Bote mail is planned but not yet implemented, right
247. now it has a local web interface.)
248.  
249. Maybe Namecoin could work together with them to enable you to register
250. your key addresses to your nickname in a secure manner, but then you
251. still have to have a globally unique nickname and tell people the
252. exact spelling.
253. =====
254. > ralf...
255. > If you are so sure, can you tell us how the next generation secure email
256. > solution will solve the "trust problem", please.
257.  
258. grarpamp...
259. Though unclear, that sounds like the old trust of a CA/PKI system problem.
260.  
261. > How does the p2p daemon
262. > find the correct crypto key, so that every user can rely on its invisible
263. > performance?
264.  
265. In general I suggest that people wish to use messaging with each other
266. once they already know them (or have some other trusted web to them).
267. As in, Hey John, nice to meet ya today, what's your key (address), I'll
268. message you later. Or Hey Jane, what's John's address. Same for
269. employers, businesses, etc. Such peer groups bootstrap and grow
270. very fast. Thus the perceived need for a cold lookup of Ralf, isn't much of
271. a real one.
272. Once you know the address (node crypto key), you put it 'To: <key>',
273. mua hands to spool, p2p daemon reads spool, looks up key in DHT and
274. sends msg off across the transport to the far key (node) when it is
275. reachable. Hopefully the transport looks like I2P/Tor in being a secure
276. random hop layer. In fact, those could probably be used today, they
277. have the keys as nodes and user facing ports for inbound/outbound
278. daemons. They just need scaling work to n-billion nodes (users,
279. aka: the hard part). People are already plugging postfix, bittorrent,
280. etc into these networks.
281.  
282. Tor is not currently addressible at the user level by the full key,
283. it 'shortens' the key into a 16char onion address. As you may be
284. hinting at... yes, that is bad... collisions, and needing secondary lookup
285. layers into the full key. Tor may be moving to full key addressibility
286. soon, see tor-dev for that.
287.  
288. I2P (and Phantom, and probably GnuNet) are addressible with full keys.
289. So you can send to 'account@key' with them if you want, and keep the
290. John/Jane/Ralf human style lookups in your MUA addressbook (once
291. you know them) without needing a secondary lookup layer into the full key.
292.  
293. No, I am not sure. But when looking at some of the p2p transport
294. layers that have come along so far, it seems like a fairly strong
295. possibility for a new backend transport model while retaining user
296. level mail tools... mutt, maildrop, mailman, Thunderbird, etc. Most
297. of what you'd need there is support for very long addresses and
298. split horizon handoff to local daemon/spool based on recognizing
299. what the destination net is... .onion, .i2p, etc.
300. I'd like to read what Pond and I2P-Bote are doing with some parts of
301. this as well.
302.  
303. I don't believe you need a trusted CA/PKI service to successfully
304. bootstrap users and their addresses/keys into a new global messaging
305. system. If I want to know what some unknown like Bruce's key is, I'll
306. look it up on his website, social net, list posts, etc. If that's what you
307. mean.
308. =====
309. bill...
310. I feel like I walking in halfway into a conversation, I'm guessing this
311. started on the cryptography list that I'm not on.
312.  
313. Your DHT comment caught my attention though.  What in particular about
314. DHTs don't seem scalable or reliable?
315.  
316. Seems like DHTs are regularly in the 5-10M range and I don't see any
317. reason that DHTs couldn't be 10 times that.
318.  
319. Any reasonable churn rate and reliability could be handled with
320. replication.  The bit-torrent DHT for instance claims that 45% of users
321. that bootstrap from a central node are reachable 15 minutes later.  So
322. typical setups involve 8 nodes per bin, and 20 bins.  So every 15
323. minutes you ping 160 hosts, only reach 45%, and do some work to
324. repopulate the missing slots.
325.  
326. Given the simplicity of the bit-torrent DHT I think there's plenty of
327. room for improvement.  Larger routing tables are obvious (at the cost of
328. more network bandwidth to track peers).
329.  
330. The most promising idea for DHT improvements I've seen is to divide
331. peers into 3 latency groups.  High, medium, and low.   Much like L1
332. cache, L2 cache, and main memory.  That way common queries are very
333. fast, yet all queries still to find keys globally.
334. =====
335. grarpamp...
336. Bittorrent is already in the 100m node range. That's not enough. This
337. needs to replace every possible messaging user on the planet over
338. the duration of their actiive lifetime. That's at least a couple billion nodes.
339. Don't forget, you can always use disk to cache things.
340. =====
341. > james...
342. > Need a system for handing one's keys around that protects end users from
343. > the horrifying sight of actual keys or actual strong hashes of keys.
344.  
345. john...
346. But at the same time the system has to not say, "I can't deliver your
347. message to that person because an invisible gnotzaframmit that I won't
348. describe to you seems to be unavailable to me in the flabogrommit."
349.  
350. grarpamp...
351. Address books as usual. Name layer if need be. We are humans, we
352. learn new lexicons, we write manuals, that part is nothing to be afraid of.
353. Being afraid only holds you back.
354. =====
355. > grarpamp...
356. > I don't believe you need a trusted CA/PKI service to successfully
357. > bootstrap users and their addresses/keys into a new global messaging
358. > system. If I want to know what some unknown like Bruce's key is, I'll
359. > look it up on his website, social net, list posts, etc. If that's what you
360. > mean.
361.  
362. > guido...
363. > You can use an untrusted CA to bootstrap. I show how it can be done at:
364. >
365. > http://eccentric-authentication.org/Brucon-Eccentric.pdf
366.  
367. ralf...
368. This is an interesting idea, because it provides certificates on
369. demand for ordinary users, if they decide to sign up to a certain
370. site. The
371. certs are then being used for other purposes, so the site does act as a
372. bootstap for using crypto. The one thing that this proposal relies on is
373. the availability of a common piece of software (user agent) that stores
374. the private key for the user. It's this part of the picture where things
375. get tricky.
376.  
377. grarpamp...
378. There can be no non-distributed/redundant elements in this p2p system,
379. aka: no 'sites', certainly none with a realworld IP on them, and none where
380. very high percentages of them vanishing will disrupt the system for others.
381. This must replace email, therefore system disruption is intolerable.
382. =====