PGP key servers under attack

Archive Security
1

Reference: SKS Keyserver Network Under Attack · GitHub

There is an interesting lessons learned part regarding decentralized Byzantine protocol security as well.

3 Likes
2
  • The software is Byzantine. The standard keyserver software is called SKS, for “Synchronizing Key Server”. A bright fellow named Yaron Minsky devised a brilliant algorithm that could do reconciliations very quickly. It became the keystone of his Ph.D thesis, and he wrote SKS originally as a proof of concept of his idea. It’s written in an unusual programming language called OCaml, and in a fairly idiosyncratic dialect of it at that. This is of course no problem for a proof of concept meant to support a Ph.D thesis, but for software that’s deployed in the field it makes maintenance quite difficult. Not only do we need to be bright enough to understand an algorithm that’s literally someone’s Ph.D thesis, but we need expertise in obscure programming languages and strange programming customs.
  • The software is unmaintained. Due to the above, there is literally no one in the keyserver community who feels qualified to do a serious overhaul on the codebase.

These two points together are a serious setback when making open source software from hard to reason about languages. It is certainly a trade-off.

3

jesus at that sign-off personal message.