[kfreds]

Sort-of. Here's how I think about it.

The fundamental value of a transparency log is to provide trivial discoverability. Say an attacker has compromised a code signing key and is using it to sign a malicious software update. Let's also assume that the attacker can distribute this update to a client that will trust it. Such a targeted attack is not trivially discoverable by the software vendor if the client's trust policy only requires a code signing signature by the compromised key. If the client's trust policy were to also require a proof that the signature is included in a trusted transparency log, the software vendor can discover the attack if it monitors the log. Note that transparency logs doesn't directly prevent attacks - it makes them discoverable.

Transparency systems based on transparency logs have five components: Log, Submitter, Client, Monitor and Auditor or Witness(es). The Log is a Merkle tree with its current root tree hash signed. In the example above the Client would be the software updating mechanism, which has a given Log in its trust policy. The Client will only trust a software update from the Submitter if the Submitter's signature and the update's hash are included in the Log. The Monitor regularly polls the Log for new entries it cares about, in this case software updates signed by the Submitter's public key. The Auditor is another party that regularly polls the Log, but the Auditor's job is not to discover log entries that constitute an attack. Instead, the Auditor's job is to monitor the Log's consistency - i.e. whether the log has removed any previously added entries. This is called a split-view attack, and it is a concern in all widely deployed transparency logs today. An alternative to Auditors is cosigning Witnesses, which proactively witness a Log's consistency, and whose witness signatures are required by the Client in order for it to trust the Log. This results in a much stronger threat model. See sigsum.org for more details on such a design.

Getting back to your comment:

- Yes, Clients are "thin", to use blockchain terminology, but they don't monitor the Log in order to detect attacks. The Log is part of their trust policy for making some trust decision, such as trusting a software update. Monitoring the Log for new entries that indicate e.g. key compromise is the Monitor's job.

- Regarding accountability: The Client's trust policy in conjunction with the Log and the Monitor increases the Submitter's accountability to the Client. Similarly the Auditors or Witnesses increases the Log's accountability to Clients, Submitter and Monitors.

- Regarding inclusion in the Log (or blockchain) I'd use the word "authority" as in who has the power to prevent something from being included. As you point out a transparency log is a central entity which has the sole power to decide what gets included or not. If the log is shut down, or its public key destroyed, nor more inclusions are possible. In this sense a blockchain is far more censorship-resistant than a transparency log. In other words, it is important that Clients trust multiple logs for redundancy. The consensus mechanism of a transparencty log is simply a public-key signature, as opposed to an emergent authority in the form of e.g. a distributed timestamp server based on SHA256. This vast difference in how the database's integrity is defined - the consensus mechanism - is why blockchains work better than transparency logs for censorship-resistant digital currency, whereas transparency logs work better than blockchains for efficient inclusion- and consistency proofs.

[JanisErdmanis]

I generally agree with what you have said. However regarding this part

> Yes, Clients are "thin", to use blockchain terminology, but they don't monitor the Log in order to detect attacks

The clients can monitor the ledger via consistency proots and it is highly beneficial as that prevents any chances of split being undetected view without requiring to trust other parties in the process. Clients submiting the record to the chain they can get inclusion proofs, but they can also at random times can query that the previous chain root commitment is consistent with existing one in the process keeping consistency proof chain. If it isn't judiciary actions in the presence of evidence can be taken against the authorithy. This is particulary interesting when ledger hosts votes which allows for a fully centralized deployment which is the basis of an voting system I am developing [1].

> it is important that Clients trust multiple logs for redundancy

Replication solves the issue that the records would would always be available which can be done by anyone who has stakes in the integrity of the ledger. Wheras the censorship reistance is an emergent phenomena where multiple people organize and collect unincluded records and overthrows the authorithy. Thus there is no actually need for Clients to trust multiple logs. Clients only need to trust that they would be able to do incident response in the case of misbehaving authorithy.

[1]: https://janiserdmanis.org/artefacts/EVOTEID-2023-poster.pdf

[kfreds]

> The clients can monitor the ledger via consistency proots and it is highly beneficial as that prevents any chances of split being undetected view without requiring to trust other parties in the process. Clients submiting the record to the chain they can get inclusion proofs, but they can also at random times can query that the previous chain root commitment is consistent with existing one in the process keeping consistency proof chain.

The design you're describing doesn't have those security properties.

A malicious or compromised Log conducts a split-view attack by showing different views of the Log to different parties. This is done by providing different parties with different inclusion proofs and consistency proofs. Thus the Log remains consistent from the respective network vantage points of the target(s). They all see an append-only log.

A Client or Monitor shouldn't merely be concerned with whether the Log is consistent from their vantage point. It should be concerned with whether the Log is globally consistent, i.e. whether all views of the Log are consistent with each other. Historically this has led to designs where the Clients gossip consistency information to each other, the introduction of Log Auditors and witness cosigning. I prefer witness cosigning, although to be fair Clients gossiping can work in some designs. Apple's transparency log design is one example, if I remember correctly. It's been a while since I thought about transparency logs.

[JanisErdmanis]

> A malicious or compromised Log conducts a split-view attack by showing different views of the Log to different parties. This is done by providing different parties with different inclusion proofs and consistency proofs. Thus the Log remains consistent from the respective network vantage points of the target(s). They all see an append-only log.

You are spot on the vantage points. It is therefore at utmost necessity that the server does not know who has made a request, is not able to track clients. This is why requests need to be routed through anonymization service like TOR to preserve a single consitent view. The client only gives away the current root commit index they have stored locally which gives a little wiggle room there to be malicious. The latter can also be improved by first asking for the current tree root commitment and then aksing consitency proof with respect to locally stored commitment.

The global consistency in this design is achieved by the server not knowing who makes requests and thus gosiping is not needed.

[FiloSottile]

We considered this design and rejected it because it requires an ultimately unwinnable cat-and-mouse game of fingerprint resistance.

Things the log can use to partition the users include their Tor version, HTTP library behavior, contact periodicity... the list goes on and on, and keeps restricting the use cases where it can be deployed securely even just in theory.

Witness cosigning is secure even if the way you fetch the proofs is completely attacker-controlled, which is closer to user expectations of regular digital signatures.

[JanisErdmanis]

For my application of the history trees (tansparency log) there are additional measures that help to ensure a global consistency view eventually. The authorithy would need to publish the final tally at the end of the vote which also would contain a tree root. The tree root would be distributed in print, in official anouncements thus any user can check that the tree root shown on the client coresponds to that with anounced tally and thus the authorithy would not know who does the check. Thus it would be unreasonably hard for adversary to deploy a deception attack at such scale.

Additional measure is that the TOR integration with the help of Arti project is deployed with the client. That ensures that every client does make the requests in the same way. It is surelly important to not disclose the server any local data or make identity revealing requests within the same session like giving away clients local commitment index before the server has shown their current commitment. Using anonymous channel for ensuring global consitency for sure is not universal but for some applications it is doable if the problem is approached holistically particularly in situations where anonymous channel is already needed within the protocol.

> Witness cosigning is secure even if the way you fetch the proofs is completely attacker-controlled

Opting for this approach makes sense if the protocol doesn't initially require an anonymous communication channel. However, if the protocol already uses it, introducing an additional assumption for trusted witnesses adds complexity.