subjective names and MITM

Neither certification hiearchies nor the PGP web-of-trust are very useful
because they try to bind True Names to keys and True Names have many
problems.  People can have duplicate names and can change their names
(what happens if I legally change my name to Bill Clinton and try to get
Verisign to certify my key under that name?), and often we don't care
about someone's True Name. 

Perhaps it is better to think of names as subjective identifiers, and
public keys as global ids.  That is, a person who has a collection of
public keys gives each of them a name, but different people can name their
keys differently.  Of course the holder of the corresponding private key
can help in the naming process (e.g., "Please call me Wei").  If two
people need to talk about a third party, they can refer to him by an
arbitrary name after establishing a common binding between his key and
that name. 

In this scheme, the man-in-the-middle problem goes away because you are 
no longer trying to communicate with a True Name, whose binding with a 
key can be spoofed, but rather with the key itself.  If the holder of 
that key chooses to act as a middle-man by relaying messages around, that 
is his business, and there is really nothing you can do about it.

Wei Dai

hfinney@shell.portal.com writes:
 > There is a difference between a MITM and the case you describe where you
 > are actually communicating securely with the person you think you are,
 > but he chooses to relay the messages around.  

Seems to me that the idea of "communicating with the person you think
you are" is intractably difficult if you're not sitting in the same
room.  If you accept instead the idea of "communicating with the
entity possessing the private half of a keypair" then life gets a lot
simpler. 

 >                                               The difference is that if
 > you are actually communicating securely with an individual, you can form
 > some estimate of his personality, judgement, etc.  You may choose on this
 > basis to trust him, provide sensitve information, take risks, and so on.
 > But if he is actually behind a MITM then all bets are off. 

I don't see why.  If, via some MITM (or "EITM", "Entity In The
Middle") you are able to form a trust relationship with a public key,
then I can see no practical difference.  Consider a dating advice
service that's behind a public key.  You send it dozens of letters,
and soon come to trust the advice being given.  By whatever means at
your disposal you look for leaks of information you divulge and find
none, so your trust increases.  If the private key is held by an AI
program, by a team of learned specialists at a shadowy Swedish
research institute, or by Rush Limbaugh, then what difference does it
make to you?

 > All of your judgement about him is irrelevant.  At any time the
 > MITM can take advantage of the information you provide.  He can
 > even "blow his cover" and take extreme action, to your detriment.

But then so can the "real person" you thought you were communicating
with.

 > This situation with the MITM is actually about the same as if you were
 > communicating insecurely in the first place.  You are exposed to all of
 > the same risks.

The only way to achieve the level of security offered by physical face
to face communication with a person is to have a physical face to face
conversation at some point.  If you only ever communicate via
electronic means, you are always subject to the risk of dealing with a
synthetic entity.  (I think.)

 > So if you are willing to accept communicating systems that allow this
 > kind of attack, you almost might as well not use cryptography at all.
 > (Not quite, because the MITM is a more expensive attack to mount than one
 > on an unsecured wire.)

That's not clear.  I can have confidence when using a PK scheme that I
am at least communicating securely with the entity that holds the
private key.  That that entity may be leaking information through
alternate channels is something I don't know; I don't see how you can
securely defend against that in any case, or perhaps I don't see how
defending against it in the case that you think you know who you're
dealing with is any different than defending against it if you accept
that you don't know who you're dealing with.

(I've read over that a couple times, and I think it's OK.)

 > In fact, I can facetiously prove that cryptography is unnecessary.  We
 > are not communicating with individuals, but with communicatees.  

Works for me.  (Indeed, Hal, I have no idea who or what your are :-)

 > All of your messages are by definition going to the communicatee
 > with whom you are communicating.  If the particular communicatee
 > who is receiving your message chooses to relay it or spread the
 > information around in other ways, that is the right and privilege
 > of the communicatee.  But messages are going to the communicatee
 > they are going to, whether encryption is used or not.  So
 > encryption is not necessary. 

Ah, but that last point is clearly *not* true.  When you encrypt, you
at least have some assurance that between you and the communicatee
there's security.  If (unfortunately) the "comminicatee" is a
conspiracy that begins at the CO where your home phone lines
terminate, then indeed you've got a problem.

 > This argument seems to mirror the one for why we only communicate with
 > keys, that if a key wants to do something nasty we can't stop it (him?),
 > etc.  I say, we don't communicate with keys.  We communicate with people
 > (or occasionally programs).

But how do you know?  (How do you know there aren't a team of people
standing beside me advising me on what to type?)  And note that you
can hardly keep me from doing something nasty: to prove it, I'm going
to get up right now and fetch my favorite beverage, which is a 6oz can
of cranberry juice mixed with a 12oz can of Diet Coke :-)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Nobody's going to listen to you if you just | Mike McNally (m5@tivoli.com) |
| stand there and flap your arms like a fish. | Tivoli Systems, Austin TX    |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

m5@dev.tivoli.com (Mike McNally) writes:

>hfinney@shell.portal.com writes:
> > There is a difference between a MITM and the case you describe where you
> > are actually communicating securely with the person you think you are,
> > but he chooses to relay the messages around.  

>Seems to me that the idea of "communicating with the person you think
>you are" is intractably difficult if you're not sitting in the same
>room.  If you accept instead the idea of "communicating with the
>entity possessing the private half of a keypair" then life gets a lot
>simpler. 

I can certainly agree with the attractive simplicity of this notion.  My
point is that it is practically useless.  I believe this is a seductive
but very wrong idea.  As I said, it amounts to defining the problem away.
Does that mean that the problem (of MITM attacks) never existed at all,
that all of the effort that people have spent over the year to try to
solve it was wasted?  I am baffled by the fact that people are taking
this whole notion of "communicating with keys" seriously.  Keys do not
communicate.

One might as easily say that wiretaps are not an issue: I am not
communicating with the person I called, but with the other end of the
telephone wire.  If that wire end is actually (unknown to me) in the
hands of a government agent who has cut the wire and interposed his own
listening device, that's OK, because I'm still communicating with the
other end of the wire.  After all, I have no way of knowing whether the
person that I am talking to may actually be spreading my info to
anyone, so it doesn't really make any difference if he does it or the
wiretappers.  Etc., etc.  This is exactly like the argument about
communicating with keys.  Does this mean that we shouldn't worry about
wiretaps?  I hope not.  I really don't understand why the argument is
so much more persuasive in the case of keys.

> >                                               The difference is that if
> > you are actually communicating securely with an individual, you can form
> > some estimate of his personality, judgement, etc.  You may choose on this
> > basis to trust him, provide sensitve information, take risks, and so on.
> > But if he is actually behind a MITM then all bets are off. 

>I don't see why.  If, via some MITM (or "EITM", "Entity In The
>Middle") you are able to form a trust relationship with a public key,
>then I can see no practical difference.  Consider a dating advice
>service that's behind a public key.  You send it dozens of letters,
>and soon come to trust the advice being given.  By whatever means at
>your disposal you look for leaks of information you divulge and find
>none, so your trust increases.  If the private key is held by an AI
>program, by a team of learned specialists at a shadowy Swedish
>research institute, or by Rush Limbaugh, then what difference does it
>make to you?

The difference is that I form a judgement about the personality of the
person I am communicating with, whereas I can't form any such judgement
about the personality of the MITM.  Consider how, in life, we decide who
to trust.  Isn't it largely on the basis of communications?  We talk to
the person, we talk to other people about him, we take what we know of
him, and we decide to trust him.  If we suppose that there is in fact a
secure channel to another person, then I suggest that it is plausible to
suppose that we could enter into a trusted relationship with him, even
without a face-to-face meeting.  After all, what exactly does the face to
face meeting accomplish?  Yes, we see a little more about the person, we
can judge some non-verbal communications.  But it is not wholly
different.

We can always be wrong - the person may not be as trustworthy as we think
he is.  There is some probability of that which we must always keep in
mind.  But, and here is my main point, if a MITM is a possibility (and
we're taking the attitude that that's just fine, we're communicating with
keys, no problem if there's a MITM involved, don't bother to take any
steps to prevent it) then these assumptions about extending trust are a
lot riskier.  The probability of a betrayal will be much higher if a MITM
is possibly involved than if he is not.  Most people do not try to betray
their communicants.  But if (in the worst case) all lines were tapped by
men in the middle, then in fact all conversations are subject to this
betrayal.  As I wrote before, I don't see the difference between this
situation and one where there is no security at all (at least from
wiretappers).

> > All of your judgement about him is irrelevant.  At any time the
> > MITM can take advantage of the information you provide.  He can
> > even "blow his cover" and take extreme action, to your detriment.

>But then so can the "real person" you thought you were communicating
>with.

Most of the time your judgement about the real person will be valid, at
least with some experience.  Most people are not AI's or teams of
conspirators.  But you have absolutely no basis to make judgements about
the MITM.  In fact the greater probability is that his interests are
opposed to yours.

> > This situation with the MITM is actually about the same as if you were
> > communicating insecurely in the first place.  You are exposed to all of
> > the same risks.

>The only way to achieve the level of security offered by physical face
>to face communication with a person is to have a physical face to face
>conversation at some point.  If you only ever communicate via
>electronic means, you are always subject to the risk of dealing with a
>synthetic entity.  (I think.)

I don't think so, or at least the risk can be minimized much more than in
the model where we just say that we're communicating with keys, therefore
a MITM is perfectly legitimate because it's just a matter of who holds
the keys.  Suppose I want to talk to PC Magazine columnist John Dvorak.
Suppose I find a VeriSign certificate for his key, with his name and
employment information.  I've never met him.  We've never had a face to
face conversation.  Yet I claim I can communicate with considerable
security with Dvorak using this certificate, certainly more than if I
just use any old key which is lying around with his name on it, one which
may be owned by a MITM.

> > So if you are willing to accept communicating systems that allow this
> > kind of attack, you almost might as well not use cryptography at all.
> > (Not quite, because the MITM is a more expensive attack to mount than one
> > on an unsecured wire.)

>That's not clear.  I can have confidence when using a PK scheme that I
>am at least communicating securely with the entity that holds the
>private key.  That that entity may be leaking information through
>alternate channels is something I don't know; I don't see how you can
>securely defend against that in any case, or perhaps I don't see how
>defending against it in the case that you think you know who you're
>dealing with is any different than defending against it if you accept
>that you don't know who you're dealing with.

>(I've read over that a couple times, and I think it's OK.)

If you are in fact communicating with the person you think you are, you
can use all the information you have about him (including other
conversations) to judge his personality and trustworthiness.  Yes, this
can be mistaken - but the same thing happens in the real world.  That
doesn't mean that we abandon the whole idea of trust.  We still can be
right most of the time.  However if you know that a MITM may be involved,
you will be much slower to extend trust.  In fact you have to act as
though you have an unsecured channel.

> > All of your messages are by definition going to the communicatee
> > with whom you are communicating.  If the particular communicatee
> > who is receiving your message chooses to relay it or spread the
> > information around in other ways, that is the right and privilege
> > of the communicatee.  But messages are going to the communicatee
> > they are going to, whether encryption is used or not.  So
> > encryption is not necessary. 

>Ah, but that last point is clearly *not* true.  When you encrypt, you
>at least have some assurance that between you and the communicatee
>there's security.  If (unfortunately) the "comminicatee" is a
>conspiracy that begins at the CO where your home phone lines
>terminate, then indeed you've got a problem.

No, by definition the "communicatee" is the set of all the people who
see your messages.  So by definition between you and the communicatee
there is security even without encryption (since no one other than the
communicatee sees the message).  Sophistry?  The number of people who can
receive your messages is no greater without encryption than if you use
encryption but don't take steps against a MITM and in fact adopt a stance
which states that MITM attacks don't exist.

> > This argument seems to mirror the one for why we only communicate with
> > keys, that if a key wants to do something nasty we can't stop it (him?),
> > etc.  I say, we don't communicate with keys.  We communicate with people
> > (or occasionally programs).

>But how do you know?  (How do you know there aren't a team of people
>standing beside me advising me on what to type?)  And note that you
>can hardly keep me from doing something nasty: to prove it, I'm going
>to get up right now and fetch my favorite beverage, which is a 6oz can
>of cranberry juice mixed with a 12oz can of Diet Coke :-)

I don't know for sure, but if you tell me or give me the impression over
a period of time that you are keeping our conversations private, and I
decide that you are honest based on our conversations and what I know
about you from others, then I can make a judgement with a reasonable
chance of safety.  Yes, I can be mistaken.  But that doesn't mean that I
should abandon the whole idea of trust.  Otherwise I will never trust
anybody in any part of life.  But preventing MITM attacks is very
important to being able to extend trust in the online world.  Defining
them away is not a satisfactory solution.

Hal

hfinney@shell.portal.com writes:
 > m5@dev.tivoli.com (Mike McNally) writes:
 > >hfinney@shell.portal.com writes:
 > > > There is a difference between a MITM and the case you describe ...
 > 
 > >Seems to me that the idea of "communicating with the person you think
 > >you are" is intractably difficult if you're not sitting in the same
 > >room. ...
 >
 > I can certainly agree with the attractive simplicity of this notion.  My
 > point is that it is practically useless. ...

Oddly enough, it seems to me that Hal (if that really *is* his name)
and I (and Carl & others) are saying basically the same things, but
drawing completely different conclusions.  Strange.  I'm willing to
wait to see what the peer review process concludes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Nobody's going to listen to you if you just | Mike McNally (m5@tivoli.com) |
| stand there and flap your arms like a fish. | Tivoli Systems, Austin TX    |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On Fri, 6 Oct 1995, Mike McNally wrote:

> 
> hfinney@shell.portal.com writes:
>  > m5@dev.tivoli.com (Mike McNally) writes:
>  > >hfinney@shell.portal.com writes:
>  > > > There is a difference between a MITM and the case you describe ...
>  > 
>  > >Seems to me that the idea of "communicating with the person you think
>  > >you are" is intractably difficult if you're not sitting in the same
>  > >room. ...
>  >
>  > I can certainly agree with the attractive simplicity of this notion.  My
>  > point is that it is practically useless. ...
> 
> Oddly enough, it seems to me that Hal (if that really *is* his name)
> and I (and Carl & others) are saying basically the same things, but
> drawing completely different conclusions.  Strange.  I'm willing to
> wait to see what the peer review process concludes.

I think Hal and some other Cypherpunks (Me, You, Carl, etc.) are not 
proceeding from one of the same assumptions.  Specifically, Hal seems to 
be proceeding from the assumption that the person "on the other end of 
the line" is in fact a known physical entity who has a meat reputation 
tied to the name.  I'm proceeding from the assumption that the person on 
the other end of the line has no specific RL reputation that I'm basing 
the relationship on, just the online one.

Here's an example:
There's someone on the list, now, apparently, with the name of "Steven 
Levy."  Hal assumes that, when communicating with that "Steven Levy," one 
intends to communicate with the fairly-well-known journalist of that 
name, and thus  certification of RL identity is important.  I assume 
that, unless there's a specific reason otherwise, I want to have an 
intellectual conversation (or financial transaction, etc) that isn't 
predicated on this being "the" Steven Levy.  In that case, certification 
of RL identity is irrelevant.

(Not to pick on you, Steve, but I needed an obvious example familiar to 
list members... The other candidate was Steve Wozniak, to whom I sent fan 
e-mail the other day... :) )

Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser@rwd.goucher.edu>            (410)494-3072 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

Jon Lasser <jlasser@rwd.goucher.edu> writes:
>I think Hal and some other Cypherpunks (Me, You, Carl, etc.) are not 
>proceeding from one of the same assumptions.  Specifically, Hal seems to 
>be proceeding from the assumption that the person "on the other end of 
>the line" is in fact a known physical entity who has a meat reputation 
>tied to the name.  I'm proceeding from the assumption that the person on 
>the other end of the line has no specific RL reputation that I'm basing 
>the relationship on, just the online one.

>Here's an example:
>There's someone on the list, now, apparently, with the name of "Steven 
>Levy."  Hal assumes that, when communicating with that "Steven Levy," one 
>intends to communicate with the fairly-well-known journalist of that 
>name, and thus  certification of RL identity is important.  I assume 
>that, unless there's a specific reason otherwise, I want to have an 
>intellectual conversation (or financial transaction, etc) that isn't 
>predicated on this being "the" Steven Levy.  In that case, certification 
>of RL identity is irrelevant.

That is not exactly my point.  My concern is avoiding the man in the
middle attack.  One way to do that is to find a certificate from Verisign
saying that this key belongs to Steven Levy, ideally with other
information that I can confirm relates to the on-line personage I wish to
speak to.  Presumably the MITM can't get a certificate for Steven Levy,
unless by coincidence his name actually is Steven Levy, in which case the
other information I mentioned will be helpful as well.

Would you propose just to use an unsigned key that says it is for
Steven Levy?  Or perhaps a key without any name at all that someone
told you was for him?  That is the policy which I have been arguing
against.  The whole idea of communicating with keys, or not having key
certificates or signatures, seems to me to leave open the possibility
of man in the middle attacks.  Isn't this a problem?  Or are the
difficulties of mounting a MITM attack considered so large that they can be
neglected?  I would just like to hear exactly what are the assumptions
being made regarding this problem by those who oppose certificates.

Hal

Assassins with Sly Stallone and Antonio Banderas with Julianne Moore as 
the cyberspatial interest.

This may be the film derived in part from some writer-type's conversation 
with our own Tim May.

Sly and Antonio get their contracts via computer from an anonymous 
source.  They favor Powerbooks.  The source types on the tops of the 
screens they type on the bottom.  The Powerbooks must have built in 
wireless modems because they are pretty casual about firing them up 
wherever they happen to be.

Julianne is cute.  Apparently being a net security expert/hacker is seen 
as women's work in Hollywood with Sandra in the Net and what's her name 
in Hackers.  Also this sort of life interferes with your social contacts 
because both Sandra and Julianne seem lonely.  Julianne likes cats.

The screens look fake (like most Hollywood computer screens).  There is 
minor mention of encryption.  Julianne is a "ghost" (self-described) 
with no SS# or DL.  She does have a car and apartment, however.  As 
always in these films, much of the action is motivated by a single 
high-density floppy.  It's amazing the amount of stuff they can get on 
those disks.

Most of these character's problems could be solved if they would simply 
transfer this info over the nets without having to meet in person.  They 
could also encrypt disks much more than they choose to.

Coincidentally, I saw both The Net and Hackers this weekend.  It is hard 
to decide which is the "best."  Assassins is slick and Antonio makes a 
great psycho.  [Note to Sly --- Many of your problems as a professional 
assassin could be solved by a few finishing shots to the head. --- I 
thought they taught that on the first day in assassin's school.]  I 
suppose I liked Assassins best although Puerto Rico makes a poor stand-in 
for an island tax haven.  I like English accents on my tax 
haven bankers.


DCF

"Who is ready to act as an advisor for a small fee to anyone out there 
who wants to do a real net film."

m5@dev.tivoli.com (Mike McNally) writes, quoting me:

Mike>Seems to me that the idea of "communicating with the person you think
Mike>you are" is intractably difficult if you're not sitting in the same
Mike>room. ...

Hal> I can certainly agree with the attractive simplicity of this notion.  My
Hal> point is that it is practically useless. ...

Mike>Oddly enough, it seems to me that Hal (if that really *is* his name)
Mike>and I (and Carl & others) are saying basically the same things, but
Mike>drawing completely different conclusions.  Strange.  I'm willing to
Mike>wait to see what the peer review process concludes.

I am afraid you have quoted this out of context and thereby exactly
reversed the sense of what I was saying.  Hence we are not saying the
same things, but rather we are saying opposite things.  The full quote is:

Mike>Seems to me that the idea of "communicating with the person you think
Mike>you are" is intractably difficult if you're not sitting in the same
Mike>room.  If you accept instead the idea of "communicating with the
Mike>entity possessing the private half of a keypair" then life gets a lot
Mike>simpler. 

Hal>I can certainly agree with the attractive simplicity of this notion.  My
Hal>point is that it is practically useless.

By "this notion" I was referring to the second sentence rather than the
first, the idea that we are communicating with whomever holds the key.
This was the one which you said would make life simpler, and so I hoped
that by agreeing about its simplicity it would be clear which of the two
competing ideas I was referring to.  Apparently it was ambiguous, so I
apologize for being unclear.

It is disturbing that even after reading that very long message my
position could be interpreted as being the opposite of what it is.
Apparently my arguments are not being well understood.  I will have to
think about this issue more and try to express myself better.

Hal

Wei Dai wrote:

| Perhaps it is better to think of names as subjective identifiers, and
| public keys as global ids.  That is, a person who has a collection of
| public keys gives each of them a name, but different people can name their
| keys differently.  Of course the holder of the corresponding private key
| can help in the naming process (e.g., "Please call me Wei").  If two
| people need to talk about a third party, they can refer to him by an
| arbitrary name after establishing a common binding between his key and
| that name. 

	Just a minor nit regarding a well thought out post, public
keys are not 'global' ids, but 'system-wide' IDs.  For keys to be
really global, there needs to be a mechanism in place for insuring
that key ids are very probably unique.  One way to ensure that keys
are globally unique would be to integrate a KCA identifier with the
keyid, and KCAs base part of their reputation on not signing multiple
keys with the same id.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Adam Shostack writes:
>	Just a minor nit regarding a well thought out post, public
>keys are not 'global' ids, but 'system-wide' IDs.  For keys to be
>really global, there needs to be a mechanism in place for insuring
>that key ids are very probably unique.  One way to ensure that keys
>are globally unique would be to integrate a KCA identifier with the
>keyid, and KCAs base part of their reputation on not signing multiple
>keys with the same id.

A public key *is* "very probably unique".  A "randomly selected" 1024 bit
prime number has a specific amount of entropy in it.  The likelihood of
two users world wide "randomly" choosing the same such prime may be
precisely determined (assuming you can figure the entropy).

Who needs a KCA to certify it?

The real benefit of the KCA is as a means of linking the key with a unique
person.  As I've commented before, anonyms have no meaningful "credit rating".

Scott Brickner wrote:

| Adam Shostack writes:
| >	Just a minor nit regarding a well thought out post, public
| >keys are not 'global' ids, but 'system-wide' IDs.  For keys to be
| >really global, there needs to be a mechanism in place for insuring
| >that key ids are very probably unique.  One way to ensure that keys
| >are globally unique would be to integrate a KCA identifier with the
| >keyid, and KCAs base part of their reputation on not signing multiple
| >keys with the same id.
| 
| A public key *is* "very probably unique".  A "randomly selected" 1024 bit
| prime number has a specific amount of entropy in it.  The likelihood of
| two users world wide "randomly" choosing the same such prime may be
| precisely determined (assuming you can figure the entropy).

	The key does indeed have a high likelihood of being unique,
but dealing with 1024 bit identifiers could strain database systems,
especially when 100 well chosen bits would be than enough.

Adam



-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Adam Shostack writes:
>	The key does indeed have a high likelihood of being unique,
>but dealing with 1024 bit identifiers could strain database systems,
>especially when 100 well chosen bits would be than enough.

Hence the suggestion to use a hash of the key instead of the key
itself.  Someone pointed out that a uniformly distributed 1024 bit
prime has something like 1014 bits of entropy.  An md5 hash of the key
should have about 128 bits of entropy, with the probability of a
collision among 2^33 keys (one per person, worldwide) being about
1 in 2^95, or about 1 in 10^29.  Sounds like we're safe, even without
straining our databases.

Wei Dai <weidai@eskimo.com> writes:

>In this scheme, the man-in-the-middle problem goes away because you are 
>no longer trying to communicate with a True Name, whose binding with a 
>key can be spoofed, but rather with the key itself.  If the holder of 
>that key chooses to act as a middle-man by relaying messages around, that 
>is his business, and there is really nothing you can do about it.

Carl Ellison has been arguing a similar point for some time, if I
understand him, which I may not!

The man in the middle problem is a difficult one, but I don't think
you're going to get away with defining the problem out of existence.
There is a difference between a MITM and the case you describe where you
are actually communicating securely with the person you think you are,
but he chooses to relay the messages around.  The difference is that if
you are actually communicating securely with an individual, you can form
some estimate of his personality, judgement, etc.  You may choose on this
basis to trust him, provide sensitve information, take risks, and so on.
But if he is actually behind a MITM then all bets are off.  All of your
judgement about him is irrelevant.  At any time the MITM can take
advantage of the information you provide.  He can even "blow his cover"
and take extreme action, to your detriment.

This situation with the MITM is actually about the same as if you were
communicating insecurely in the first place.  You are exposed to all of
the same risks.
So if you are willing to accept communicating systems that allow this
kind of attack, you almost might as well not use cryptography at all.
(Not quite, because the MITM is a more expensive attack to mount than one
on an unsecured wire.)

In fact, I can facetiously prove that cryptography is unnecessary.  We
are not communicating with individuals, but with communicatees.  All of
your messages are by definition going to the communicatee with whom you
are communicating.  If the particular communicatee who is receiving
your message chooses to relay it or spread the information around in
other ways, that is the right and privilege of the communicatee.  But
messages are going to the communicatee they are going to, whether
encryption is used or not.  So encryption is not necessary.

This argument seems to mirror the one for why we only communicate with
keys, that if a key wants to do something nasty we can't stop it (him?),
etc.  I say, we don't communicate with keys.  We communicate with people
(or occasionally programs).

Hal