What do we do about untrustworthy Certificate Authorities?

OpenSSL maintainer and Google cryptographer Ben Laurie and I collaborated on an article for Nature magazine on technical systems for finding untrustworthy Certificate Authorities. We focused on Certificate Transparency, the solution that will shortly be integrated into Chrome, and also discuss Sovereign Keys, a related proposal from the Electronic Frontier Foundation. Both make clever use of cryptographic hashes, arranged in Merkle trees, to produce "untrusted, provable logs."

In 2011, a fake Adobe Flash updater was discovered on the Internet. To any user it looked authentic. The software’s crypto­graphic certificates, which securely verify the authenticity and integrity of Internet connections, bore an authorized signature. Internet users who thought they were applying a legitimate patch unwittingly turned their computers into spies. An unknown master had access to all of their data. The keys used to sign the certificates had been stolen from a ‘certificate authority’ (CA), a trusted body (in this case, the Malaysian Agricultural Research and Development Institute) whose encrypted signature on a website or piece of software tells a browser program that the destination is bona fide. Until the breach was found and the certificate revoked, the keys could be used to impersonate virtually any site on the Internet.

Secure the Internet (PDF)

• [bardfinn]

  I would love to see Sovereign Keys implemented; It would hugely reduce the need for using passwords.

• [plyx]

  I’ve wondered about this before. I also noticed when I received my Samsung laptop last year that inside WMP I had some plugins that had been pre-installed that I could not change the properties of nor delete. There was one in particular that only contained Korean text that I’m sure came from Samsung but I had no idea what it was there for. I was discussing the lack of transparency concerning NASA and other taxpayer funded organizations with someone just yesterday and I think more transparency should also be required of commercial product manufacturers.

• [Bobby Martin]

  Well, Trusted Authority is less secure than Web of Trust.  However, Web of Trust requires a robust community of signers, which we don’t currently have.

  If 2/3 of the CAs trusted by the browser (or 50%, or whatever number makes you happy) sign a doc that says “revoke the certificate of CA X”, then the browser should honor that.

  You could post that doc to a well-known single website, or a standard location on any website (a la robots.txt) and then have the browsers look for it periodically.

  While you’re at it, you might as well allow CAs the browser already trusts to extend trust to new CAs in the same way.

  • [bardfinn]

    If we just had a majority of CA’s revoking individual CA’s, there would be a move to control a majority of CA’s by one interest or a consortium of interests. Then you’d have treaty signatories directing their members to eject non-signatories, over things like copyright royalty fees being charged, hosting torrent trackers, hosting unpopular speech, having a disruptive business model, etcetera etcetera.
    It’s best to avoid situations where the Haves can leverage the Internet to extort the HaveNots.

  • [ZikZak]

    Why have CAs at all?  Who decided that any of these random institutions were worthy of my trust?  We don’t just need to worry about certificates being “forged” with CA’s signatures, we need to worry about CAs voluntarily cooperating with efforts to spy on us.  Securing my internet connection is not a general service that anyone can do, it’s a political issue.  Will this institution cooperate with the US government?  How about the Chinese government?  Is it owned in whole or in part by the megacorp I’m suing?  Different people are going to trust very different institutions – the idea of having one master list is flawed from the start.

    I should be able to designate entities which I actually trust to verify certificates for me.  If my trust later changes, I should be able to revise which entities I use to verify my certificates without any impact on what sites I can access.

    Moxie Marlinspike has done some thinking and coding on these issues: http://convergence.io/ http://tack.io/

    I think those ideas are simultaneously more radical and more viable than a total overhaul of internet protocols.  Primarily because they empower an individual user to independently implement new methods of verifying certificates, regardless of how the “internet architects” think things should be handled.

• [Dale Glass]

  Here’s another idea: have certs signed by multiple CAs. Let’s say at least 4 CAs per cert. That way if a CA’s root cert is compromised, browsers can immediately stop trusting it. So long 2 of 4 signatures are valid, the site still shows as verified.

  This should put a considerable pressure on CAs to have good security, as now any one of them is completely optional and can be removed without breaking half of the internet.

  • [Stooge]

    I’d say you’ve got it backwards: CAs get four times the business while having to worry less about security precisely because no-one’s relying on an individual CA.

    • [Dale Glass]

      They get more business, true. But they have to worry more.

      Imagine Thawte gets compromised. Can you remove their cert from the trusted list? Sure, if you want to break half the net. So you’ll have weeks worth of drama and negotiations back and forth.

      Now imagine Thawte is 1 of 4. You remove their cert and nothing visible to the users happens. You can effectively bankrupt one of the biggest cert providers, without them having any ability to fight back. Big as they are they would be 100% optional.

      Having nobody relying on you is bad, because it makes you expendable.

• [robcat2075]

  If a security scheme makes it possible for a legitimate thing to appear legitimate over the web, how can it really make it impossible for an illegitimate thing to appear legitimate over the web?

  Naive question? Perhaps, but I’ll venture that doubts about the current security scheme were also dismissed as naive before it was implemented.

• [Mitchell Glaser]

  If you look at the big picture of security risk in most people’s lives, the riskiest thing they do is give a credit card to a waiter.

  • [plyx]

    True to an extent. If you stay on top of your online bank statement then you could easily squash such an issue. I learned this lesson the hard way about 5 years ago. My GF and I tried out a new pub in town and had a few drinks plus an appetizer. A few days later I checked my online statement and discovered that the waitress had change my $10 tip (on a $30 check, btw) to a $100 tip. I complained to the owner and he acted as though I was lying! A $100 tip on a $30 check! I threatened to contact the local police department and he reluctantly refunded $90 to me. That’s right, he would only give me back the amount over what I had originally intended to tip. I found out later that he was romantically involved with said waitress whilst cheating on his wife (small town). I’m happy to say that his pub later went under and his wife divorced him taking half his livelihood. Good riddance to bad rubbish.

    • [foobar]

      You’re too nice. The only thing you need to say is “Refund the charge, or I will dispute it. I will file said dispute in 24 hours.”

• [foobar]

  A large part of the problem is the proliferation of trusted by default CA’s. Shouldn’t the people who want to trust the Malaysian Agricultural Research and Development Institute be expected to import it themselves? It seems to me that they could be removed without impacting practically anyone.

  • [Mya Lewis]

    And how widespread could the trust be for a cert signed by the Malaysian ARDI? It’s certainly not something that would be by default installed in _any_ commonly used device or software program, is it?

    • [foobar]

      That’s the problem, it is, and these minor, shouldn’t be installed CA’s can sign certificates for any domain.

• [MyrddinWilt]

  There is so much confusion about what Certificates and CAs can and cannot do here.

  First a couple of disclaimers, I have worked in the CA industry for 15 years and I currently work for a large CA. Google is also a client of mine in my consulting business and I am working with Ben and others on CT in the IETF.

  People seem to have the idea that if only there was no cost to using PKI then everyone would be using it. The problem is that that isn’t true. We tried deploying a PGP Web of trust scheme for the Internet starting in 1992. It didn’t get very far and the reason is pretty clear from graph theory. If you have a million users and each user signs 100 keys then even with an optimum graph configuration there will be three degrees of separation from two different users. Three degrees of separation is pretty much the limit as far as a trust chain goes and few people venture beyond the hundreds in their facebook or LinkedIn friends.

  The Internet actually has about 3 billion users right now and is converging on the population of the planet. Web of trust does not cut it. For the system to scale there must either be nodes of very high degree or people have to accept long trust chains. We (reluctantly) went with nodes of high degree.

  CT won’t solve the password problem either, sorry. Just like it won’t cure malaria or feed the world. The problem of client side authentication and user authentication are hard in their own right.

  As for Ben’s paper, I can’t see the relevance of the code signing anecdote that they open with. Every PKI structure fails in the case that the end user’s private key is disclosed and this is not discovered. That is why revocation mechanisms are necessary. And that is why the EFF sovereign keys proposal was a waste of time, it only works as long as no administrator ever makes a mistake because if they do make a mistake there is no way to ever fix it. Telling people to ‘just be careful and don’t make mistakes’ is really easy if you are an academic or a think-tanker but it does not work in the real world.

  The main role of the CAs is in practice to tell people how to deploy crypto in the first place. In the days when I taught courses on PKI we charged $2400 for a three day course. And most people would have travel costs on top of that. Getting people to the level of knowledge when they can operate PKI successfully costs time and in the commercial world that costs money.

• [Mark Reynolds]

  There is also the concept of Local Trust Anchor management, which allows the local user to manage those CAs that are accepted:

  http://tools.ietf.org/html/draft-ietf-sidr-ltamgmt-07

• [bolamig]

  Simple serious question: How safe is it to click OK when Windows 7 tells me there is a new version of java available to be installed?  How do I know it’s not a virus posing as Oracle (presuming you don’t think Oracle is a virus maker)

  • [robcat2075]

     Based on this article…. less than 100% safe:

    http://www.computerworld.com/s/article/9227736/Researchers_reveal_how_Flame_fakes_Windows_Update

  • [foobar]

    It would be wiser not to have Java installed unless you have a specific need for it.