6 ms·

The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything - and you are at their mercy for not revoking. And what's

by 0x0 11y ago

The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything - and you are at their mercy for not revoking. And what's worse, even if you pick a decent vendor, you can't prevent shadier outfits from also issuing parallel certs. :(

inopinatus 11y ago
In the short term - by which I mean, the next ten years - my hopes are on DNSSEC with DANE/TLSA for DNS-based certificate assurance. This is not a great solution: firstly, adoption of DNSSEC has yet to snowball; and secondly, DNS remains a tree with a single root controlled by a governmental authority, and it's tough to argue that's any better than the CAs. The longer dream of a universally federated, decentralized trust mesh depends on a substrate protocol emerging for which I think Bitcoin is only the first glimmer of hope; timeframe ca.10-50 years.
- thezilch 11y ago
  Except DNSSEC is just as sketch (and maybe more so) a trust chain. We replace CAs with registrars (OH GOD), TLDs (and for .com, that's just CAs again or governments, OH GOD), and ICANN (subject to government seizures!!!). I'd much sooner support adoption of Marlinspike's Convergence or something similarly distributed: http://convergence.io/ http://convergence.io/
  - superuser2 11y ago
    I think you're forgetting the 99% of internet users who are nowhere near computer-literate enough to make anything approaching not-insane decisions about who to trust. I'm not a fan of the CAs either, but trust is a really hard problem and surfacing it to people who would just as easily try to run viagra.exe on their Macs is unlikely to make the situation better.
    - michaelbuckbee 11y ago
      Completely agreed - the current system of CAs is designed to blunt phishing attacks and secure cc transactions over the wire and it mostly succeeds at that. Where it fails is as a protection against state sponsored scrutiny or a serious direct hacking attempt.
  - viraptor 11y ago
    Unfortunately convergence is dead for 4 years now with no updates. Do you know if that's just enthusiasm running out, or was there some serious issue with the service?
    - thezilch 11y ago
      That's true; what cropped up after Convergence was TACK: http://tack.io/index.html http://tack.io/index.html It too has seen not a lot of traction. However, Google has implemented a competing stack into Chrome (and Firefox supports it) in HPKP (HTTP Public Key Pinning) with sites having the ability to pin their cert, and these browsers will trust that bond all day.
  - 0x0 11y ago
    But even with today's SSL CA system, those entities (registars, TLDs, ICANN) have full control. They could easily override the NS records and/or WHOIS for a domain targeting a domain-validating CA, and receive a valid certificate. Might as well place the CA authorities with the TLDs, then. At least that would limit their authority to their subtree, instead of the free-for-all that is the current CA club. It might even let end-users make a semi informed trust decision: ".be seems to run a tight shop and appears trustworthy, .ly not so much" (random TLDs picked for example purposes only). It would even make it worthwhile for site owners to pick a more reliable/valuable/expensive TLD (and thus CA), since it would bring a generally-accepted-to-be higher level of trust.
    - bro-stick 11y ago
      Exactly. The challenges with convergence are akin to a simplified gpg+keybase... increasing its popularity needs further development and proponents to gather a critical mass of users and providers. Trust is hard. For top-down TLS CA to work, the net needs a fewer trustworthy, sensible, well-secured/geo ip'd/leadership nonprofits to be the systems-of-record far out of reach of govt and corporate dictatorships. (icann, iana are a good start, but they could be better. ssl cert cert authority as another type common-good org.). Also, having a zillion CAs able to independently issue endless wildcard certs for the same domain is lunacy... only the domain owner can be issued certs. It should be tied to common global record-keeping system as domain name registrars do and/or domain registrar-mediated challenge to prove ownership (control panel login / authenticated API calls, not just adding some spoofable TXT record cookie or link in an email). End MITM by rogue certs, at a minimum.
      - 0x0 11y ago
        Yes, exactly. The registrar would be the obvious place for CA issuance - by definition your account there proves your ownership. Heck, make it a requirement that registrars issue free SSL certificates as part of the domain registation service and we might even get to the https-everywhere world that seems to be in vogue. Double bonus if this can be engineered with a technical guarantee/verification that only the proper registrar for a domain is a valid CA for it.
  - nly 11y ago
    It doesn't really matter. Most people are only getting their CA certs through domain validation anyhow, so you're already at the mercy of registrars and TLDs. DANE actually reduces the people you need to trust. Hell, some CAs will issue a cert for a domain to anyone who can write to the docroot on the webserver it points to. Grabbing one before a malicious entity and deploying HSTS and HPKP is your only weak defence.
  - AndyMcConachie 11y ago
    There seems to be this mistaken belief that DNSSEC/DANE are intended to replace CAs. There is no such idea. I wrote about this recently if you're interested. http://metafarce.com/adventures-in-dane/ http://metafarce.com/adventures-in-dane/ "..the purpose of DANE is not to do away with the CA system. It is to provide another chain of trust based on the DNS hierarchy."
    - inopinatus 11y ago
      If only intentions made the world go round. But how we use things, and build upon them, is often rather more interesting than what someone intended. The commercial CAs will be a relic. It's only a matter of time before the whole house of cards collapses. The price pressure has been downwards for years. EV is not meaningful to most end-users, remaining a money-printing scam that provides little assurance of safety (if Enron, or Ashley Madison could get one, what's it worth?), and is vulnerable to MITM and rebinding attacks[1]. I anticipate that Amazon's CA[2] could undermine the profitability - and via desperation, the integrity - of the whole sector even further. [1] http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA... [2] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer...
      - realityking 11y ago
        How is it relevant that Enron or Ashley Madison could get EV certificates? They are intended to proof that you're communicating with whom you intended to communicate. They make no claim about the trustworthiness of the company itself (and how would you even test that?)
- idlewords 11y ago
  You really think that giving Libya the keys to bit.ly, for example, is a step forward?
  - toast0 11y ago
    Doesn't Libya already have the keys? They can redelgate the zone and get a domain controlled cert. Or probably something more subtle with selective who is responses.
    - tptacek 11y ago
      No! Choosing a .LY name for your website does not give the government of Libya your TLS keys. With DNSSEC, that could change.
      - toast0 11y ago
        If the operator of .LY might takeover the domain to return DANE records that it controls, why wouldn't it takeover the domain and procure a domain validated certificate from a CA? For extra sneakyness, they could probably return the regular glue records and whois information to most requestors, and poisoned values to the targeted CA, to get the certificate up an running in advance of hijacking the domain in general.
        tptacek 11y ago
        CAs are insecure. Nobody is arguing otherwise. The problem is that you can't mitigate insecure CAs by adding a new set of irrevocable government-controlled CAs. That's the point 'idlewords is making. Right now, the DNS does not function as a sort of distributed CA. But that's exactly what DNSSEC asks it to do.
        toast0 11y ago
        For domain validated certificates, the DNS does essentially function as a sort of distributed CA; if you control the DNS for a domain, you can get the certificate issued: this isn't insecure, it's by design. Unless we're talking about removing domain validated certificates, I don't see why explicitly treating DNS as a CA, when it's a de facto CA is a problem. I'm not sure how we can get to HTTPS everywhere without domain validated certificates?
aianus 11y ago
https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...
- 0x0 11y ago
  So after all those years of x509/asn1/openssl bugs and ca breaches we are left with... ~/.ssh/known_hosts reimplemented, poorly? :-}
nailer 11y ago
That's what HPKP and certificate transparency are for. Google also require certificate transparency for all EV certs.
chetanahuja 11y ago
"The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything" It boggles the mind that all these security experts (including those frequenting these forums) take such pains over obscure, hard to exploit things (like about half the CVE vulns), and come down with the fury of a thousand suns on anyone daring to come up with, say a new secure messaging protocols without their permission (remember the Telegram brouhaha) and yet blithely go on endorsing and even encouraging this totally broken third party trust system, this house of cards that the entire web security framework is built on. Just baffling.
- Zigurd 11y ago
  Many security consultants sell "security" out one door and surveillance/forensics out the other door. Only one of those businesses sells a working product/service.

by 0x0 11y ago

inopinatus 11y ago

In the short term - by which I mean, the next ten years - my hopes are on DNSSEC with DANE/TLSA for DNS-based certificate assurance. This is not a great solution: firstly, adoption of DNSSEC has yet to snowball; and secondly, DNS remains a tree with a single root controlled by a governmental authority, and it's tough to argue that's any better than the CAs. The longer dream of a universally federated, decentralized trust mesh depends on a substrate protocol emerging for which I think Bitcoin is only the first glimmer of hope; timeframe ca.10-50 years.

thezilch 11y ago
Except DNSSEC is just as sketch (and maybe more so) a trust chain. We replace CAs with registrars (OH GOD), TLDs (and for .com, that's just CAs again or governments, OH GOD), and ICANN (subject to government seizures!!!). I'd much sooner support adoption of Marlinspike's Convergence or something similarly distributed: http://convergence.io/ http://convergence.io/
- superuser2 11y ago
  I think you're forgetting the 99% of internet users who are nowhere near computer-literate enough to make anything approaching not-insane decisions about who to trust. I'm not a fan of the CAs either, but trust is a really hard problem and surfacing it to people who would just as easily try to run viagra.exe on their Macs is unlikely to make the situation better.
  - michaelbuckbee 11y ago
    Completely agreed - the current system of CAs is designed to blunt phishing attacks and secure cc transactions over the wire and it mostly succeeds at that. Where it fails is as a protection against state sponsored scrutiny or a serious direct hacking attempt.
- viraptor 11y ago
  Unfortunately convergence is dead for 4 years now with no updates. Do you know if that's just enthusiasm running out, or was there some serious issue with the service?
  - thezilch 11y ago
    That's true; what cropped up after Convergence was TACK: http://tack.io/index.html http://tack.io/index.html It too has seen not a lot of traction. However, Google has implemented a competing stack into Chrome (and Firefox supports it) in HPKP (HTTP Public Key Pinning) with sites having the ability to pin their cert, and these browsers will trust that bond all day.
- 0x0 11y ago
  But even with today's SSL CA system, those entities (registars, TLDs, ICANN) have full control. They could easily override the NS records and/or WHOIS for a domain targeting a domain-validating CA, and receive a valid certificate. Might as well place the CA authorities with the TLDs, then. At least that would limit their authority to their subtree, instead of the free-for-all that is the current CA club. It might even let end-users make a semi informed trust decision: ".be seems to run a tight shop and appears trustworthy, .ly not so much" (random TLDs picked for example purposes only). It would even make it worthwhile for site owners to pick a more reliable/valuable/expensive TLD (and thus CA), since it would bring a generally-accepted-to-be higher level of trust.
  - bro-stick 11y ago
    Exactly. The challenges with convergence are akin to a simplified gpg+keybase... increasing its popularity needs further development and proponents to gather a critical mass of users and providers. Trust is hard. For top-down TLS CA to work, the net needs a fewer trustworthy, sensible, well-secured/geo ip'd/leadership nonprofits to be the systems-of-record far out of reach of govt and corporate dictatorships. (icann, iana are a good start, but they could be better. ssl cert cert authority as another type common-good org.). Also, having a zillion CAs able to independently issue endless wildcard certs for the same domain is lunacy... only the domain owner can be issued certs. It should be tied to common global record-keeping system as domain name registrars do and/or domain registrar-mediated challenge to prove ownership (control panel login / authenticated API calls, not just adding some spoofable TXT record cookie or link in an email). End MITM by rogue certs, at a minimum.
    - 0x0 11y ago
      Yes, exactly. The registrar would be the obvious place for CA issuance - by definition your account there proves your ownership. Heck, make it a requirement that registrars issue free SSL certificates as part of the domain registation service and we might even get to the https-everywhere world that seems to be in vogue. Double bonus if this can be engineered with a technical guarantee/verification that only the proper registrar for a domain is a valid CA for it.
- nly 11y ago
  It doesn't really matter. Most people are only getting their CA certs through domain validation anyhow, so you're already at the mercy of registrars and TLDs. DANE actually reduces the people you need to trust. Hell, some CAs will issue a cert for a domain to anyone who can write to the docroot on the webserver it points to. Grabbing one before a malicious entity and deploying HSTS and HPKP is your only weak defence.
- AndyMcConachie 11y ago
  There seems to be this mistaken belief that DNSSEC/DANE are intended to replace CAs. There is no such idea. I wrote about this recently if you're interested. http://metafarce.com/adventures-in-dane/ http://metafarce.com/adventures-in-dane/ "..the purpose of DANE is not to do away with the CA system. It is to provide another chain of trust based on the DNS hierarchy."
  - inopinatus 11y ago
    If only intentions made the world go round. But how we use things, and build upon them, is often rather more interesting than what someone intended. The commercial CAs will be a relic. It's only a matter of time before the whole house of cards collapses. The price pressure has been downwards for years. EV is not meaningful to most end-users, remaining a money-printing scam that provides little assurance of safety (if Enron, or Ashley Madison could get one, what's it worth?), and is vulnerable to MITM and rebinding attacks[1]. I anticipate that Amazon's CA[2] could undermine the profitability - and via desperation, the integrity - of the whole sector even further. [1] http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA... [2] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer...
    - realityking 11y ago
      How is it relevant that Enron or Ashley Madison could get EV certificates? They are intended to proof that you're communicating with whom you intended to communicate. They make no claim about the trustworthiness of the company itself (and how would you even test that?)
idlewords 11y ago
You really think that giving Libya the keys to bit.ly, for example, is a step forward?
- toast0 11y ago
  Doesn't Libya already have the keys? They can redelgate the zone and get a domain controlled cert. Or probably something more subtle with selective who is responses.
  - tptacek 11y ago
    No! Choosing a .LY name for your website does not give the government of Libya your TLS keys. With DNSSEC, that could change.
    - toast0 11y ago
      If the operator of .LY might takeover the domain to return DANE records that it controls, why wouldn't it takeover the domain and procure a domain validated certificate from a CA? For extra sneakyness, they could probably return the regular glue records and whois information to most requestors, and poisoned values to the targeted CA, to get the certificate up an running in advance of hijacking the domain in general.
      - tptacek 11y ago
        CAs are insecure. Nobody is arguing otherwise. The problem is that you can't mitigate insecure CAs by adding a new set of irrevocable government-controlled CAs. That's the point 'idlewords is making. Right now, the DNS does not function as a sort of distributed CA. But that's exactly what DNSSEC asks it to do.
        toast0 11y ago
        For domain validated certificates, the DNS does essentially function as a sort of distributed CA; if you control the DNS for a domain, you can get the certificate issued: this isn't insecure, it's by design. Unless we're talking about removing domain validated certificates, I don't see why explicitly treating DNS as a CA, when it's a de facto CA is a problem. I'm not sure how we can get to HTTPS everywhere without domain validated certificates?

aianus 11y ago

https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...

0x0 11y ago
So after all those years of x509/asn1/openssl bugs and ca breaches we are left with... ~/.ssh/known_hosts reimplemented, poorly? :-}

nailer 11y ago

That's what HPKP and certificate transparency are for. Google also require certificate transparency for all EV certs.

chetanahuja 11y ago

"The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything" It boggles the mind that all these security experts (including those frequenting these forums) take such pains over obscure, hard to exploit things (like about half the CVE vulns), and come down with the fury of a thousand suns on anyone daring to come up with, say a new secure messaging protocols without their permission (remember the Telegram brouhaha) and yet blithely go on endorsing and even encouraging this totally broken third party trust system, this house of cards that the entire web security framework is built on. Just baffling.

Zigurd 11y ago
Many security consultants sell "security" out one door and surveillance/forensics out the other door. Only one of those businesses sells a working product/service.