7 ms·

> Even if you pick a trustworthy CA, you're at the mercy of the weakest link (any random other CA elsewhere in the world). This was solved RFC 2692 & 2693, in

by wtbob 10y ago

> Even if you pick a trustworthy CA, you're at the mercy of the weakest link (any random other CA elsewhere in the world). This was solved RFC 2692 & 2693, in 1999, and the entire industry has studiously ignored the solution and refused to use it. Had we paid attention, DNS would be secure — truly secure. But we don't, and every month we see another issue. Why? Cui bono?

tptacek 10y ago
This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. The problem with the CA system isn't technical (even though X.509 truly does suck), but institutional: you can't have a single central authority handling all of Internet trust (it doesn't scale well, and it [rightfully!] alarms people), but if you have more then one, a market forms and generates a race to the bottom. Whether your certificates are sexprs or ASN.1, and no matter how many new features you bake into them, you're still going to have to solve the Internet trust distribution problem. The last thing in the universe you want is for Internet trust to somehow back out into the DNS. http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/
- 0x0 10y ago
  Not sure I agree with the DNSSEC rant. What we trust implicitly are the registrars (and they already manage the NS records for your domain even if you run your own primary DNS server), and the TLD and root-zone operators. If you cannot trust the registrars, then all is lost, because if your registrar account is breached (or your registrar is playing tricks on you), then whoever breached your registrar account (or, the registrar itself in case it's backstabbing you) is easily able to validate against any existing CA and obtain a HTTPS certificate. There is no additional security gained by having the CA roots external to the registrars, but it opens a huge avenue for attackers to obtain certificates without breaching your registrar, whether we're talking rogue CAs or evil TLDs. By merging the registrar and CA role (and preferably ensuring that for any given domain, the CA === the domain registrar), you eliminate all unrelated venues of attack. But you've always needed to trust your registrar (and TLD+root-zone operator). TL;DR: If DNS is untrustworthy then so is the current broken CA system because it emails validation tokens based on DNS MX records.
  - tptacek 10y ago
    The post directly addresses this concern. I'll stick by those arguments. But I'll add these: by merging the registrar and the CA role, two things immediately happen: * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites, including (along with the COMs and NETs and CO.UKs) every .IO host. * It immediately becomes impossible for Google to use CA-level revocation to punish shenanigans (Google can't "revoke" .COM, or, for that matter, leave it.) It is mind-boggling to me that a community that is so animated by the Snowden disclosures and the leaks of the Equation Group exploits could entertain the idea of DNSSEC even for a moment.
    - 0x0 10y ago
      If registrars were the only valid CA for a domain and clients could somehow validate this, then we'd remove the "insecure SMTP" from the equation. Also I wouldn't mind people thinking twice about the implications of using .ly and others as their home on the internet. Why shouldn't geopolitical TLDs mean something? It would allow end users to make a more informed decision on trusting a particular website, more than today's system. We would still allow multiple registars for both generic TLDs and national TLDs. And Google could very well implement a blacklist for registrars that have turned out to be mischievous, similar to the safe browsing service they already have. Or the TLD operators could kick out the unserious registrars from their TLD registry. And domain registrants would shun unserious registrars like crazy if google started blacklisting particular registrars. Edit: To clarify, a "registrar" is not a TLD operator but one of many companies with access to the TLD database, taking domain registrations on behalf of the TLD. I think it's important that TLDs still delegate registration to multiple independent, approved registrars like it is today. Edit2: Today, you are trusting: (#1.) that the registrar or TLD operator or root zone operator doesn't fool around with your NS records or they could redirect SSL purchases to themselves for your domain and (#2.) that not a single CA in the world produces an improper certificate for your domain regardless of #1. With my suggestion, you no longer need to trust #2, but you still need to trust #1. Which is better than today's situation.
    - AndyMcConachie 10y ago
      Could you elaborate on the link between DNSSEC and the FVEY? > * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites, including (along with the COMs and NETs and CO.UKs) every .IO host. Please prove the above assertion. Everytime I see you post something about DNSSEC I ask you these same questions and I've never gotten a response from you that elucidates this link. What is it exactly about DNSSEC that you think it gives controls to world governments? Spell it out for me in as much detail as possible.
- wtbob 10y ago
  > This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. You're not the only one, and that's the problem. It has been, for nearly twenty years now. > The problem with the CA system isn't technical (even though X.509 truly does suck), but institutional: you can't have a single central authority handling all of Internet trust (it doesn't scale well, and it [rightfully!] alarms people), but if you have more then one, a market forms and generates a race to the bottom. The problem is that we already have a single point of truth: ICANN. And the problem is that we have multiple points of truth: every single CA out there is trusted for the entire Internet. If you trust letsencrypt, you ultimately rely on ICANN. If you trust StartSSL, you ultimately rely on ICANN. The virtue of SPKI is that it forces one to be honest with oneself. The owner of com really does own every single hostname under com; why not be honest about that? The owner of cn really does own every single hostname under cn; why not be honest about that? Why create a system where entities who can be legally compelled by any two-bit nation-state which can pay for a guy with a rubber hose are trusted for the entire world, rather than only for their two-bit nation-states? Government-controlled PKI doesn't bother me, because ultimately every PKI is controlled by governments, because governments have a monopoly on force. AC Camerfirma S.A. is in my certstore; they are a firm in the Kingdom of Spain, and the King or any of his government are at liberty to compel AC Camerfirma S.A. to produce a certificate for google.com or news.ycombinator.com at any time they wish. So I am trusting the King of Spain and his government with the security of my connexion to Google, an Alphabet company with servers located in the U.S. That's … insane. Per your article's comment, 'Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys': Gaddafi did ultimately control bit.ly's TLS keys, as indicated in 2010 when his government shut down vb.ly. They could have, had they wished, pointed that domain name at servers they controlled and requested a StartSSL certificate; today they could do the same for a letsencrypt cert. DNSSEC is probably a mistake for other reasons, but a SPKI-based system in which hosts received certificates from their domain name providers, from their IP address providers and from their legal places of registration would have been superior to our current system, in which any host may be certified by any CA anywhere.

by wtbob 10y ago

tptacek 10y ago

This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. The problem with the CA system isn't technical (even though X.509 truly does suck), but institutional: you can't have a single central authority handling all of Internet trust (it doesn't scale well, and it [rightfully!] alarms people), but if you have more then one, a market forms and generates a race to the bottom. Whether your certificates are sexprs or ASN.1, and no matter how many new features you bake into them, you're still going to have to solve the Internet trust distribution problem. The last thing in the universe you want is for Internet trust to somehow back out into the DNS. http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/

0x0 10y ago
Not sure I agree with the DNSSEC rant. What we trust implicitly are the registrars (and they already manage the NS records for your domain even if you run your own primary DNS server), and the TLD and root-zone operators. If you cannot trust the registrars, then all is lost, because if your registrar account is breached (or your registrar is playing tricks on you), then whoever breached your registrar account (or, the registrar itself in case it's backstabbing you) is easily able to validate against any existing CA and obtain a HTTPS certificate. There is no additional security gained by having the CA roots external to the registrars, but it opens a huge avenue for attackers to obtain certificates without breaching your registrar, whether we're talking rogue CAs or evil TLDs. By merging the registrar and CA role (and preferably ensuring that for any given domain, the CA === the domain registrar), you eliminate all unrelated venues of attack. But you've always needed to trust your registrar (and TLD+root-zone operator). TL;DR: If DNS is untrustworthy then so is the current broken CA system because it emails validation tokens based on DNS MX records.
- tptacek 10y ago
  The post directly addresses this concern. I'll stick by those arguments. But I'll add these: by merging the registrar and the CA role, two things immediately happen: * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites, including (along with the COMs and NETs and CO.UKs) every .IO host. * It immediately becomes impossible for Google to use CA-level revocation to punish shenanigans (Google can't "revoke" .COM, or, for that matter, leave it.) It is mind-boggling to me that a community that is so animated by the Snowden disclosures and the leaks of the Equation Group exploits could entertain the idea of DNSSEC even for a moment.
  - 0x0 10y ago
    If registrars were the only valid CA for a domain and clients could somehow validate this, then we'd remove the "insecure SMTP" from the equation. Also I wouldn't mind people thinking twice about the implications of using .ly and others as their home on the internet. Why shouldn't geopolitical TLDs mean something? It would allow end users to make a more informed decision on trusting a particular website, more than today's system. We would still allow multiple registars for both generic TLDs and national TLDs. And Google could very well implement a blacklist for registrars that have turned out to be mischievous, similar to the safe browsing service they already have. Or the TLD operators could kick out the unserious registrars from their TLD registry. And domain registrants would shun unserious registrars like crazy if google started blacklisting particular registrars. Edit: To clarify, a "registrar" is not a TLD operator but one of many companies with access to the TLD database, taking domain registrations on behalf of the TLD. I think it's important that TLDs still delegate registration to multiple independent, approved registrars like it is today. Edit2: Today, you are trusting: (#1.) that the registrar or TLD operator or root zone operator doesn't fool around with your NS records or they could redirect SSL purchases to themselves for your domain and (#2.) that not a single CA in the world produces an improper certificate for your domain regardless of #1. With my suggestion, you no longer need to trust #2, but you still need to trust #1. Which is better than today's situation.
  - AndyMcConachie 10y ago
    Could you elaborate on the link between DNSSEC and the FVEY? > * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites, including (along with the COMs and NETs and CO.UKs) every .IO host. Please prove the above assertion. Everytime I see you post something about DNSSEC I ask you these same questions and I've never gotten a response from you that elucidates this link. What is it exactly about DNSSEC that you think it gives controls to world governments? Spell it out for me in as much detail as possible.
wtbob 10y ago
> This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. You're not the only one, and that's the problem. It has been, for nearly twenty years now. > The problem with the CA system isn't technical (even though X.509 truly does suck), but institutional: you can't have a single central authority handling all of Internet trust (it doesn't scale well, and it [rightfully!] alarms people), but if you have more then one, a market forms and generates a race to the bottom. The problem is that we already have a single point of truth: ICANN. And the problem is that we have multiple points of truth: every single CA out there is trusted for the entire Internet. If you trust letsencrypt, you ultimately rely on ICANN. If you trust StartSSL, you ultimately rely on ICANN. The virtue of SPKI is that it forces one to be honest with oneself. The owner of com really does own every single hostname under com; why not be honest about that? The owner of cn really does own every single hostname under cn; why not be honest about that? Why create a system where entities who can be legally compelled by any two-bit nation-state which can pay for a guy with a rubber hose are trusted for the entire world, rather than only for their two-bit nation-states? Government-controlled PKI doesn't bother me, because ultimately every PKI is controlled by governments, because governments have a monopoly on force. AC Camerfirma S.A. is in my certstore; they are a firm in the Kingdom of Spain, and the King or any of his government are at liberty to compel AC Camerfirma S.A. to produce a certificate for google.com or news.ycombinator.com at any time they wish. So I am trusting the King of Spain and his government with the security of my connexion to Google, an Alphabet company with servers located in the U.S. That's … insane. Per your article's comment, 'Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys': Gaddafi did ultimately control bit.ly's TLS keys, as indicated in 2010 when his government shut down vb.ly. They could have, had they wished, pointed that domain name at servers they controlled and requested a StartSSL certificate; today they could do the same for a letsencrypt cert. DNSSEC is probably a mistake for other reasons, but a SPKI-based system in which hosts received certificates from their domain name providers, from their IP address providers and from their legal places of registration would have been superior to our current system, in which any host may be certified by any CA anywhere.