5 ms·

Given that there seems to be no security impact (and none expected in the next year or two)... Curious why everyone doesn’t agree to use 64 bits in future and

Given that there seems to be no security impact (and none expected in the next year or two)... Curious why everyone doesn’t agree to use 64 bits in future and just let the mis-issued certs live out their natural life? Seems to create a lot of busywork for lots of people for no discernible benefit?

mmastrac 8y ago
No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/nlN_QrDwgaw/cg_v-VY0AQAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.
- geofft 8y ago
  The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as conventionally defined. The "trust" part is "can you pass audits and generally be technically and organizationally competent to not let your private key be stolen / your infrastructure be abused by an attacker." Individual employees are part of the threat model, so there's usually a two-person rule for access to the private key; entire malicious organizations willing to lie in public and cover their tracks are not envisioned by the model.) So people are trying to block their application by nitpicking technical mistakes that, by the letter of the Baseline Requirements, disqualify you from being a CA. https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups... covers some background on DarkMatter. One of the Baseline Requirements is you may not issue certs with fewer than 64 bits of entropy. Turns out DarkMatter was doing that, by issuing certs with 63 bits of entropy. Also turns out this was a thing lots of CAs did. Now that it's been pointed out publicly....
  - im3w1l 8y ago
    I know nothing about DarkMatter so this may nor may not be justified but I just want to make the point that they could be kicked out if they actually did make MITM certs. There are certificate comparison programs that try to spot them.
    - ethbro 8y ago
      Are there any that cover the one-in-a-million targeted MitM scenario? My understanding of current cert transparency efforts was that they wouldn't catch "we fingerprinted your connection, identified you, and are just injecting a malicious cert for you" scenarios. And were more targeted at the "rouge / misconfigured CA signing half the internet" to any client mishap.
      - geofft 8y ago
        Mandatory CT does actually solve that: if a browser won't trust a cert without seeing it include a signed certificate timestamp from a trusted log, then the CA has to disclose certs, even if they're only targeting one user. But most people don't have e.g. Expect-CT set up, so it's not clear it would help on a majority of sites. (One reasonable option would be to require certs from DarkMatter, and really every CA going forward, to have SCTs in their certs, and enforce that with a flag in the root store. But if there's a concern about DarkMatter specifically, it's probably better to phrase a change to the root store policies that say "We won't accept CAs we just don't trust" instead of waiting for them to misbehave and then rescinding their membership.)
        isostatic 8y ago
        > it's probably better to phrase a change to the root store policies that say "We won't accept CAs we just don't trust" instead of waiting for them to misbehave and then rescinding their membership Unless you can define the policies up front that's a very risky road to go down. Why refuse to trust DarkMatter, but not refuse to trust China Bank?
    - geofft 8y ago
Buge 8y ago
The reason for the urgent fixes is to promote uniformly applied rules. There are certain predefined rules that CAs need to follow, regardless of whether the individual rules help security or not. The rules say the certs that are badly formed need to be reissued in 5 days. If these rules are not followed and no penalties are applied, then later on when other CAs make more serious mistakes they'll point to this and say "Apple and Google got to disobey the rules, so we should as well, otherwise it's favoritism to Apple and Google."

mmastrac 8y ago

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/nlN_QrDwgaw/cg_v-VY0AQAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

geofft 8y ago
The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as conventionally defined. The "trust" part is "can you pass audits and generally be technically and organizationally competent to not let your private key be stolen / your infrastructure be abused by an attacker." Individual employees are part of the threat model, so there's usually a two-person rule for access to the private key; entire malicious organizations willing to lie in public and cover their tracks are not envisioned by the model.) So people are trying to block their application by nitpicking technical mistakes that, by the letter of the Baseline Requirements, disqualify you from being a CA. https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups... covers some background on DarkMatter. One of the Baseline Requirements is you may not issue certs with fewer than 64 bits of entropy. Turns out DarkMatter was doing that, by issuing certs with 63 bits of entropy. Also turns out this was a thing lots of CAs did. Now that it's been pointed out publicly....
- im3w1l 8y ago
  I know nothing about DarkMatter so this may nor may not be justified but I just want to make the point that they could be kicked out if they actually did make MITM certs. There are certificate comparison programs that try to spot them.
  - ethbro 8y ago
    Are there any that cover the one-in-a-million targeted MitM scenario? My understanding of current cert transparency efforts was that they wouldn't catch "we fingerprinted your connection, identified you, and are just injecting a malicious cert for you" scenarios. And were more targeted at the "rouge / misconfigured CA signing half the internet" to any client mishap.
    - geofft 8y ago
      Mandatory CT does actually solve that: if a browser won't trust a cert without seeing it include a signed certificate timestamp from a trusted log, then the CA has to disclose certs, even if they're only targeting one user. But most people don't have e.g. Expect-CT set up, so it's not clear it would help on a majority of sites. (One reasonable option would be to require certs from DarkMatter, and really every CA going forward, to have SCTs in their certs, and enforce that with a flag in the root store. But if there's a concern about DarkMatter specifically, it's probably better to phrase a change to the root store policies that say "We won't accept CAs we just don't trust" instead of waiting for them to misbehave and then rescinding their membership.)
      - isostatic 8y ago
        > it's probably better to phrase a change to the root store policies that say "We won't accept CAs we just don't trust" instead of waiting for them to misbehave and then rescinding their membership Unless you can define the policies up front that's a very risky road to go down. Why refuse to trust DarkMatter, but not refuse to trust China Bank?
  - geofft 8y ago

Buge 8y ago

The reason for the urgent fixes is to promote uniformly applied rules. There are certain predefined rules that CAs need to follow, regardless of whether the individual rules help security or not. The rules say the certs that are badly formed need to be reissued in 5 days. If these rules are not followed and no penalties are applied, then later on when other CAs make more serious mistakes they'll point to this and say "Apple and Google got to disobey the rules, so we should as well, otherwise it's favoritism to Apple and Google."