3 ms·

Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs. DANE is, unfortunate

Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs. DANE is, unfortunately, not viable to implement in browsers right now for a variety of reasons: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html

lifthrasiir 7y ago
> Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs. CT makes such an attack obvious, but the harm can't be undone. A case study: root certificates for the GPKI, the South Korean governmental CA primarily used for public institutions, are not included in most browsers except for maybe IE [1] but frequently trusted due to (still) prevalent uses of ActiveX controls. It is of course subject to CA/B Forum baseline requirements [2] and publishes CT records, so you may guess their "accidentally" invalid wildcard certificates [3] are quickly spotted... Heck no! It was only noticed 3 years later [4]. No one knows what happened in this period. [1] For example, Firefox doesn't include it: https://bugzilla.mozilla.org/show_bug.cgi?id=1377389 https://bugzilla.mozilla.org/show_bug.cgi?id=1377389 [2] https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ [3] For example, https://crt.sh/?id=6990343 https://crt.sh/?id=6990343 contains a public suffix `.co.kr` (comparable to `.com`). Note that the BR contains very strong requirements for such public suffixes, which the GPKI didn't follow. [4] https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArticle.do?bbsId=BBSMSTR_000000000009&nttId=62842 https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArti...

3 ms·

Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs. DANE is, unfortunate

by Ajedi32 7y ago

lifthrasiir 7y ago
> Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs. CT makes such an attack obvious, but the harm can't be undone. A case study: root certificates for the GPKI, the South Korean governmental CA primarily used for public institutions, are not included in most browsers except for maybe IE [1] but frequently trusted due to (still) prevalent uses of ActiveX controls. It is of course subject to CA/B Forum baseline requirements [2] and publishes CT records, so you may guess their "accidentally" invalid wildcard certificates [3] are quickly spotted... Heck no! It was only noticed 3 years later [4]. No one knows what happened in this period. [1] For example, Firefox doesn't include it: https://bugzilla.mozilla.org/show_bug.cgi?id=1377389 https://bugzilla.mozilla.org/show_bug.cgi?id=1377389 [2] https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ [3] For example, https://crt.sh/?id=6990343 https://crt.sh/?id=6990343 contains a public suffix `.co.kr` (comparable to `.com`). Note that the BR contains very strong requirements for such public suffixes, which the GPKI didn't follow. [4] https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArticle.do?bbsId=BBSMSTR_000000000009&nttId=62842 https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArti...