3 ms·

I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new b

I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.

WorldMaker 6y ago
Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now expired root can you? If you restrict it to the subset of time where both roots are unexpired, you have the exact same problem as the intermediate game that the BBC has to play in the article.
- GoblinSlayer 6y ago
  Same as with the browser update: you receive it before the previous certificate expired.
  - WorldMaker 6y ago
    Most of this article is about the pain caused by that we cannot assume devices will update in years. There's no window you can set for both certificates to be valid side-by-side that will be long enough to update every device. Again, roots are already cross-signed and the article points out they still take 2+ years to pass other validity checks for root adoption. Even if they "virally" propagated in this manner after all those checks passed, there are plenty of devices that are only powered on once a year or less; there are a lot of devices whose support lifetimes for any upgrades at all are less than 2 years (that's a specific call in the article: we need security support lifetimes extended to decades at least, probably). If they propagate "virally" you have a lot of questions of whether or not a device will even see that there is an updated certificate. Not every user or device visits a web page in a certificate chain to any given root routinely much less ever. Comments to this article even point out that there is a semi-viral update process already in place in most browsers called AIA chasing, where certificates may point to URLs to look up their parent authorities, and Mozilla intentionally doesn't AIA chase because it's very definitely a privacy risk, even if you don't agree that it is a security risk (bad certificates sending you to bad URLs). The security risk is why the browsers that do AIA chasing only allow it for intermediate certificates and will not trust new roots found by AIA chasing.

WorldMaker 6y ago

Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now expired root can you? If you restrict it to the subset of time where both roots are unexpired, you have the exact same problem as the intermediate game that the BBC has to play in the article.

GoblinSlayer 6y ago
Same as with the browser update: you receive it before the previous certificate expired.
- WorldMaker 6y ago
  Most of this article is about the pain caused by that we cannot assume devices will update in years. There's no window you can set for both certificates to be valid side-by-side that will be long enough to update every device. Again, roots are already cross-signed and the article points out they still take 2+ years to pass other validity checks for root adoption. Even if they "virally" propagated in this manner after all those checks passed, there are plenty of devices that are only powered on once a year or less; there are a lot of devices whose support lifetimes for any upgrades at all are less than 2 years (that's a specific call in the article: we need security support lifetimes extended to decades at least, probably). If they propagate "virally" you have a lot of questions of whether or not a device will even see that there is an updated certificate. Not every user or device visits a web page in a certificate chain to any given root routinely much less ever. Comments to this article even point out that there is a semi-viral update process already in place in most browsers called AIA chasing, where certificates may point to URLs to look up their parent authorities, and Mozilla intentionally doesn't AIA chase because it's very definitely a privacy risk, even if you don't agree that it is a security risk (bad certificates sending you to bad URLs). The security risk is why the browsers that do AIA chasing only allow it for intermediate certificates and will not trust new roots found by AIA chasing.