4 ms·

I had a co-worker who was pushing for certs that were only valid for a day, or for hours or even minutes. It would solve the whole problem of revocation.

by krupan 6y ago

dotancohen 6y ago
Is he not aware of OCSP Stapling? It's very much a solved issue, as the same CA authorization can be presented to multiple clients.
t0astbread 6y ago
You have to draw the line somewhere. Daily certs would probably increase the load for CAs by a lot. Also, energy consumption for certificate management would increase.
- easton 6y ago
  How compute intensive is a CA, anyway? I’d think that a few Raspberry Pi-ish devices would be enough to do it for an entire enterprise (or maybe even one, but fault tolerance).
  - t0astbread 6y ago
    In general I would assume when you shorten certificate validity from 90-ish days to one the computational resources required for issuance will increase to about 90x of what it was before. So it would be a lot more expensive to run. Also, unrelated to that argument but I think the most expensive part in a CA is not issuance but rather OCSP since an OCSP query could happen with every TLS connection (although stapling exists to solve that). OCSP would not be affected by a shortening of validity periods.
algesten 6y ago
When I've implemented JWT in the past (yes, I know, "don't use JWT"), I've opted for public/private signatures. The public cert I would publish on some URL for all consumers of the JWT to use. The rotation of certs there was a matter of hours. It would hold 3-4 of the last certs (depending on JWT lifetime).
- fireant 6y ago
  What's wrong with using JWTs? What you have done should be industry standard and is enabled by the JWK spec. In fact several features of OpenID Connect are built upon signed JWTs from a well-known JWK store.
  - Dylan16807 6y ago
    https://www.howmanydayssinceajwtalgnonevuln.com/ https://www.howmanydayssinceajwtalgnonevuln.com/ Having such a tempting footgun is a real problem.
    - fireant 6y ago
      The problem I think is that JWT is just a small puzzle piece of a great artwork that is identity and auth. It is overly complex (not without reason) and people don't put in enough effort to learn the whole picture (and it just isn't thought in schools) and just want to use something quickly for their current problem. Which is why they pick JWT and don't understand the host of related technologies - OAuth2, OIDC, JWK, JWE - just to name a few. I don't see a reason why I would ever want to use auth=none for anything as at that point JWT is just base64 encoded json but I may be too deep in the identity world by now.
viraptor 6y ago
Openstack Anchor aimed for that. No problem with revocation if your certificates last a day, are fully automated, and issuing is validated by network https://wiki.openstack.org/wiki/Security/Projects/Anchor https://wiki.openstack.org/wiki/Security/Projects/Anchor
supertrope 6y ago
So like Kerberos?

I had a co-worker who was pushing for certs that were only valid for a day, or for hours or even minutes. It would solve the whole problem of revocation.

by krupan 6y ago

I had a co-worker who was pushing for certs that were only valid for a day, or for hours or even minutes. It would solve the whole problem of revocation.

dotancohen 6y ago

Is he not aware of OCSP Stapling? It's very much a solved issue, as the same CA authorization can be presented to multiple clients.

t0astbread 6y ago

You have to draw the line somewhere. Daily certs would probably increase the load for CAs by a lot. Also, energy consumption for certificate management would increase.

easton 6y ago
How compute intensive is a CA, anyway? I’d think that a few Raspberry Pi-ish devices would be enough to do it for an entire enterprise (or maybe even one, but fault tolerance).
- t0astbread 6y ago
  In general I would assume when you shorten certificate validity from 90-ish days to one the computational resources required for issuance will increase to about 90x of what it was before. So it would be a lot more expensive to run. Also, unrelated to that argument but I think the most expensive part in a CA is not issuance but rather OCSP since an OCSP query could happen with every TLS connection (although stapling exists to solve that). OCSP would not be affected by a shortening of validity periods.

algesten 6y ago

When I've implemented JWT in the past (yes, I know, "don't use JWT"), I've opted for public/private signatures. The public cert I would publish on some URL for all consumers of the JWT to use. The rotation of certs there was a matter of hours. It would hold 3-4 of the last certs (depending on JWT lifetime).

fireant 6y ago
What's wrong with using JWTs? What you have done should be industry standard and is enabled by the JWK spec. In fact several features of OpenID Connect are built upon signed JWTs from a well-known JWK store.
- Dylan16807 6y ago
  https://www.howmanydayssinceajwtalgnonevuln.com/ https://www.howmanydayssinceajwtalgnonevuln.com/ Having such a tempting footgun is a real problem.
  - fireant 6y ago
    The problem I think is that JWT is just a small puzzle piece of a great artwork that is identity and auth. It is overly complex (not without reason) and people don't put in enough effort to learn the whole picture (and it just isn't thought in schools) and just want to use something quickly for their current problem. Which is why they pick JWT and don't understand the host of related technologies - OAuth2, OIDC, JWK, JWE - just to name a few. I don't see a reason why I would ever want to use auth=none for anything as at that point JWT is just base64 encoded json but I may be too deep in the identity world by now.

viraptor 6y ago

Openstack Anchor aimed for that. No problem with revocation if your certificates last a day, are fully automated, and issuing is validated by network https://wiki.openstack.org/wiki/Security/Projects/Anchor https://wiki.openstack.org/wiki/Security/Projects/Anchor

supertrope 6y ago

So like Kerberos?