8 ms·

DigiNotar root CA trust removal follow-up

guelo 15y ago
DigiNotar's complete collapse is intriguing. Doing a little Googling I noticed that they just got acquired 8 months ago http://www.vasco.com/company/press_room/news_archive/2011/acquisition_diginotar.aspx http://www.vasco.com/company/press_room/news_archive/2011/ac... That investment is not looking very good for Vasco right now. It would be interesting to know the backstory here. I wouldn't be surprised if something about the acquisition caused all the engineers to jump ship. Their one press release seems to be begging the Dutch government to provide staff http://www.sacbee.com/2011/09/02/3881380/vasco-offers-dutch-government.html http://www.sacbee.com/2011/09/02/3881380/vasco-offers-dutch-...
- alastairpat 15y ago
  They have put out a statement[1], although it's in Dutch. Assuming Google's translation conveys the gist and tone of it, they seem more irritated that the browser vendors are removing the root certificates than anything else. [1] http://www.diginotar.nl/Actueel/tabid/264/articleType/ArticleView/articleId/327/Default.aspx http://www.diginotar.nl/Actueel/tabid/264/articleType/Articl...
  - X-Istence 15y ago
    That is exactly what the article comes over as. They seem to be annoyed with the fact that their roots were being pulled when they claim only a single subroot was compromised. They are willing to give people new certificates chained to the PKIOverheid, but that comes with the rules and requirements of those certs, and looking at later news it sounds like the Dutch government has revoked their access to that and will be taking over.
  - Michiel 15y ago
    This: "Gebruikers van SSL certificaten kunnen afhankelijk van de desbetreffende browserleverancier geconfronteerd worden met een mededeling dat het certificaat niet vertrouwd wordt. Dit is in 99,9% van de gevallen onjuist, het certificaat kan wel worden vertrouwd. Dit kan handmatig door de gebruiker zelf worden aangegeven in de browser (hiervoor kunt u terecht op de FAQ op onze website)." Translates (roughly) to this: Depending on the browsers a user of SSL certificates may be confronted with a message stating the certificate is not trusted. In 99.9% of the cases this is not correct, the certificate can be trusted. The user can do this manually using his browser (see our FAQ). --- Given the situation I don't think that is the right message. I think people should not be told that 99.9% of certificates can be trusted even though their computer says no.
    - stingraycharles 15y ago
      That's terrible that they're saying that. You would expect a CA to be the last person to try to educate others to ignore those warnings. It kind of undermines their whole reason of existence.
      - marshray 15y ago
        One explanation is that they just don't understand that. Another is that they don't give a flip about their CA business at this point because it's just a liability to them that they wish would just go away. If they're going to have any customer left after this it's going to be gov.nl, who seems to prefer having a pwned CA to re-rooting their whole PKI setup.
- sjmulder 15y ago
  There was a live press conference on Dutch TV a few hours ago (“this broadcast is being interrupted…”) stating pretty much what’s written in this article: An audit revealed that the government certificates may have been compromised and thus these have all been revoked. The government will take control over DigiNotar and will quickly replace all existing certificates.
  - joelhaasnoot 15y ago
    It has now gotten to the point where Digid, the Dutch e-government single sign on has is basically saying "We're not secure" http://www.digid.nl/nieuws/artikel/artikel/89/ http://www.digid.nl/nieuws/artikel/artikel/89/. Very honest stance, and certificates are to be replaced. For the backstory, this conference was at 00:30, and interrupting the public channels only happens when there's big news, plane crashes, etc.
- marshray 15y ago
  Other than gov.nl, their certs are only on a few hundred web servers. They likely didn't have the revenue to support even a single full-time person.
  - blauwbilgorgel 15y ago
    Their certs are also baked into hardware and a large part of the Dutch e-Government. Diginotar has more than 10 employees. They do other things than merely signing certs. Size of the company doesn't really matter too. If it matters we would have a single CA. Apparently even my new passport is signed by the Diginotar PKI. I'm wondering when this will be big news in Holland.
    - marshray 15y ago
      A full time person dedicated to the certificate business I was trying to say.
SoftwareMaven 15y ago
Would Mozilla (or any browser vendor) really remove them if they had 20% of the cert market? That will be an interesting test.
- Skalman 15y ago
  Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't followed) But if a CA was compromised and they didn't know the how many certificates they had issued, surely they'd have to block the root cert, if not permanently?
  - dmethvin 15y ago
    If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.
    - Skalman 15y ago
      True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
      - marshray 15y ago
        Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.
nikcub 15y ago
DigiNotar should never have been a top-level CA. They should have been a third-party CA underneath Verisign or somebody similar, with only a right to sign and verify certain certificates. This is how most banks are setup. There are far, far too many trusted top-level cert CA's now. The list was 3-4 long years ago, and was designed with third-party CA's just for this reason. Today you have a huge list and it changes every month
- tptacek 15y ago
  You probably know something about certificates I don't, but as I understand the code that handles this stuff, your certificate either has CA=YES or CA=NO in its basicConstraints; if it's CA=YES, you're a CA full stop. It's the combination of having that bit -- err, DER boolean -- set and chaining to browser root cert that makes you a CA. There isn't a provision in the scheme for them to do less than be able to sign Google, which is why the CA system is so brittle and broken. What is the bank setup that you're thinking about? I didn't think that BankOfAmerica.com could sign its own certs for CNs under BankOfAmerica.com. Our customers include large banks and they bitch about having to work with Verisign just like everyone else.
  - nikcub 15y ago
    My experience is from 10 years ago, where I set this up for a startup I worked at. This was the situation: we had built a platform for trade finance. It was like eBay but for trade paper. eg. somebody is exporting $80M worth of oil, and they need a bank to finance it. We had 500+ banks from around the world on the platform, and they would all bid for the business. Because we were dealing with hundreds of millions of dollars worth of commitments, we needed a certificate architecture that would verify the seller, the buyer, and for each of those parties to verify the site. I went to Verisign and asked them for the best solution, and this is what they setup: - we had a Verisign terminal setup in the office. This was a normal computer, but locked down to only run Verisign software. It was a flavor of UNIX - the terminal had a smart-card reader on it, and a private net connection that went only back to Verisign. - the authentication to login to the computer was two passwords, both with secure tokens, and two smart cards - when you login, you do the ID shuffle, which involved two people who had background checks conducted on them etc. - we generate a certificate, which is then signed using a sub-CA certificate that Verisign issues to us - Our certificate thus acted as a CA, but it was authorized by Verisign, so the certs that we signed would then check out using the built-in browser CA certs This cost us hundreds of thousands of dollars to setup, and cost us hundreds of dollars for each cert we signed. When I did the due dilligence on the solution, I visited 3 london-based banks who had implemented the same system. The selling point was that we could act as a CA, but without really being a CA. Verisign's sales pitch was that you could never become the root CA because of the stringent policies that had to be put in place (isolated networks, key generation, etc.), but for the fraction of the cost, we could sign certs using our cert which would be verified up the chain to the root CA which was Verisign I can't stress how secure this whole procedure was. The root CA store was the holy grail - nobody that did't have the infrastructure or procedures like Verisign would get anywhere near it. I now read stories 10 years later of dodgy dutch companies with no budgets being given root CA privileges, and I am just blown away. If these guys needed a solution to sign certs, they should have been setup with what we had, and what the other banks had, not just given placement in the root cert store. Verisign would check and double-check everything we did, and would frequently revert certs we signed where they suspected something was wrong. With this story it seems there was a completely amateur operation given privileges to sign certs as part of a root CA. I have 163 root CA certs on my OS X machine. 10 years ago I am certain the number was 4 or 5 note: this was so long ago that I probably have some of my terminology mixed up, but what we bought was the right to sign certs as a sub-CA of Verisign, a privileged root CA. I also got a very cool tour of Verisign which is another story.
crististm 15y ago
Nobody seems to ask why should I trust DigiNotar or Verisign or whatever? I do not know them myself to trust them in the first place. So why should I trust them through Mozilla? Or Google? I don't know enough to trust them either... The whole pyramid trust scheme is broken.
- bzbarsky 15y ago
  If you don't trust your browser, then you've already lost, since your browser ipso facto sees the unencrypted form of all your web traffic, both incoming and outgoing. Not only that, but it's running native code on your machine!
  - crististm 15y ago
    I agree. That's why I go mostly with open software. If I care enough I'll go and get my hands dirty with code. However I trust open source because people _I know_ told me they are trust-able not because of a higher authority. I trust Amazon because friends of mine are satisfied customers and not because Verisign says so.
    - bzbarsky 15y ago
      Sure. But one important point here: Verisign doesn't tell you to trust Amazon. What Verisign can tell you is that you can trust that the server you're talking to right now is in fact affiliated with Amazon (in the case of EV certs) or corresponds to the hostname in your URL bar (in the case of regular certs). As long as no certificates got stolen, no one mis-issues certificates, etc....
rwg 15y ago
Mozilla's Gervase Markham posted a more detailed (and, frankly, more damning) blog entry about the DigiNotar fiasco: http://blog.gerv.net/2011/09/diginotar-compromise/ http://blog.gerv.net/2011/09/diginotar-compromise/

guelo 15y ago

DigiNotar's complete collapse is intriguing. Doing a little Googling I noticed that they just got acquired 8 months ago http://www.vasco.com/company/press_room/news_archive/2011/acquisition_diginotar.aspx http://www.vasco.com/company/press_room/news_archive/2011/ac... That investment is not looking very good for Vasco right now. It would be interesting to know the backstory here. I wouldn't be surprised if something about the acquisition caused all the engineers to jump ship. Their one press release seems to be begging the Dutch government to provide staff http://www.sacbee.com/2011/09/02/3881380/vasco-offers-dutch-government.html http://www.sacbee.com/2011/09/02/3881380/vasco-offers-dutch-...

alastairpat 15y ago
They have put out a statement[1], although it's in Dutch. Assuming Google's translation conveys the gist and tone of it, they seem more irritated that the browser vendors are removing the root certificates than anything else. [1] http://www.diginotar.nl/Actueel/tabid/264/articleType/ArticleView/articleId/327/Default.aspx http://www.diginotar.nl/Actueel/tabid/264/articleType/Articl...
- X-Istence 15y ago
  That is exactly what the article comes over as. They seem to be annoyed with the fact that their roots were being pulled when they claim only a single subroot was compromised. They are willing to give people new certificates chained to the PKIOverheid, but that comes with the rules and requirements of those certs, and looking at later news it sounds like the Dutch government has revoked their access to that and will be taking over.
- Michiel 15y ago
  This: "Gebruikers van SSL certificaten kunnen afhankelijk van de desbetreffende browserleverancier geconfronteerd worden met een mededeling dat het certificaat niet vertrouwd wordt. Dit is in 99,9% van de gevallen onjuist, het certificaat kan wel worden vertrouwd. Dit kan handmatig door de gebruiker zelf worden aangegeven in de browser (hiervoor kunt u terecht op de FAQ op onze website)." Translates (roughly) to this: Depending on the browsers a user of SSL certificates may be confronted with a message stating the certificate is not trusted. In 99.9% of the cases this is not correct, the certificate can be trusted. The user can do this manually using his browser (see our FAQ). --- Given the situation I don't think that is the right message. I think people should not be told that 99.9% of certificates can be trusted even though their computer says no.
  - stingraycharles 15y ago
    That's terrible that they're saying that. You would expect a CA to be the last person to try to educate others to ignore those warnings. It kind of undermines their whole reason of existence.
    - marshray 15y ago
      One explanation is that they just don't understand that. Another is that they don't give a flip about their CA business at this point because it's just a liability to them that they wish would just go away. If they're going to have any customer left after this it's going to be gov.nl, who seems to prefer having a pwned CA to re-rooting their whole PKI setup.
sjmulder 15y ago
There was a live press conference on Dutch TV a few hours ago (“this broadcast is being interrupted…”) stating pretty much what’s written in this article: An audit revealed that the government certificates may have been compromised and thus these have all been revoked. The government will take control over DigiNotar and will quickly replace all existing certificates.
- joelhaasnoot 15y ago
  It has now gotten to the point where Digid, the Dutch e-government single sign on has is basically saying "We're not secure" http://www.digid.nl/nieuws/artikel/artikel/89/ http://www.digid.nl/nieuws/artikel/artikel/89/. Very honest stance, and certificates are to be replaced. For the backstory, this conference was at 00:30, and interrupting the public channels only happens when there's big news, plane crashes, etc.
marshray 15y ago
Other than gov.nl, their certs are only on a few hundred web servers. They likely didn't have the revenue to support even a single full-time person.
- blauwbilgorgel 15y ago
  Their certs are also baked into hardware and a large part of the Dutch e-Government. Diginotar has more than 10 employees. They do other things than merely signing certs. Size of the company doesn't really matter too. If it matters we would have a single CA. Apparently even my new passport is signed by the Diginotar PKI. I'm wondering when this will be big news in Holland.
  - marshray 15y ago
    A full time person dedicated to the certificate business I was trying to say.

SoftwareMaven 15y ago

Would Mozilla (or any browser vendor) really remove them if they had 20% of the cert market? That will be an interesting test.

Skalman 15y ago
Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't followed) But if a CA was compromised and they didn't know the how many certificates they had issued, surely they'd have to block the root cert, if not permanently?
- dmethvin 15y ago
  If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.
  - Skalman 15y ago
    True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
    - marshray 15y ago
      Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.

nikcub 15y ago

DigiNotar should never have been a top-level CA. They should have been a third-party CA underneath Verisign or somebody similar, with only a right to sign and verify certain certificates. This is how most banks are setup. There are far, far too many trusted top-level cert CA's now. The list was 3-4 long years ago, and was designed with third-party CA's just for this reason. Today you have a huge list and it changes every month

tptacek 15y ago
You probably know something about certificates I don't, but as I understand the code that handles this stuff, your certificate either has CA=YES or CA=NO in its basicConstraints; if it's CA=YES, you're a CA full stop. It's the combination of having that bit -- err, DER boolean -- set and chaining to browser root cert that makes you a CA. There isn't a provision in the scheme for them to do less than be able to sign Google, which is why the CA system is so brittle and broken. What is the bank setup that you're thinking about? I didn't think that BankOfAmerica.com could sign its own certs for CNs under BankOfAmerica.com. Our customers include large banks and they bitch about having to work with Verisign just like everyone else.
- nikcub 15y ago
  My experience is from 10 years ago, where I set this up for a startup I worked at. This was the situation: we had built a platform for trade finance. It was like eBay but for trade paper. eg. somebody is exporting $80M worth of oil, and they need a bank to finance it. We had 500+ banks from around the world on the platform, and they would all bid for the business. Because we were dealing with hundreds of millions of dollars worth of commitments, we needed a certificate architecture that would verify the seller, the buyer, and for each of those parties to verify the site. I went to Verisign and asked them for the best solution, and this is what they setup: - we had a Verisign terminal setup in the office. This was a normal computer, but locked down to only run Verisign software. It was a flavor of UNIX - the terminal had a smart-card reader on it, and a private net connection that went only back to Verisign. - the authentication to login to the computer was two passwords, both with secure tokens, and two smart cards - when you login, you do the ID shuffle, which involved two people who had background checks conducted on them etc. - we generate a certificate, which is then signed using a sub-CA certificate that Verisign issues to us - Our certificate thus acted as a CA, but it was authorized by Verisign, so the certs that we signed would then check out using the built-in browser CA certs This cost us hundreds of thousands of dollars to setup, and cost us hundreds of dollars for each cert we signed. When I did the due dilligence on the solution, I visited 3 london-based banks who had implemented the same system. The selling point was that we could act as a CA, but without really being a CA. Verisign's sales pitch was that you could never become the root CA because of the stringent policies that had to be put in place (isolated networks, key generation, etc.), but for the fraction of the cost, we could sign certs using our cert which would be verified up the chain to the root CA which was Verisign I can't stress how secure this whole procedure was. The root CA store was the holy grail - nobody that did't have the infrastructure or procedures like Verisign would get anywhere near it. I now read stories 10 years later of dodgy dutch companies with no budgets being given root CA privileges, and I am just blown away. If these guys needed a solution to sign certs, they should have been setup with what we had, and what the other banks had, not just given placement in the root cert store. Verisign would check and double-check everything we did, and would frequently revert certs we signed where they suspected something was wrong. With this story it seems there was a completely amateur operation given privileges to sign certs as part of a root CA. I have 163 root CA certs on my OS X machine. 10 years ago I am certain the number was 4 or 5 note: this was so long ago that I probably have some of my terminology mixed up, but what we bought was the right to sign certs as a sub-CA of Verisign, a privileged root CA. I also got a very cool tour of Verisign which is another story.

crististm 15y ago

Nobody seems to ask why should I trust DigiNotar or Verisign or whatever? I do not know them myself to trust them in the first place. So why should I trust them through Mozilla? Or Google? I don't know enough to trust them either... The whole pyramid trust scheme is broken.

bzbarsky 15y ago
If you don't trust your browser, then you've already lost, since your browser ipso facto sees the unencrypted form of all your web traffic, both incoming and outgoing. Not only that, but it's running native code on your machine!
- crististm 15y ago
  I agree. That's why I go mostly with open software. If I care enough I'll go and get my hands dirty with code. However I trust open source because people _I know_ told me they are trust-able not because of a higher authority. I trust Amazon because friends of mine are satisfied customers and not because Verisign says so.
  - bzbarsky 15y ago
    Sure. But one important point here: Verisign doesn't tell you to trust Amazon. What Verisign can tell you is that you can trust that the server you're talking to right now is in fact affiliated with Amazon (in the case of EV certs) or corresponds to the hostname in your URL bar (in the case of regular certs). As long as no certificates got stolen, no one mis-issues certificates, etc....

rwg 15y ago

Mozilla's Gervase Markham posted a more detailed (and, frankly, more damning) blog entry about the DigiNotar fiasco: http://blog.gerv.net/2011/09/diginotar-compromise/ http://blog.gerv.net/2011/09/diginotar-compromise/