4 ms·

I hate the concept of certificate authorities in general. I wish we had a way to do robust security without them. The idea that you need the approval of one o

I hate the concept of certificate authorities in general. I wish we had a way to do robust security without them. The idea that you need the approval of one of these companies to publish to the web without a wall of alerts is just absurd.

Ajedi32 4y ago
IMO the correct solution would be one based on DNS. (E.g. DNSSEC+DANE or something similar.) Right now (unless we bring back extended validation) the entire purpose of certs on the web is to tell browsers what private key is associated with a domain. It's silly to involve completely unrelated third parties in that process when you could just get the information from the authoritative source (DNS) directly.
- tptacek 4y ago
  No, it's not. One of the important benefits you get from this layer of indirection is revocability of trust. CAs can be removed from browsers (Google and Mozilla have both removed some of the largest CAs), and DNS roots cannot. Browsers and root store operators can pressure CAs to adopt safeguards like Certificate Transparency --- they simply won't trust CAs that don't. There is no DANE Transparency in part because nobody can pressure TLD operators to adopt it. There are a whole variety of other problems with a DNS PKI, and with DNSSEC in particular, but when we're talking about issues like this thread, revocability is the the big thing.
  - Ajedi32 4y ago
    You raise some good points. There are definitely some benefits to having a diversity of different trust anchors rather than just one. The problem though is that the way things are currently set up that diversity is somewhat of an illusion; DNS is still a central point of failure for all CAs (e.g. via the ACME DNS challenge), and each individual CA is also a single point of failure unto itself (a CA can issue certs for any domain, not just those of its customers). I also think you may be underestimating the amount of leverage browser developers have over DNS, should they choose to exercise it. If Google, Apple, Microsoft, and Mozilla all agreed tomorrow that they wanted to migrate the web to a new set of DNS root servers they could probably do it. (Though yes, it would be a huge ordeal for everyone involved.) The real reason we haven't gotten DANE transparency (or anything similar) is simply because it hasn't been a priority for browsers. (Why pressure DNS roots to improve a system that you aren't even using in the first place?) Still, I can't deny what you're saying. The CA system is probably a lot more flexible than a naively designed DNS-based system would be. I'll have to think about that a bit more. Maybe it would make sense to have something like SCTs in the certificate transparency system, where a number of different independently operated organizations all have to sign off on the validity of each cert _in addition_ to the DNS operator that actually issued the certificate. That way you'd get the benefits of diversified trust anchors without the downside of having hundreds of distributed single points of failure.
    - tptacek 4y ago
      The browsers absolutely cannot migrate to a different set of DNS roots. It's only been in the last 5-10 years that they've managed to get as much control over the root programs as they have now, and there was a lot of behind-the-scenes drama involved in that. And TLS certificates are, when you come right down to it, a browser feature.
      - Ajedi32 4y ago
        That was just a hypothetical example to illustrate how much power browser vendors have over the web; they wouldn't need to literally migrate to a different DNS root in order to effect change in this space, but I maintain they absolutely could go that far (again, hypothetically) if they all agreed and there were a sufficiently compelling reason. Browsers always had full control over CA root programs, it's just a question of how willing they were to actually assert themselves in that fashion. I agree they've become more bold about that over the years, but what Mozilla just did to TrustCo was always an option for the major browser vendors, both legally and technically (or at least since automatic updates became a thing). DNS is also effectively a browser feature these days, as evidenced by all the browsers suddenly supporting things like DNS-over-HTTPS despite host operating systems lacking support. Given a sufficiently smooth transition path for users and website operators, browser vendors could collectively decide to alter their DNS implementations in pretty much any way they want.
        tptacek 4y ago
        I don't think this is really true at all, and I think it underestimates (significantly) the amount of behind-the-scenes work that went into the current WebPKI situation with activist root programs. I don't think there's any reason at all to believe that browsers would have similar success governing a DNS PKI, and there are specific reasons --- evidence, even --- to believe they wouldn't. We can go round and round on this stuff, but I feel like I'm repeating myself at this point.
        Ajedi32 4y ago
  - planede 4y ago
    Isn't there an implicit trust on DNS already for domain validated certificates?
    - tptacek 4y ago
      Yes, there is. But all certificate issuance is cryptographically logged, and DNSSEC signatures aren't. You can spot and react to misissuance of certificates.
yrro 4y ago
If only Kerberos had been adopted as an alternative to TLS for securing have to traffic... things could have been so different (at least for the purposes of an organisation wanting to enable secure communications between its own clients and servers)

Ajedi32 4y ago

IMO the correct solution would be one based on DNS. (E.g. DNSSEC+DANE or something similar.) Right now (unless we bring back extended validation) the entire purpose of certs on the web is to tell browsers what private key is associated with a domain. It's silly to involve completely unrelated third parties in that process when you could just get the information from the authoritative source (DNS) directly.

tptacek 4y ago
No, it's not. One of the important benefits you get from this layer of indirection is revocability of trust. CAs can be removed from browsers (Google and Mozilla have both removed some of the largest CAs), and DNS roots cannot. Browsers and root store operators can pressure CAs to adopt safeguards like Certificate Transparency --- they simply won't trust CAs that don't. There is no DANE Transparency in part because nobody can pressure TLD operators to adopt it. There are a whole variety of other problems with a DNS PKI, and with DNSSEC in particular, but when we're talking about issues like this thread, revocability is the the big thing.
- Ajedi32 4y ago
  You raise some good points. There are definitely some benefits to having a diversity of different trust anchors rather than just one. The problem though is that the way things are currently set up that diversity is somewhat of an illusion; DNS is still a central point of failure for all CAs (e.g. via the ACME DNS challenge), and each individual CA is also a single point of failure unto itself (a CA can issue certs for any domain, not just those of its customers). I also think you may be underestimating the amount of leverage browser developers have over DNS, should they choose to exercise it. If Google, Apple, Microsoft, and Mozilla all agreed tomorrow that they wanted to migrate the web to a new set of DNS root servers they could probably do it. (Though yes, it would be a huge ordeal for everyone involved.) The real reason we haven't gotten DANE transparency (or anything similar) is simply because it hasn't been a priority for browsers. (Why pressure DNS roots to improve a system that you aren't even using in the first place?) Still, I can't deny what you're saying. The CA system is probably a lot more flexible than a naively designed DNS-based system would be. I'll have to think about that a bit more. Maybe it would make sense to have something like SCTs in the certificate transparency system, where a number of different independently operated organizations all have to sign off on the validity of each cert _in addition_ to the DNS operator that actually issued the certificate. That way you'd get the benefits of diversified trust anchors without the downside of having hundreds of distributed single points of failure.
  - tptacek 4y ago
    The browsers absolutely cannot migrate to a different set of DNS roots. It's only been in the last 5-10 years that they've managed to get as much control over the root programs as they have now, and there was a lot of behind-the-scenes drama involved in that. And TLS certificates are, when you come right down to it, a browser feature.
    - Ajedi32 4y ago
      That was just a hypothetical example to illustrate how much power browser vendors have over the web; they wouldn't need to literally migrate to a different DNS root in order to effect change in this space, but I maintain they absolutely could go that far (again, hypothetically) if they all agreed and there were a sufficiently compelling reason. Browsers always had full control over CA root programs, it's just a question of how willing they were to actually assert themselves in that fashion. I agree they've become more bold about that over the years, but what Mozilla just did to TrustCo was always an option for the major browser vendors, both legally and technically (or at least since automatic updates became a thing). DNS is also effectively a browser feature these days, as evidenced by all the browsers suddenly supporting things like DNS-over-HTTPS despite host operating systems lacking support. Given a sufficiently smooth transition path for users and website operators, browser vendors could collectively decide to alter their DNS implementations in pretty much any way they want.
      - tptacek 4y ago
        I don't think this is really true at all, and I think it underestimates (significantly) the amount of behind-the-scenes work that went into the current WebPKI situation with activist root programs. I don't think there's any reason at all to believe that browsers would have similar success governing a DNS PKI, and there are specific reasons --- evidence, even --- to believe they wouldn't. We can go round and round on this stuff, but I feel like I'm repeating myself at this point.
        Ajedi32 4y ago
- planede 4y ago
  Isn't there an implicit trust on DNS already for domain validated certificates?
  - tptacek 4y ago
    Yes, there is. But all certificate issuance is cryptographically logged, and DNSSEC signatures aren't. You can spot and react to misissuance of certificates.

yrro 4y ago

If only Kerberos had been adopted as an alternative to TLS for securing have to traffic... things could have been so different (at least for the purposes of an organisation wanting to enable secure communications between its own clients and servers)