3 ms·

Let me ask some basic questions, that I might someday know what I'm talking about on this topic. I can self-sign certs. The problem is that no browser recogniz

Let me ask some basic questions, that I might someday know what I'm talking about on this topic. I can self-sign certs. The problem is that no browser recognizes my self-signed certs, so they put up dialog boxes filled with warnings. (Which many users will just dismiss without a second thought, since they are very used to their machines crying wolf. But let's ignore that big problem for now.) So the problem is that some of the CAs whose credentials are pre-installed and pre-trusted in various browsers or clients turn out to have shoddy verification practices. Does the answer to this involve Mozilla, Webkit, Microsoft et al. decertifying these CAs, which would turn them into the equivalent of someone like me, signing certificates in his basement? I guess the problem with that is that all the existing paying customers of these CAs would wake up one day to find that their certs don't work anymore and that their money was wasted. What is the answer to this problem? What kind of contract do you have to sign to become a CA, and with whom?

cscott 18y ago
If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Certificate Policy is here: http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ There are operational requirements and management attestations that must be made such as "WebTrust Principles and Criteria for Certification Authorities".
- tptacek 18y ago
  WebTrust is an accounting entity; it's just a process formalism that allows companies like KPMG to "audit" CAs. I went down that rabbit hole and found the WebTrust standards document: http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&re_id=0 http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&... The technical stuff starts on page 34. The intro to the document claims that the WebTrust CA standard is loosely based on RFC2527: http://www.ietf.org/rfc/rfc2527.txt http://www.ietf.org/rfc/rfc2527.txt The technical material in these documents is about FIPS compliance for hardware crypto, key size, and backup/restore; in other words, the exact same stuff you'd read in a Common Criteria document, utterly divorced from actual operational or code security. Compare to the new PCI-DSS standard: on paper, it is actually harder to process an individual VISA card than it is to run a CA. Neither document contains the letters "M-D-5" or requires serial numbers to be randomized. However, the majority of CAs do randomize serial numbers, suggesting a best practice that simply isn't included in the industry's CA certification standard. The link you provided to the Bugzilla report on adding GeoTrust/RapidSSL is almost offensive; it reads: "we got audited by KPMG, here's our address", "ok, fill out this document", "ok, we'll add you to the next release".
  - cscott 18y ago
    I'm surprised and a bit skeptical that every CA (except for one) randomizes serial numbers without it being published in a standard or guidance document somewhere. Best practice usually has something worse than a (n - 1) distribution.
    - jhancock 18y ago
      was the "one" in those articles? I didn't see. Anyway, who do you trust to buy certs from? I need to get a new one soon and would like recommendations.
      - cscott 18y ago
        What's slightly ironic is trust doesn't matter for the buyer. As long as you purchase your certificate from a CA well placed in the major browser vendors, you're good to go. Edit: Here's a list of Mozilla's included certificates: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/
tptacek 18y ago
Yes, that's just about the nut of it. If you ask me, the biggest problem is that we've acclimated the whole user population of the Internet to ignorance and a cavalier attitude towards security. Companies like Comodo "get away" with stuff like this because people see certificates as a nuisance --- they're a pain to request, a pain to install, and they make browsers complain. The fact is that SSL simply doesn't work without the PKI component. The PKI component is most of the actual security in SSL. But because technical people get away with saying "even if you're not authenticated, you're at least encrypted", it isn't the end of the world when Comodo (or RapidSSL) screws up. As for "what kind of contract do you need to sign", what you need to do is convince Microsoft and Mozilla to add you to their root CA store; both organizations have standards and practices, and both incur an audit, and neither are particularly inclined to add more CA's (there's a bit of grandfathering that appears to happen here).
- jhancock 18y ago
  A bit of an aside, but it used to be damn near impossible to get a root cert in IE (think mid to late '90s). I would love to know how Thawte managed the hat truck of getting approved so long ago when it was clear the big boys wouldn't let anyone else in. Shuttleworth deserves credit for creating a good company; lots of hard work, for sure. But it couldn't have happened without getting approved my Microsoft. How a young man from Cape Town pulled this off seems to be an untold part of his success story.
  - tptacek 18y ago
    Thawte is apparently one of the fuckups in the Sotirov et al report from this morning. Paul Kocher, one of the designers of SSL3/TLS, told the NYTimes that he was astonished that anyone would rely on MD5 in 2008; is it possible that nobody at Thawte really understands how SSL and x509 works? If so, is it really an industry success story that they got included with IE?
    - jhancock 18y ago
      Thawte is unfortunately not the same company anymore. It doesn't surprise me a bit that Verisign let it degrade. Thawte _was_ a success story for its time. When Shuttleworth created it he severely undercut prices which is why Verisign had to buy them since he was quickly working up the food chain. After Verisign bought them, they carefully controlled the product offering to keep it the low-price step-child that it is today. I have used Thawte a few times but the last few years I have been dissatisfied. Do you have any recommendations? I would like to give my business to someone other than Verisign if possible.

cscott 18y ago

If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Certificate Policy is here: http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ There are operational requirements and management attestations that must be made such as "WebTrust Principles and Criteria for Certification Authorities".

tptacek 18y ago
WebTrust is an accounting entity; it's just a process formalism that allows companies like KPMG to "audit" CAs. I went down that rabbit hole and found the WebTrust standards document: http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&re_id=0 http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&... The technical stuff starts on page 34. The intro to the document claims that the WebTrust CA standard is loosely based on RFC2527: http://www.ietf.org/rfc/rfc2527.txt http://www.ietf.org/rfc/rfc2527.txt The technical material in these documents is about FIPS compliance for hardware crypto, key size, and backup/restore; in other words, the exact same stuff you'd read in a Common Criteria document, utterly divorced from actual operational or code security. Compare to the new PCI-DSS standard: on paper, it is actually harder to process an individual VISA card than it is to run a CA. Neither document contains the letters "M-D-5" or requires serial numbers to be randomized. However, the majority of CAs do randomize serial numbers, suggesting a best practice that simply isn't included in the industry's CA certification standard. The link you provided to the Bugzilla report on adding GeoTrust/RapidSSL is almost offensive; it reads: "we got audited by KPMG, here's our address", "ok, fill out this document", "ok, we'll add you to the next release".
- cscott 18y ago
  I'm surprised and a bit skeptical that every CA (except for one) randomizes serial numbers without it being published in a standard or guidance document somewhere. Best practice usually has something worse than a (n - 1) distribution.
  - jhancock 18y ago
    was the "one" in those articles? I didn't see. Anyway, who do you trust to buy certs from? I need to get a new one soon and would like recommendations.
    - cscott 18y ago
      What's slightly ironic is trust doesn't matter for the buyer. As long as you purchase your certificate from a CA well placed in the major browser vendors, you're good to go. Edit: Here's a list of Mozilla's included certificates: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/

tptacek 18y ago

Yes, that's just about the nut of it. If you ask me, the biggest problem is that we've acclimated the whole user population of the Internet to ignorance and a cavalier attitude towards security. Companies like Comodo "get away" with stuff like this because people see certificates as a nuisance --- they're a pain to request, a pain to install, and they make browsers complain. The fact is that SSL simply doesn't work without the PKI component. The PKI component is most of the actual security in SSL. But because technical people get away with saying "even if you're not authenticated, you're at least encrypted", it isn't the end of the world when Comodo (or RapidSSL) screws up. As for "what kind of contract do you need to sign", what you need to do is convince Microsoft and Mozilla to add you to their root CA store; both organizations have standards and practices, and both incur an audit, and neither are particularly inclined to add more CA's (there's a bit of grandfathering that appears to happen here).

jhancock 18y ago
A bit of an aside, but it used to be damn near impossible to get a root cert in IE (think mid to late '90s). I would love to know how Thawte managed the hat truck of getting approved so long ago when it was clear the big boys wouldn't let anyone else in. Shuttleworth deserves credit for creating a good company; lots of hard work, for sure. But it couldn't have happened without getting approved my Microsoft. How a young man from Cape Town pulled this off seems to be an untold part of his success story.
- tptacek 18y ago
  Thawte is apparently one of the fuckups in the Sotirov et al report from this morning. Paul Kocher, one of the designers of SSL3/TLS, told the NYTimes that he was astonished that anyone would rely on MD5 in 2008; is it possible that nobody at Thawte really understands how SSL and x509 works? If so, is it really an industry success story that they got included with IE?
  - jhancock 18y ago
    Thawte is unfortunately not the same company anymore. It doesn't surprise me a bit that Verisign let it degrade. Thawte _was_ a success story for its time. When Shuttleworth created it he severely undercut prices which is why Verisign had to buy them since he was quickly working up the food chain. After Verisign bought them, they carefully controlled the product offering to keep it the low-price step-child that it is today. I have used Thawte a few times but the last few years I have been dissatisfied. Do you have any recommendations? I would like to give my business to someone other than Verisign if possible.