3 ms·

Every single CA - including non-profit CAs like Let's Encrypt - have made mistakes that require cert rotation. And sometimes it isn't mistakes that require cer

by agwa 2y ago

Every single CA - including non-profit CAs like Let's Encrypt - have made mistakes that require cert rotation. And sometimes it isn't mistakes that require cert rotation, but cryptographic breakthroughs that render the algorithms in the cert insecure. It's much better engineering to accept that certs will need to be rotated and make sure it happens regularly so it's not a huge emergency when it's required.

grayhatter 2y ago
> And sometimes it isn't mistakes that require cert rotation, but cryptographic breakthroughs that render the algorithms in the cert insecure. Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it breaking. I'll also point out, if you find the signature made by a CA is weakened such that it can be forged; certificate pinning would actually protect existing users from such an attack. > It's much better engineering to accept that certs will need to be rotated that's a very debatable assertion, but I don't disagree outright > and make sure it happens regularly so it's not a huge emergency when it's required. No, that's not good engineering. Do something needlessly, so that it's easy to do it when it becomes required is operations not engineering. Engineering would be designing a system that requires the minimal amount of operational support. Certs do need to be updated, and maintanted, they don't need to be rotated.
- agwa 2y ago
  512 bit RSA used to be common in publicly-trusted certificates. That's very easily breakable on today's hardware. If quantum computers happen, all existing keys in the WebPKI will be broken.
- woodruffw 2y ago
  > Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it breaking. Flame (back in 2012) was a pretty famous example of certificate forgery due to weak hash choice (MD5) and other operational weaknesses in the PKI (predictable serial numbers, if I remember correctly). > Do something needlessly, so that it's easy to do it when it becomes required is operations not engineering. I don't think that's a good interpretation of what 'agwa meant. I'm pretty sure he meant that it's considered good engineering practice to build systems that don't encourage the normalization of deviance, which long-lived certificates combined with manual rotation procedures historically have. Or put another way: automatic rotation procedures ensure the isostability of a PKI, rather than its brittle stability.

by agwa 2y ago

grayhatter 2y ago

> And sometimes it isn't mistakes that require cert rotation, but cryptographic breakthroughs that render the algorithms in the cert insecure. Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it breaking. I'll also point out, if you find the signature made by a CA is weakened such that it can be forged; certificate pinning would actually protect existing users from such an attack. > It's much better engineering to accept that certs will need to be rotated that's a very debatable assertion, but I don't disagree outright > and make sure it happens regularly so it's not a huge emergency when it's required. No, that's not good engineering. Do something needlessly, so that it's easy to do it when it becomes required is operations not engineering. Engineering would be designing a system that requires the minimal amount of operational support. Certs do need to be updated, and maintanted, they don't need to be rotated.

agwa 2y ago
512 bit RSA used to be common in publicly-trusted certificates. That's very easily breakable on today's hardware. If quantum computers happen, all existing keys in the WebPKI will be broken.
woodruffw 2y ago
> Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it breaking. Flame (back in 2012) was a pretty famous example of certificate forgery due to weak hash choice (MD5) and other operational weaknesses in the PKI (predictable serial numbers, if I remember correctly). > Do something needlessly, so that it's easy to do it when it becomes required is operations not engineering. I don't think that's a good interpretation of what 'agwa meant. I'm pretty sure he meant that it's considered good engineering practice to build systems that don't encourage the normalization of deviance, which long-lived certificates combined with manual rotation procedures historically have. Or put another way: automatic rotation procedures ensure the isostability of a PKI, rather than its brittle stability.