4 ms·

> We dont have a really good way of revoking keys after something bad happens. Why would there be. If the key is 'revokable' that is a weakness in it self.

gruez 2y ago
>If the key is 'revokable' that is a weakness in it self. ??? Why?
- LegionMammal978 2y ago
  I'd read it primarily as censorship risk. If a CA is under a government that wants your website taken down, they can just lean on the CA to stop renewing any certificates for it, as opposed to futzing around with ISPs or DNS providers that can only have a local impact. Or alternatively, the CAs in the future might directly use their monopoly to decide who's good and evil (especially on "integrity of the network" grounds against those judged to be spammers et al.). At least perceived censorship risk is why the archive.is guy always uses HTTP links and not HTTPS links for his site, iirc.
  - ndsipa_pomu 2y ago
    I'd classify that as very low risk. If a CA's business is compromised by a government, then it's pretty easy to just switch to using a different CA, preferably in a different jurisdiction to work around the censorship. I don't really get the argument behind using HTTP links to avoid the censorship risk with HTTPS - just provide both and get the best of both worlds. Also, using HTTP is far more prone to being interfered with in transit - I recall BT (or their ISP business department) trialling that and injecting adverts into HTTP pages. I can't recall any instance of HTTPS being censored by restricting certificates.
    - hulitu 2y ago
      > I'd classify that as very low risk. The majority of CAs are in the US.
      - ndsipa_pomu 2y ago
        Whilst that could be a problem, there are some CAs that aren't based in the US. I consider it a low risk issue as I haven't heard of it happening. It'd be more likely for your IP to be cut off rather than attempting to deny an SSL cert.
      - yugcesofni 2y ago
        FWIW, a slight clarification here would be that the majority of TLS certificates are issued by CAs in the US, but the majority of CAs are not headquartered in the US.
  - bawolff 2y ago
    As you say though, the risk of revocation is low, since anyone who wants to do that can just fail to renew (renewing and revoking are different operations). I guess it decreases the lead time of censorship. That seems pretty minor though.
- hulitu 2y ago
  You cannot run this program. Invalid certificate.
Dylan16807 2y ago
A mistaken revocation is orders of magnitude less harmful then a failure to revoke. If revocation worked pretty reliably, that would be an improvement over the status quo.
bawolff 2y ago
> Why would there be. If the key is 'revokable' that is a weakness in it self. What?? This does not make sense. Keys are revocable in most crypto systems.
dspillett 2y ago
> If the key is 'revokable' that is a weakness in it self. Ish. The threat of that is part of a different risk model, and probably less serious. A long-lived certificate that ends up being able to be used by a malicious party (perhaps due to a leak of the private key) could be serious for many users if the certificate can't be reliably revoked, which they currently can't be. A mistaken or malicious revocation if someone were to manage that could be an issue to the service operator (users can't get in) but this is a safer failure than users connecting to a malicious shadow service due, for example, to an accidentally exposed private key and a DNS poisoning attack. As others have mentioned: if revocation worked better currently, this would be less of an issue.
Arnt 2y ago
Others have answered on one level. I want to answer on another. A few older crypto mechanisms were designed around trusting one thing totally. For example, everything's secure until the end of time provided that the user keeps a private key totally private at all times, with no interruption, ever, and if the user lapses then the overall mechanism breaks really badly. They were complicated mechanisms held together by a screw made of a metal which was assumed to be infinitely strong. The current fashion is to trust thing in a more limited way, and to design systems such that they won't blow up spectactularly if something breaks. Being able to revoke keys is part of that, it is a weakness that helps to avoid a really bad weakness.
olliej 2y ago
Wait, what is the threat model for revocation being a weakness?

gruez 2y ago

>If the key is 'revokable' that is a weakness in it self. ??? Why?

LegionMammal978 2y ago
I'd read it primarily as censorship risk. If a CA is under a government that wants your website taken down, they can just lean on the CA to stop renewing any certificates for it, as opposed to futzing around with ISPs or DNS providers that can only have a local impact. Or alternatively, the CAs in the future might directly use their monopoly to decide who's good and evil (especially on "integrity of the network" grounds against those judged to be spammers et al.). At least perceived censorship risk is why the archive.is guy always uses HTTP links and not HTTPS links for his site, iirc.
- ndsipa_pomu 2y ago
  I'd classify that as very low risk. If a CA's business is compromised by a government, then it's pretty easy to just switch to using a different CA, preferably in a different jurisdiction to work around the censorship. I don't really get the argument behind using HTTP links to avoid the censorship risk with HTTPS - just provide both and get the best of both worlds. Also, using HTTP is far more prone to being interfered with in transit - I recall BT (or their ISP business department) trialling that and injecting adverts into HTTP pages. I can't recall any instance of HTTPS being censored by restricting certificates.
  - hulitu 2y ago
    > I'd classify that as very low risk. The majority of CAs are in the US.
    - ndsipa_pomu 2y ago
      Whilst that could be a problem, there are some CAs that aren't based in the US. I consider it a low risk issue as I haven't heard of it happening. It'd be more likely for your IP to be cut off rather than attempting to deny an SSL cert.
    - yugcesofni 2y ago
      FWIW, a slight clarification here would be that the majority of TLS certificates are issued by CAs in the US, but the majority of CAs are not headquartered in the US.
- bawolff 2y ago
  As you say though, the risk of revocation is low, since anyone who wants to do that can just fail to renew (renewing and revoking are different operations). I guess it decreases the lead time of censorship. That seems pretty minor though.
hulitu 2y ago
You cannot run this program. Invalid certificate.

Dylan16807 2y ago

A mistaken revocation is orders of magnitude less harmful then a failure to revoke. If revocation worked pretty reliably, that would be an improvement over the status quo.

bawolff 2y ago

> Why would there be. If the key is 'revokable' that is a weakness in it self. What?? This does not make sense. Keys are revocable in most crypto systems.

dspillett 2y ago

> If the key is 'revokable' that is a weakness in it self. Ish. The threat of that is part of a different risk model, and probably less serious. A long-lived certificate that ends up being able to be used by a malicious party (perhaps due to a leak of the private key) could be serious for many users if the certificate can't be reliably revoked, which they currently can't be. A mistaken or malicious revocation if someone were to manage that could be an issue to the service operator (users can't get in) but this is a safer failure than users connecting to a malicious shadow service due, for example, to an accidentally exposed private key and a DNS poisoning attack. As others have mentioned: if revocation worked better currently, this would be less of an issue.

Arnt 2y ago

Others have answered on one level. I want to answer on another. A few older crypto mechanisms were designed around trusting one thing totally. For example, everything's secure until the end of time provided that the user keeps a private key totally private at all times, with no interruption, ever, and if the user lapses then the overall mechanism breaks really badly. They were complicated mechanisms held together by a screw made of a metal which was assumed to be infinitely strong. The current fashion is to trust thing in a more limited way, and to design systems such that they won't blow up spectactularly if something breaks. Being able to revoke keys is part of that, it is a weakness that helps to avoid a really bad weakness.

olliej 2y ago

Wait, what is the threat model for revocation being a weakness?