5 ms·

Since you’ve thought about it a lot, in an ideal world, should CAs exist at all?

Stefan-H 2y ago
What alternatives come to mind when asking that question? Not being in the PKI world directly, web of trust is what comes to mind, but I'm curious what your question hints at.
- grey-area 2y ago
  I honestly don’t know enough about it to have an opinion, have vague thoughts that dns is the weak point anyway for identity so can’t certs just live there instead but I’m sure there are reasons (historical and practical).
Ajedi32 2y ago
In an ideal world where we rebuilt the whole stack from scratch, the DNS system would securely distribute key material alongside IP addresses and CAs wouldn't be needed. Most modern DNS alternatives (Handshake, Namecoin, etc) do exactly this, but it's very unlikely any of them will be usurping DNS anytime soon, and DNS's attempts to implement similar features have been thus far unsuccessful.
- tptacek 2y ago
  People who idealize this kind of solution should remember that by overloading core Internet infrastructure (which is what name resolution is) with a PKI, they're dooming any realistic mechanism that could revoke trust in the infrastructure operators. You can't "distrust" .com. But the browsers could distrust Verisign, because Verisign had competitors, and customers could switch transparently. Browser root programs also used this leverage to establish transparency logs (though: some hypothetical blockchain name thingy could give you that automatically, I guess; forget about it with the real DNS though).
  - transfire 2y ago
    Who cares? What does a certificate tell me other than someone paid for a certificate. And what do certificate buyers gain? The ability for their site to be revoked or expired and thus no longer work. I’d like to corrected.
    - brazzy 2y ago
      Are you seriously not aware of Let's Encrypt? https://letsencrypt.org/ https://letsencrypt.org/ Nobody has really had to pay for certificates for quite a number of years. What certificates get you, as both a website owner and user, is security against man-in-the-middle attacks, which would otherwise be quite trivial, and which would completely defeat the purpose of using encryption.
      - transfire 2y ago
        As long as Let’s Encrypt is still around. I find it hard to believe there is no way to secure without requiring an authority in the middle.
    - squiggleblaz 2y ago
      A certificate authority is an organisation that pays good money to make sure that their internet connection is not being subjected to MITMs. They put vastly more resources into that than you can. A certificate is evidence that the server you're connected to has a secret that was also possessed by the server that the certificate authority connected to. This means that whether or not you're subject to MITMs, at least you don't seem to be getting MITMed right now. The importance of certificates is quite clear if you were around on the web in the last days before universal HTTPS became a thing. You would connect to the internet, and you would somehow notice that the ISP you're connected to had modified the website you're accessing.
      - Ajedi32 2y ago
        > pays good money to make sure that their internet connection is not being subjected to MITMs Is that actually true? I mean, obviously CAs aren't validating DNS challenges over coffee shop Wi-Fi so it's probably less likely to be MITMd than your laptop, but I don't think the BRs require any special precautions to assure that the CA's ISP isn't being MITMd, do they?
WJW 2y ago
How relevant is that since we don't live in such a world? Unless you have a way to get to to such a world, of course, but even then CAs would need to keep existing until you've managed to bring the ideal world about. It would be a mistake to abolish them first and only then start on idealizing the world.
mcpherrinm 2y ago
There's no such thing as an ideal world, just the one we have. Let's Encrypt was founded with a goal of rapidly (within a few years) helping get the web to as close to 100% encrypted as we could. And we've succeeded. I don't think we could have achieved that goal any way other than being a CA.
- grey-area 2y ago
  Sorry was not trying to be snarky, was interested in your answer as to what a better system would look like. The current one seems pretty broken but hard to fix.
klysm 2y ago
CAs exist on the intersection of reality (far from ideal) and cryptography.
thayne 2y ago
In an ideal world we could just trust people not to be malicious, and there wouldn't be any need to encrypt traffic at all.
throwaway2037 2y ago
This is a great question. If we don't have CAs, how do we know if it OK to trust a cert? Are there any reasonable alternatives to CAs in a modern world? I have never heard any good proposals.
- deleted 2y ago
  [deleted]
- kbolino 2y ago
  There are some alternatives. Certificate pinning is probably the most widely known way to get a certificate out there without relying on live PKI. However, certificate pinning just shifts the burden of trust from runtime to install time, and puts an expiration date on every build of the program. It also doesn't work for any software that is meant to access more than a small handful of pre-determined sites. Web-of-trust is a theoretical possibility, and is used for PGP-signed e-mail, but it's also a total mess that doesn't scale. Heck, the best way to check the PGP keys for a lot of signed mail is to go to an HTTPS website and thus rely on the CAs. DNSSEC could be the basis for a CA-free world, but it hasn't achieved wide use. Also, if used in this way, it would just shift the burden of trust from CAs to DNS operators, and I'm not sure people really like those much better.
  - hackcoughgasp 2y ago
    Certificate pinning is suicide in an environment where certificates expire in max 47 days. You'll have to rebuild and push your app at least that often and probably sync your devops with your certificate management.
    - kbolino 2y ago
      Only if you pin a CA/Browser Forum-approved certificate. But you don't have to do that. You can instead pin a self-signed or private CA-signed certificate, and then it can have the maximum lifetime you're comfortable with and that the software supports. A related option is to ship your app with a copy of your private CA certificate(s) and configure the HTTPS client to trust those in addition to, or instead of, the system-provided CAs. I'm not sure how viable these approaches are on more locked-down platforms (like smartphones) and, even if they are viable today, whether they will remain viable in the future. It's also only good for full apps; anything that uses the system browser has to stick with the system CAs.
JackSlateur 2y ago
No they should not DANE is the way (https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...) But no browser have support for it, so .. :/
- ryao 2y ago
  I tried filing an issue against the chromium project for DANE support a year or two ago and they closed the issue with a nonsense reason.
- talideon 2y ago
  Much as I like the idea of DANE, it solves nothing by itself and you need to sign the zone from tampering. Right now, the dominant way to do that is DNSSEC, though DNSCurve is a possible alternative, even if it doesn't solve the exact same problem. For DANE to be useful, you'd first need to get that set up on the domain in question, and the effort to get that working is far, far from trivial, and even then, the process is so error prone and brittle that you can easily end up making a whole zone unusable. Further, all you've done is replace one authority (the CA authority) with another one (the zone authority, and thus your domain registrar and the domain registry).
  - JackSlateur 2y ago
    The zone authority already superseeds the CA authority in all ways When I manage a DNS zone, I'm free to generate all certificates I want

What alternatives come to mind when asking that question? Not being in the PKI world directly, web of trust is what comes to mind, but I'm curious what your question hints at.

grey-area 2y ago
I honestly don’t know enough about it to have an opinion, have vague thoughts that dns is the weak point anyway for identity so can’t certs just live there instead but I’m sure there are reasons (historical and practical).

Ajedi32 2y ago

In an ideal world where we rebuilt the whole stack from scratch, the DNS system would securely distribute key material alongside IP addresses and CAs wouldn't be needed. Most modern DNS alternatives (Handshake, Namecoin, etc) do exactly this, but it's very unlikely any of them will be usurping DNS anytime soon, and DNS's attempts to implement similar features have been thus far unsuccessful.

tptacek 2y ago
People who idealize this kind of solution should remember that by overloading core Internet infrastructure (which is what name resolution is) with a PKI, they're dooming any realistic mechanism that could revoke trust in the infrastructure operators. You can't "distrust" .com. But the browsers could distrust Verisign, because Verisign had competitors, and customers could switch transparently. Browser root programs also used this leverage to establish transparency logs (though: some hypothetical blockchain name thingy could give you that automatically, I guess; forget about it with the real DNS though).
- transfire 2y ago
  Who cares? What does a certificate tell me other than someone paid for a certificate. And what do certificate buyers gain? The ability for their site to be revoked or expired and thus no longer work. I’d like to corrected.
  - brazzy 2y ago
    Are you seriously not aware of Let's Encrypt? https://letsencrypt.org/ https://letsencrypt.org/ Nobody has really had to pay for certificates for quite a number of years. What certificates get you, as both a website owner and user, is security against man-in-the-middle attacks, which would otherwise be quite trivial, and which would completely defeat the purpose of using encryption.
    - transfire 2y ago
      As long as Let’s Encrypt is still around. I find it hard to believe there is no way to secure without requiring an authority in the middle.
  - squiggleblaz 2y ago
    A certificate authority is an organisation that pays good money to make sure that their internet connection is not being subjected to MITMs. They put vastly more resources into that than you can. A certificate is evidence that the server you're connected to has a secret that was also possessed by the server that the certificate authority connected to. This means that whether or not you're subject to MITMs, at least you don't seem to be getting MITMed right now. The importance of certificates is quite clear if you were around on the web in the last days before universal HTTPS became a thing. You would connect to the internet, and you would somehow notice that the ISP you're connected to had modified the website you're accessing.
    - Ajedi32 2y ago
      > pays good money to make sure that their internet connection is not being subjected to MITMs Is that actually true? I mean, obviously CAs aren't validating DNS challenges over coffee shop Wi-Fi so it's probably less likely to be MITMd than your laptop, but I don't think the BRs require any special precautions to assure that the CA's ISP isn't being MITMd, do they?

WJW 2y ago

How relevant is that since we don't live in such a world? Unless you have a way to get to to such a world, of course, but even then CAs would need to keep existing until you've managed to bring the ideal world about. It would be a mistake to abolish them first and only then start on idealizing the world.

mcpherrinm 2y ago

There's no such thing as an ideal world, just the one we have. Let's Encrypt was founded with a goal of rapidly (within a few years) helping get the web to as close to 100% encrypted as we could. And we've succeeded. I don't think we could have achieved that goal any way other than being a CA.

grey-area 2y ago
Sorry was not trying to be snarky, was interested in your answer as to what a better system would look like. The current one seems pretty broken but hard to fix.

klysm 2y ago

CAs exist on the intersection of reality (far from ideal) and cryptography.

thayne 2y ago

In an ideal world we could just trust people not to be malicious, and there wouldn't be any need to encrypt traffic at all.

throwaway2037 2y ago

This is a great question. If we don't have CAs, how do we know if it OK to trust a cert? Are there any reasonable alternatives to CAs in a modern world? I have never heard any good proposals.

deleted 2y ago
[deleted]
kbolino 2y ago
There are some alternatives. Certificate pinning is probably the most widely known way to get a certificate out there without relying on live PKI. However, certificate pinning just shifts the burden of trust from runtime to install time, and puts an expiration date on every build of the program. It also doesn't work for any software that is meant to access more than a small handful of pre-determined sites. Web-of-trust is a theoretical possibility, and is used for PGP-signed e-mail, but it's also a total mess that doesn't scale. Heck, the best way to check the PGP keys for a lot of signed mail is to go to an HTTPS website and thus rely on the CAs. DNSSEC could be the basis for a CA-free world, but it hasn't achieved wide use. Also, if used in this way, it would just shift the burden of trust from CAs to DNS operators, and I'm not sure people really like those much better.
- hackcoughgasp 2y ago
  Certificate pinning is suicide in an environment where certificates expire in max 47 days. You'll have to rebuild and push your app at least that often and probably sync your devops with your certificate management.
  - kbolino 2y ago
    Only if you pin a CA/Browser Forum-approved certificate. But you don't have to do that. You can instead pin a self-signed or private CA-signed certificate, and then it can have the maximum lifetime you're comfortable with and that the software supports. A related option is to ship your app with a copy of your private CA certificate(s) and configure the HTTPS client to trust those in addition to, or instead of, the system-provided CAs. I'm not sure how viable these approaches are on more locked-down platforms (like smartphones) and, even if they are viable today, whether they will remain viable in the future. It's also only good for full apps; anything that uses the system browser has to stick with the system CAs.

JackSlateur 2y ago

No they should not DANE is the way (https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...) But no browser have support for it, so .. :/

ryao 2y ago
I tried filing an issue against the chromium project for DANE support a year or two ago and they closed the issue with a nonsense reason.
talideon 2y ago
Much as I like the idea of DANE, it solves nothing by itself and you need to sign the zone from tampering. Right now, the dominant way to do that is DNSSEC, though DNSCurve is a possible alternative, even if it doesn't solve the exact same problem. For DANE to be useful, you'd first need to get that set up on the domain in question, and the effort to get that working is far, far from trivial, and even then, the process is so error prone and brittle that you can easily end up making a whole zone unusable. Further, all you've done is replace one authority (the CA authority) with another one (the zone authority, and thus your domain registrar and the domain registry).
- JackSlateur 2y ago
  The zone authority already superseeds the CA authority in all ways When I manage a DNS zone, I'm free to generate all certificates I want