8 ms·

Hey gov, how about promoting a transparent decentralized system for certificate signing that doesn't require paying a vig every year to a corporation that can e

by bcg1 12y ago

Hey gov, how about promoting a transparent decentralized system for certificate signing that doesn't require paying a vig every year to a corporation that can easily be leaned on by not-so-well-meaning authorities? Oh wait, nevermind... I just realized something.

onezeno 12y ago
What did you realize?
- fweespeech 12y ago
  I believe he meant to imply that the government wants the ability to lean on the SSL cert companies.
ori_b 12y ago
What's the alternative? A web of trust where thousands of individuals can be leaned on by not-so-well-meaning authorities? Trusting the individuals or groups who validate identity at some level seems to be unavoidable.
- michaelt 12y ago
  The best alternative I've heard so far is actually a patch: We keep the CAs, but they publish signed, append-only lists containing every cert they've issued. No cert is trusted if it isn't in such a list, and the lists are mirrored (and cross-signed) by a bunch of trustworthy authorities, hashes written into the blockchain, and so on. Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it's possible to grandfather in certs they've already issued to avoid breaking lots of sites. Of course, it won't solve the problem of CAs unjustifiably charging $$$ for certain types of cert - or the problem of the dubious authentication done for affordable domain-validated certs.
  - throwaway7767 12y ago
    > Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it's possible to grandfather in certs they've already issued to avoid breaking lots of sites. I wish. Even in cases today where we have conclusive proof of CAs willfully issuing fraudulent certificates, they get a pass. TrustWave still has a valid CA cert even after having been caught with their hand in the cookie jar. Oddly, DigiNotar got the death sentence. The only lesson I can see in this is that incompetence is inexcusable, but willfully subverting the CA system is A-OK.
cesarb 12y ago
> how about promoting a transparent decentralized system for certificate signing Honest question: with a decentralized system for certificate signing, what would be the trust root? The current system has the browser makers as the root of trust; this trust is delegated to a set of certificate authorities through the list of root certificates which comes with the browser; these certificate authorities then delegate to their intermediates, which finally certify a server as trusted for a fully-qualified domain name. Without a root of trust, anyone could say "I'm example.gov, this is my certificate", and present "proof" of that. A trust root is necessary to prevent this. So far, the only working proposals I've seen for decentralized trust (which don't do away with the human readability side of Zooko's triangle) are based in distributed proof-of-work systems like Bitcoin's, where the trust root is the distributed "chain". Has anyone ever tried to apply a system like that for certificate signing for TLS?
- fweespeech 12y ago
  A block chain like structure could probably act as a record of trust for SSL by using SSL cert/IP address pairs in place of transaction data. https://namecoin.info/ https://namecoin.info/ is trying to solve a similar problem but by rebuilding the entire DNS system.
- konklone 12y ago
  Convergence and DNSChain are two interesting proposals to replace the CA system. IMO, it's more important to emphasize the idea of secure origins, and HTTPS hits that note. TLS could be swapped out, the CA system could be changed, but what matters is the expectation that connections across the web are expected to be secure by default.
  - tracker1 12y ago
    Agreed.. it's a shame that I can't just publish a public-key as part of a DNS entry for a domain, and as long as the DNS chain is secure (DNSSEC) then that key can be trusted.
    - M2Ys4U 12y ago
vtlynch 12y ago
While I certainly don't love the CA system, this isnt where I see the biggest flaws with SSL. Regardless of who is "trusted", the true critical points are in the Private Key and the Cryptographic primitives. Fixing the CA model addresses neither. Symantec CA does not ever get to see my private key when I purchase a certificate from them. They dont get to determine the encryption methods I use. All they do is verify my identity (and do a damn good job at it in my opinion). Server Authentication is an important part of SSL, but its only one part. The other part, encryption, is able to be undermined in many other ways - ways where we have much more direct proof of gov't surveillance and tampering. You can perfect Server Authentication all you want, but if there are holes in the encryption, thats all for naught. If I was going to 'fix' SSL I would start there. I think this is a great initiative.
- me1010 12y ago
  The encryption is really quite good. It's actually very rare to have a problem with the crypto. Compromise of the trust network is much more common and is really the problem with today's crypto systems... read a bit about superfish for a good news worthy example of abuse of trust. When reading the https gov doc -- it's very important to remember that the government runs its own CA.
  - vtlynch 12y ago
    Hmm, not sure if I totally agree. Superfish was certainly a huge abuse of the trust network. However, if we look at other recent SSL vulnerabilities: Heartbleed, POODLE, FREAK - most of these are all dealing with flaws in the encryption (some directly, through most with the use of side-channel or other clever attacks). We also know that the NSA is saving encrypted messages for mass decryption in the future. New technologies like Perfect Forward Secrecy (PFS) can help eliminate this issue. I think that fact that nearly 100% of servers were still allowing SSL 3 up until the POODLE attack a few months ago highlights how poor most SSL configurations are. Unlike the trust network, which has infrequent but serious breaches, the encryption side seems to be poorly implemented almost universally. However, unlike Superfish, which we know affected thousands, alot of these other SSL vulnerabilities are usually just PoCs... A complex issue for sure.
13throwaway 12y ago
Using something like Namecoin https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin and storing the cert hashes in the blockchain would allow for decentralized verification. In order to be an improvement over the CA model a new system would have to satisfy all 3 points of zooko's triangle. https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle

by bcg1 12y ago

onezeno 12y ago

What did you realize?

fweespeech 12y ago
I believe he meant to imply that the government wants the ability to lean on the SSL cert companies.

ori_b 12y ago

What's the alternative? A web of trust where thousands of individuals can be leaned on by not-so-well-meaning authorities? Trusting the individuals or groups who validate identity at some level seems to be unavoidable.

michaelt 12y ago
The best alternative I've heard so far is actually a patch: We keep the CAs, but they publish signed, append-only lists containing every cert they've issued. No cert is trusted if it isn't in such a list, and the lists are mirrored (and cross-signed) by a bunch of trustworthy authorities, hashes written into the blockchain, and so on. Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it's possible to grandfather in certs they've already issued to avoid breaking lots of sites. Of course, it won't solve the problem of CAs unjustifiably charging $$$ for certain types of cert - or the problem of the dubious authentication done for affordable domain-validated certs.
- throwaway7767 12y ago
  > Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it's possible to grandfather in certs they've already issued to avoid breaking lots of sites. I wish. Even in cases today where we have conclusive proof of CAs willfully issuing fraudulent certificates, they get a pass. TrustWave still has a valid CA cert even after having been caught with their hand in the cookie jar. Oddly, DigiNotar got the death sentence. The only lesson I can see in this is that incompetence is inexcusable, but willfully subverting the CA system is A-OK.

cesarb 12y ago

> how about promoting a transparent decentralized system for certificate signing Honest question: with a decentralized system for certificate signing, what would be the trust root? The current system has the browser makers as the root of trust; this trust is delegated to a set of certificate authorities through the list of root certificates which comes with the browser; these certificate authorities then delegate to their intermediates, which finally certify a server as trusted for a fully-qualified domain name. Without a root of trust, anyone could say "I'm example.gov, this is my certificate", and present "proof" of that. A trust root is necessary to prevent this. So far, the only working proposals I've seen for decentralized trust (which don't do away with the human readability side of Zooko's triangle) are based in distributed proof-of-work systems like Bitcoin's, where the trust root is the distributed "chain". Has anyone ever tried to apply a system like that for certificate signing for TLS?

fweespeech 12y ago
A block chain like structure could probably act as a record of trust for SSL by using SSL cert/IP address pairs in place of transaction data. https://namecoin.info/ https://namecoin.info/ is trying to solve a similar problem but by rebuilding the entire DNS system.
konklone 12y ago
Convergence and DNSChain are two interesting proposals to replace the CA system. IMO, it's more important to emphasize the idea of secure origins, and HTTPS hits that note. TLS could be swapped out, the CA system could be changed, but what matters is the expectation that connections across the web are expected to be secure by default.
- tracker1 12y ago
  Agreed.. it's a shame that I can't just publish a public-key as part of a DNS entry for a domain, and as long as the DNS chain is secure (DNSSEC) then that key can be trusted.
  - M2Ys4U 12y ago

vtlynch 12y ago

While I certainly don't love the CA system, this isnt where I see the biggest flaws with SSL. Regardless of who is "trusted", the true critical points are in the Private Key and the Cryptographic primitives. Fixing the CA model addresses neither. Symantec CA does not ever get to see my private key when I purchase a certificate from them. They dont get to determine the encryption methods I use. All they do is verify my identity (and do a damn good job at it in my opinion). Server Authentication is an important part of SSL, but its only one part. The other part, encryption, is able to be undermined in many other ways - ways where we have much more direct proof of gov't surveillance and tampering. You can perfect Server Authentication all you want, but if there are holes in the encryption, thats all for naught. If I was going to 'fix' SSL I would start there. I think this is a great initiative.

me1010 12y ago
The encryption is really quite good. It's actually very rare to have a problem with the crypto. Compromise of the trust network is much more common and is really the problem with today's crypto systems... read a bit about superfish for a good news worthy example of abuse of trust. When reading the https gov doc -- it's very important to remember that the government runs its own CA.
- vtlynch 12y ago
  Hmm, not sure if I totally agree. Superfish was certainly a huge abuse of the trust network. However, if we look at other recent SSL vulnerabilities: Heartbleed, POODLE, FREAK - most of these are all dealing with flaws in the encryption (some directly, through most with the use of side-channel or other clever attacks). We also know that the NSA is saving encrypted messages for mass decryption in the future. New technologies like Perfect Forward Secrecy (PFS) can help eliminate this issue. I think that fact that nearly 100% of servers were still allowing SSL 3 up until the POODLE attack a few months ago highlights how poor most SSL configurations are. Unlike the trust network, which has infrequent but serious breaches, the encryption side seems to be poorly implemented almost universally. However, unlike Superfish, which we know affected thousands, alot of these other SSL vulnerabilities are usually just PoCs... A complex issue for sure.

13throwaway 12y ago

Using something like Namecoin https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin and storing the cert hashes in the blockchain would allow for decentralized verification. In order to be an improvement over the CA model a new system would have to satisfy all 3 points of zooko's triangle. https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle