I don't understand why we trust lone authentication services. They are single points of failure. SSL Certificates should be validated by a collection of independent certificate authorities. If not all of the authorities agree on the certificate, that's a sign there is hacking going on - or a sign that not all of the services have synchronized the certificate.
If we do it this way, a hacker who wants to try to imitate a site can't get away with compromising just one certificate authority. They'd have to compromise all of them, which (if there are enough) would be nearly impossible.
Well, how do you distribute trust? Do you have a quorum or something?
Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
> Well, how do you distribute trust? Do you have a quorum or something?
Basically, yes.
> Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
By not trusting you.
Right now, what happens is the browser and/or OS vendor determines a set of certificate authorities to declare "trusted", and all certificates they issue are simply assumed to be valid.
Instead, we could require, say, three signatures, each from different authorities, to invoke the normal "this is a secure connection to a properly-identified website" behavior.
But each of those authorities was still determined by the vendor to be trustworthy. It's still going to be the likes of e.g. VeriSign, Comodo, StartSSL, etc.. It's not going to be you.
That is in no way different than the current situation. If all of the dozens of trusted certificate authorities the world over has decided that they shouldn't provide certs for company X, you should probably be looking to company X for the problem, rather than the authorities.
In any case, users have always had the option of modifying the trust infrastructure or even ignoring it entirely.
Although this is perhaps an ill timed suggestion given that it is verisign in the news, I have long thought that DNSSEC would serve as a good mechanism for distributing public keys.
Perhaps in conjunction rather than opposition to the current CA system.
"SSL Certificates should be validated by a collection of independent certificate authorities"
That would greatly raise the cost of the SSL certificates. And I don't think that would be something that you could get the various providers to even agree on.
> That would greatly raise the cost of the SSL certificates.
$0 x N is still $0, and the difference between 1 EV certificate and 3 EV certificates is not going to put anybody who really thinks they need one out of business.
> And I don't think that would be something that you could get the various providers to even agree on.
Put simply, certificate authorities don't have a vote. It's up to the browser and OS vendors to set their own requirements for default trust.
If Google, Microsoft, Mozilla, and Apple declare that all SSL certificates lacking at least N valid signatures are treated by default as invalid, that's the ball game. If the current authorities don't play along, new authorities will.
Edit: I should also note that there's really no need for anybody to play along. You can ship a CSR off to as many authorities as you want for signatures, then assemble those signatures and your certificate in whatever form is used by your server and the browsers. The only possible response by an authority is revocation of their signature upon discovery that your certificate has been signed by other authorities, too. Such an action would make them a laughingstock.
Isn't the name of the issuing CA inserted into the the blob of ASN.1 that the CA signs?
I'm sure there have been various proposals over the years to allow it, but I don't think current X509 PKI in browsers accepts multiple signers on certs (except for odd cases like countersigned timestamps for Microsoft Authenticode code signing).
Sorry, I was speaking imprecisely and off the top of my head. You of course have to have multiple certificates, but the point is all that is necessary is for all of the certificates to be sent to the browser and for the browser to check them. It's entirely a question of browser<->server interaction.
You can get all of those certificates for the same hostname and key without any of the authorities even knowing the others exist.
Of course there are technical changes necessary in the browsers and web servers, but that's not the point. The SSL trust model is flawed and needs to be fixed, there are precious few options that won't involve some technical changes.
Comments
I don't understand why we trust lone authentication services. They are single points of failure. SSL Certificates should be validated by a collection of independent certificate authorities. If not all of the authorities agree on the certificate, that's a sign there is hacking going on - or a sign that not all of the services have synchronized the certificate.
If we do it this way, a hacker who wants to try to imitate a site can't get away with compromising just one certificate authority. They'd have to compromise all of them, which (if there are enough) would be nearly impossible.
Well, how do you distribute trust? Do you have a quorum or something?
Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
> Well, how do you distribute trust? Do you have a quorum or something?
Basically, yes.
> Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
By not trusting you.
Right now, what happens is the browser and/or OS vendor determines a set of certificate authorities to declare "trusted", and all certificates they issue are simply assumed to be valid.
Instead, we could require, say, three signatures, each from different authorities, to invoke the normal "this is a secure connection to a properly-identified website" behavior.
But each of those authorities was still determined by the vendor to be trustworthy. It's still going to be the likes of e.g. VeriSign, Comodo, StartSSL, etc.. It's not going to be you.
But what if Verisign really doesn't like Bank of America, can they cast doubt on their websites now?
No, but if they could and did, their business would come to an abrupt end when browsers stopped trusting them anyway.
What if everyone did it to some company
That is in no way different than the current situation. If all of the dozens of trusted certificate authorities the world over has decided that they shouldn't provide certs for company X, you should probably be looking to company X for the problem, rather than the authorities.
In any case, users have always had the option of modifying the trust infrastructure or even ignoring it entirely.
Let me rephrase. What if every cert authority might do it to some company (different companies for different cert authorities)
How would you even know if they did?
Although this is perhaps an ill timed suggestion given that it is verisign in the news, I have long thought that DNSSEC would serve as a good mechanism for distributing public keys.
Perhaps in conjunction rather than opposition to the current CA system.
Would like to chat to you about this if possible. Contact info is in my profile if you're happy to get in touch.
"SSL Certificates should be validated by a collection of independent certificate authorities"
That would greatly raise the cost of the SSL certificates. And I don't think that would be something that you could get the various providers to even agree on.
> That would greatly raise the cost of the SSL certificates.
$0 x N is still $0, and the difference between 1 EV certificate and 3 EV certificates is not going to put anybody who really thinks they need one out of business.
> And I don't think that would be something that you could get the various providers to even agree on.
Put simply, certificate authorities don't have a vote. It's up to the browser and OS vendors to set their own requirements for default trust.
If Google, Microsoft, Mozilla, and Apple declare that all SSL certificates lacking at least N valid signatures are treated by default as invalid, that's the ball game. If the current authorities don't play along, new authorities will.
Edit: I should also note that there's really no need for anybody to play along. You can ship a CSR off to as many authorities as you want for signatures, then assemble those signatures and your certificate in whatever form is used by your server and the browsers. The only possible response by an authority is revocation of their signature upon discovery that your certificate has been signed by other authorities, too. Such an action would make them a laughingstock.
Isn't the name of the issuing CA inserted into the the blob of ASN.1 that the CA signs?
I'm sure there have been various proposals over the years to allow it, but I don't think current X509 PKI in browsers accepts multiple signers on certs (except for odd cases like countersigned timestamps for Microsoft Authenticode code signing).
Sorry, I was speaking imprecisely and off the top of my head. You of course have to have multiple certificates, but the point is all that is necessary is for all of the certificates to be sent to the browser and for the browser to check them. It's entirely a question of browser<->server interaction.
You can get all of those certificates for the same hostname and key without any of the authorities even knowing the others exist.
Of course there are technical changes necessary in the browsers and web servers, but that's not the point. The SSL trust model is flawed and needs to be fixed, there are precious few options that won't involve some technical changes.