Abridging Certication Authorities DRAFT - Please do

AbridgingCertificationAuthoritiesDRAFT-PleasedonotdistributeMatthiasJacobPrincetonUniversitymjacob@tractCertificatesheyarehighlytrustedentitiesthatcanonlybeissuedbyafewtrustedcertificationauthorities(CAs),theyareacostlysecuritycomponentintoday’r,alargepartoftheInternet’orealterna-tivestotheold-fashionedCAstructureandcometotheconclusionthattheseapproachesprovidecompletelysuffitheselow-volumeserversdonotevenusecer-tificatesbecausetotlter-nativetechniques,whendeployed,willbeaninexpen-sivewayforissuingcertificatesandhenceincreasingtrustandsecurityinnetworks.1IntroductionInsecurecommunicationsuchasanSSLconnectionoveranetworkitisacommonproblemtomatchanon-lineidentirentso-lutiontothisproblemisthedeploymentofcertifily-trustedCertificationAuthorities(CA)verifywhetherthematchingbetweenahost’sDNSnameandpublickeyiscorrectandissueacertifippenzellerStanfordUniversityappenz@ingtheinitiationofthesecurecommunication,forexampleusingSSL,rtificateexiststhegenuinenessofahost’versinthenetworkarere-sponsibleforresolvingahost’sDNSnametoitsIPaddress,butitisawell-knownfactthatDNSserversarepronetoattacksinwhichanadversaryspoofstheDNSnameandmatcr,certifi,certificatesarehighlytrusted,sotheCAneedstocheckexternaldocumentationwhenitissuesacertifi,itiscrucialthattheprivatesigningkeyoftheCAdoesnotleak,,CAshavetodistributethepublickeyforcheckingthecertificatestotheclients,,ultisthatformanyhostssuchaslow-volumewebserversornodesinpeer-to-peernetworksobtainingcertifiommunitythereexistsastrongde-sireforcheapcertificates[5,1,4].However,sofar,tpopularcurrentlyavailablealternativetohighlytrustedcertifi-catesarelow-costcertificates[3,18].Intheverifica-tionprocessforthesecertificatestheCAsendsasin-gleverifihisprocessisquickandconvenient,anattackercanin-terceptthisverificationemailandforgethecertifiubtfulthatthisisaviablewaytocertifytrustinaserver.

Inthispaperweprovideanovelapproachtocheapcer-tifirvethatastate-of-the-artCAdecideswhethertocertifyahostsolelybasedoninformationitobtainsatthetimethehostrequeststhecertifiheCAhasissuedthecertificateitisvalidoveralongtimeperiod(ars).Inordertoinvali-datethecertificatetheCAhastomanuallypublishitonitscertificaterevocationlist(CRL)[16].TheprocessofmanuallyverifyingtrustinahostandpublishingtheCRLsisexpensive,tedious,andunreliable.1.1Time-basedtrustedauthenticationWeapproachtheproblemofissuingcheapcertificatesbyusing“trustovertime”:Whenahostconsistentlyrespondswiththesamepublickeyintheinitialpublitheassumacommonprincipleinthephysicalworld,editreportshowswhetherapotlienthasbeeningoodstandingoversometimeperiod,paperwedevelopCAsthatinitiateSSLcon-nectionsperiodicallyinordertofiu-tomaticallyadjuststhehost’strustlevelandissuesanewcertifihecertificationprocessworksautomaticallythesecertificatescanhavefiner-grainedexpirationdatesthantheX.509certifition2partdefinesimportanttermsofthecertifihowtomaketheCAaccountableandwhatthesecurityguaranteesareinsection4,andfinallyexplaininsection5howafullydistributedCAworks.2X.509CertificationSystemInthispaperweample,inacliensneedtomakesurethattheyarecommunicatingwiththerightserver,andhence,theyrequestthecer-tificatethatverifiized,thetypicalnetworkcon-sistsofthefollowingcomponents:•Client:Aclientinitiatesaconnertoexchangedatasecurelytheclientneedstoascertainthatitpossessesthepub-lickeythatmatchestheserver’entusescertificatestoverifywhetherthepublickeyfromtheserveristhecorrectone,•Server:AserverprovidesnetworkservicestoclientsandpublishestotheclientthatthepublickeybelongstotheservertheCAissuesacertificatethatcontainsthispublickeyandtheserver’sDNSname.•CertificationAuthority(CA):Thecertificationauthorityissuescertifier-tificatescontaininformationabouttheserver’ficateintheX.509speci-ficationalsocontainsinformationaboutthephys-icalidentityoftheserverandaccesspolicies,lly,aserveraskstheCAtoissueacertifisoper-ationtheserverpassesalongtotheCAitsDNSnameserver,itspublickeypk,andsomeexternalidentifiheckingexternalidentificationtheCAreturnsthecertificatecontainingtheDNSnameandthe

server{server, pk, id}clientserverCAcert(server, pk)cert(server, pk)Figure1:TheroleofthecertifirusesaprivatekeyfentcontactstheserverbyusingitsDNSnameandgetsthecorrectpublickeyintheserver’scertifiy,theclienttruststheCA,heassumptionthattrustistransitive,hence,ignsthecertifientinthesystemcannowrequestacertifientverifiesthesignatureofthecertificateand,ifvalid,obtainsthepublickeypk.•issuecertificate(server)(client→server):(server:client→server)⇒({certCA(server,pk)}:server→client)OncetheCAhasissuedacertificateitisvaliduntilitsexpirationdategivenonthecertifificatebecomesinvalidbeforeitsexpirationdatewhentheCApublishesitonaCRLthatcontainsalistofallinvalidcertificates.2.1SecurityAnalysisWeguaranteethesexistthreekindofattacks:First,anadversarycanma-nipulateanycontentsaserver,,,anad-versarycancompromisetheCAandgettheprivatesigningkey:•Attacksfromthenetwork:Sincethecertificationauthoritysignsallcertifi-catesitisnotpossibleforanadversarytomodifyorforgecertifihecertificationprocessdoesnottakeplaceon-lineduetoexternalidentification,modifyingtheserver’rsarycanspooftheDNSresolutionbe-tweenclientandserverinwhichcasetheclientgetsredirectedtoadifferentphysicalhost,butinordertoverifyapublickeythishostneedstohaveavalidcertificate.•Compromisingservers:Whenanadversarycompromisesaserveranditsprivatekeyleakstheadversarycandecryptallmessagestheserverreceives,buttheadversarycannotchangethekeywithoutgettinganewcer-tificasetheCAneedstoputthecer-tificateontifi-catecannotprotectagainstpassiveattackswhentheadversarycompromisestheserver.•CompromisingtheCA:versarycompromisestheCAandobtainstheprivatesigningkeytheadversarycanissuefalsecertificasthecrucialcomponentofthesystem,andithastospendalotofeffortinprotectingthepri-vatesigningkeyfromleakingwhichisoneoftherea-sonscertificatesareexpensive,extsectionwefirstlookintohowwecanauto-matetheprocessofcertifyingaserversuchthatcostlyverificationofexternalidentificationisnotnecessaryanymore.3CAusingtrustovertimeTheweaknessinthestandardX.509certificationau-thoritysystemistoestablishtrustbetweentheCAand

eedstoverifyoffly,theCAverifiesthismappingbyexaminingexternalidenti-ficationsuchasadriver’rtogetaroundthisexpensiveverificationmethodweapplythe“trustovertime”principletothecertifiverhasacertaintrustleveltheCAissuesthecertificate,orevensim-pler,itjustissuesacertifistablishesthetrustlevelbycheckingperiod-icallywheerver’eserverwantstoobtainacertificateitsubmitsitsDNShostnameandpublickeytotheCAandreceivesacertificateoftrustlevelt