Slashdot Mirror
Are Some CAs Too Big To Fail?
Trailrunner7 writes "In the wake of this weekend's revelations of the seriousness of the attack on certificate authority DigiNotar, security experts have renewed criticism of the Internet's digital certificate infrastructure, with some wondering if larger certificate authorities (CAs) might be too big to fail. Would Mozilla and Microsoft and Google have revoked trust in root certificates from VeriSign or Thawte had they been compromised? Unlikely. 'It's not a simple matter of removing certificates from a database, because they're not in any databases,' says researcher Moxie Marlinspike, who presented an alternative approach to the current SSL infrastructure last month at DEFCON. 'We may never track them all down.'"
Maybe we should do a better job of teaching people about computers and technology when they are in high school. CAs are able to get away with poor practices and poor security because most computer uses have no clue what a CA is. If people would start disabling Thawte's certificates en masse, Thawte would be forced to protect its business by regaining the users' trust.
Palm trees and 8
Just to provide some links to the "alternative approach" mentioned in the summary:
* The Perspectives Project spearheaded the concept of independant notary servers instead of a chain-of-trust.
* Convergence is another spin on the same concept, by Moxie Marlinspike in fact. (Not sure if it's compatible w/ Perspectives, but I think it is)
Too big to fail means too big to give a shit. Failure is the motivator for performance. With no cost for bad performance, there is no incentive for good. Just ask the "big" banks, or better yet, ask the customers...
We shouldn't have CAs at all, they have proven themselves irrelevant, untrustworthy and insecure.
Time for a new plug in. Cert Blocker Plus. Automatically updates with a list of certs know to be compromised, questionable, run by governments, or members of the opposing party. :) (Actually, I can see this coming out soon, and if someone patents this, I call prior art!)
I'm not too sure how CA's work, but if till this point we know, say "Thawte" is uncompromised.
Then, secure Thawte, issue new certificates using a different name, say "Thawte2"
Change this name every year or so, securing the previous certificates.
This way, in case of a compromise, only a max. of 1 year of certs are invalidated
Marlinspike's approach, implemented in a Firefox extension presented at DefCon '11, is to do away with the notion of CAs altogether in SSL, replacing it with a distributed network that reports on the certificate they see. Basically, if the certificate you see agrees with the rest of the network, then you're not being spoofed.
He had previously explained the properties a replacement to the CA system had to demonstrate in order to be viable
Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
with Comodo, they only hardcoded some certificate signatures but did not revoke the entire CA. There is another problem: "your website is too small to care". I am not sure if a small business operator will receive the same treatment like they did with Comodo, patch their browsers to protect users of your small site
CAs should be limited to sets of domains, and this enforced in browsers. Country-level CAs should be limited to the country in which they operate. Government CAs should be limited to their domain (".gov", "mil.uk", etc.).
CAs for the open domains should have to post a big bond, which can obtained through a bonding agency if necessary, with a value of at least $10 million, to back up their "relying party agreement".
That's what "corporate responsibility" means - third party bonding.
We regularly find Windows workstations that won't accept a valid certificate from any of several known good servers one of our applications use. Sometimes installing the root certificate solves it, but often it doesn't. Most of the time reinstalling Windows is the only solution.
Microsoft is of no use in these circumstances, as they avoid dealing with root certs at all. The CA also has no answer. Applying root updates, the specific certs, an all-encompassing cert, even removing and reapplying the CA in Windows doesn't always solve it. And yes, 90% of our users never have any trouble. Even clean Windows installs sometimes fail. It's not so simple as malware.
Several things are rotten in SSL. We need something better.
deleting the extra space after periods so i can stay relevant, yeah.
companys that should know better mess up big time ... and it won't change anytime soon, because:
1) Users/Customers dont know that there even is a problem (havent heard about it or do not understand what this is all about anyways). I think that covers about 99.9% of the internet useres
2) If they know, they do not care because it does not affect them directly.
Sure maybe one particular company (DigiNotar in this case) goes down the drain but the chance it hits you are still pretty low. Too low for most managers to hire IT people who actually know what they are doing.
And it will stay this way until wave after wave hits major parts of the population/economy causing massive damage. And I'm talking billions of dollars damage not 1 week of downtime for the PSN. (Okay that did real damage to Sony but who cares.... for most people it was just a minor inconvinience).
Until even the "average Joe" has to ask himself "What the *** is going on here? Where did my money go? Aren't these internet people supposed to prevent this from happening..."
Until then it's more or less pure luck (really stupid scams aside)
Average pay for a server admin, and yet major sites getting hacked left and right, the Net steadily becoming more unsafe all the time: http://www1.salary.com/Client-Server-Database-Administrator-salary.html Must be nice to get paid to fail.
Too big to fail.... Just a sign of the times I guess. Don't expect anything to get better if this is the question we ask ourselves.
I say let failures fail. Lessons shall be learned because of it.
Not even Goliath was too big to fail. Was there seriously bad consequences because of his fall? Absolutely... especially for the Philistines.
'It's not a simple matter of removing certificates from a database, because they're not in any databases,
I don't get this. Removing/replacing a CA cert from trust is easy for browsers/os vendors to do, technically (CA should be on the hook to re-certify certs if they are forced to remove their cert from circulation).
With OSCP, at least *good* certificates *are* in a CA's database, and OSCP will fail for any signed certs that cannot update the OSCP server's hosted copy. Implementation wise, OSCP validation is done poorly, but that's not a flaw of the theoretical design.
There is a whole lot of people calling to throw the baby out with the bathwater in x509, but a 'simple' tweak of mandatory, *affirmative* (no saying 'ok' to server errors or 'try again') OSCP validation to indicate any hint of trustworthiness. If a CA screws up, kick em out.
In terms of more 'radical' changes, I've liked suggestions such as 'require multiple CAs to sign a CSR' and 'publish the CA(s) that are *expected* to be in use via DNSSEC' (requiring attacker to compromise the *specific* CA in use or compromise DNSSEC as well as a CA). I'm wary of key distribution via DNSSEC (requires implementation too pervasive to be practical, theoretically lands you into more dubious territory than current CA model), and I'm wary of Perspectives/Convergence (I'm dubious on how trust gets established in the first place, and I would not be surprised if these systems fell flat on their face under the onslaught of the 'unwashed masses'). Lot's of attacking current state of x509 in the name of advocating some drastic change without enough thought around fixing the weaknesses while preserving the proven strengths.
XML is like violence. If it doesn't solve the problem, use more.
When I hear that something is "Too Big To Fail", I think about 2008 but I also think about USSR. Was the entire country "Too Big To Fail"? How about USA, is it "Too Big To Fail"?
Who can prevent a country from failing?
CA is not a country, but if one CA issues a large number of certificates, then does this CA become too big to fail and do we close our eyes on the problem, which is - CA cannot be trusted?
Can a CA be trusted? Any CA at all? OK, let's turn this around and ask it differently, can a CA be shut down, as in, all certificates signed by that CA revoked and what is the moral hazard of NOT shutting down a CA if one is shown that it cannot be trusted?
Compare this question to the question of moral hazard in the financial industry: how much better is the health of economy now, that financial industry players were deemed "Too Big To Fail" and they were bailed out and stimulated?
Is it better now? Does anybody believe that the economy is better now, that those corporations were not allowed to go bankrupt, as the market required, debts liquidated, assets sold off to pay off some debts in order of priority?
I know the argument that is going to be brought up: counterparties are put at risk. Yes, other banks are put at risk and they will also go bankrupt and shut down and will have to be liquidated, because they assumed risk that was hedged by the counterparties, which are going down.
Same with the CAs, if you shut down the ones that are failing, then what about all the sites out there, whose certificates will stop working? It's not just B2P sites, it's all sorts of certificates that are used in B2B commerce systems, etc.
AFAIC there is no such thing: "Too Big To Fail". You let them fail, you always let them fail. Certificates must be recreated, it will cost businesses something, but it will make them choose their CAs (or whatever other means of doing business), this will increase competition, new ideas will be thrown around, likely many will go with self signed certificates (well many do, I know for a fact that many businesses do use self signed certificates for inter-business stuff).
If you think preventing something that is "Too Big To Fail" from failing with SOLVE the problem, look at the economy today, look at who was bailed out and think again.
You can't handle the truth.
should be nationalized. because if they are as big like that, it means they become infrastructures of strategic kind, which you cannot just let private interests control.
anyone arguing otherwise has to justify not privatizing the army first.
Read radical news here
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea to check certs from different network paths (which doesn't work if your only path is compromised, and how do you secure the communication to the service that does the check for you?).
So here's an alternative idea: Require multiple CAs.
Instead of doing it the "extended validation" way which is more money for not a whole lot more service from the same provider, it'd be much better to have multiple CA signatures on a single cert.
Compromising multiple CAs in the same timeframe to create a cert would be considerably harder than creating one. More importantly, it'd make revoking large CAs much easier.
Let's say that the new norm is to have a site's cert is signed by 5 different CAs, and that the minimum acceptable amount is 3 signatures.
Then, if Verisign gets compromised there's no problem with pulling their cert: you're down to 4 valid signatures on your certificate, which is still fine. That should put considerably more pressure on CAs to perform better.
Even Verisign wouldn't be able to trust that their security problems would be let go due to their popularity, as even the largest CAs would be completely expendable without the end users needing to care much. The site would just go with a different 5th CA to return back to the full strength.
Why doesn't each browser's company put up a certificate revocation server? Then, they can revoke individual certs, including those of the certificate authority, and control the length of the revocation, re-authorization, etc.
Citizens Against Plate Tectonics
I point out that Comodo are compromised twice recently, and not revoked by any browser. As Moxie pointed out in his blackhat talk.
One thing is that I would love a costless distributed solution like the one Marlinspike suggests. I'd much rather trust a large group of peers than a company whose security practices may be questionable. Sure, the peers might be much less secure individually but as a group it's extremely hard to force something onto everybody thus causing manipulative results. If the network both rates the certificates and each other, it's next to impossible to introduce corruption on a level that matters.
Now, given what we have today, the solution is easy:
Regardless of importance - any CA caught being the source of fraudulent certs should be immediately blacklisted so that all certs issued by this CA are rendered useless. It should not even be possible to accept the risk and visits sites using certs from this CA. This will in turn result in massive lawsuits against the CA (just imagine the loss from a company like Amazon being unable to process payments) and thus most likely the complete financial destruction of the CA. The mere prospect of this should make the CA's take their security seriously. I mean if a semi-talented wannabe like this Comodo-hacker can cause this much damage, and perhaps even have gained access to several CA's, their security must be next to non-existent, and that is more than unacceptable.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
What if you publish your own CA with the domain name in the DNS?
You first make an CA and publish your public key as an TXT (or something similar) field to your root domain (name.tld) and using dnssec to make sure it's correct. You can now use that CA to make certs of all the names that you want within your own domain.
If someone tries to make an CA of your name and try to intercept the dns traffic to change the public key, the dnssec would fail and in that case and the CA is invalid?
So here's an alternative idea: Require multiple CAs.
Instead of doing it the "extended validation" way which is more money for not a whole lot more service from the same provider, it'd be much better to have multiple CA signatures on a single cert.
What you are proposing is roughly what the Perspectives project has implemented.