(note the tidy email editing, Ben, and other blind top posters to massive
email threads :)
See inlne.
On Sun, Dec 16, 2012 at 10:52:37AM +0300, ianG wrote:
[...] we want to prove that a certificate found in an MITM was in the chain
or not.
But (4) we already have that, in a non-cryptographic way. If we find
a certificate that is apparently signed by say VeriSign root and was
found in an MITM, we can simply publish it with the facts. Verisign
are then encouraged to disclose (a) it was ours, (b) it wasn't ours,
or (c) mmmmummm...
Verisign cant claim it wasnt theirs because the signing CA it will be signed
by one of their roots, or a sub-CA thereof. Now one source of suspicion may
be if there are multiple non-revoked, non-expired server certificates for
the same domain (with different private keys). However, there are people
who think multiple certs are a good idea for redundant servers and SSL
terminating equipment - to not have the same private key in multiple
devices (eg say so they can revoke and replace in one suspected compromised
server without replacing them all). Seems kind of dubious to me, but there
you go.
The same server domain with multiple certs (with diff pri keys) one or more
signed by a different CA - even more suspicious. But many people are
certificate tarts - they wil buy the cert on the day from the days cheapest
cert provider, so again inconclusive.
If the server owner claims that cert was not issued to them that is
conclusive but it becomes a who do you trust question. Was the server owner
technically confused (he forgot, the cert issue failed and he did it again
and forgot about that.) The details are done by admins, are they going to
keep a signed, audited, backed up log book of such transient, failures and
try-again during cert issuig. Nopes. Or is the CA compromised, had a rogue
RA, rogue admin, and wants to avoid the embarrassment. Or the CA issued a
duplicate cert on request for law enforcement and doesnt want to admit that.
Dont forget that many government, law enforcement, spy organizations, major
defense contractors, outsourced quasi-governmental spy organizations already
own and operate CAs that are in browser databases, in many countries
uncluding many western countries.
Basically no one will talk or you cant tell who is lying. Quite likely even
neither the CA, nor the domain owner will talk in standard corporate PR
coverup mode.
But if you could prove one of those directions, then you'd be getting
somewhere. Like domain has to prove, in a publicly auditable way, that the
CA cant disavow, ownership of the private key of each cert issued. Then the
domain owner can say that cert isnt mine. And browsers can check that like
they check CRLs now.
Well and thats where these draft protocols come in.
Adam
_______________________________________________
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography
