Google security researchers Ben Laurie and Adam Langley propose a new way in which digital certificates are issued and verified, to make sure that situations in which CAs issue them unknowingly will become rare or even inexistent.
In a paper called “
Certificate Authority Transparency and Auditability” Laurey and Langley state that another important objective is to make sure that users are protected against unlawfully issued certificates.
The method they propose is pretty straightforward and simple, but its deployment will be difficult, especially if others don’t cooperate.
“Firstly, every publicly visible certificate should be published in a publicly auditable certificate log. Secondly, each certificate issued must be accompanied by an audit proof. Thirdly, servers must send these proofs along with the certificates to browsers, and browsers must check them,” reveals the paper.
The final step would require domains owners to monitor these public logs to make sure that no rogue certificates were issued.
While in theory it may all sound easy, in practice there are some things that could prove to be problematic to this approach.
In a blog post, Langley claims that everyone needs to be “in” in order for the scheme to function properly. On the bright side, since certificates need to be renewed anyway, the proposition could be adopted incrementally by all the parties involved.
Side-channels are another problem since if they’re used to check up on the logs, the lookup would be asynchronous, not to mention the functionality, performance and privacy issues that may emerge from using this technique.
Read more>>
