SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust

Chuat, Laurent; Abdou, AbdelRahman; Sasse, Ralf; Sprenger, Christoph; Basin, David; Perrig, Adrian

doi:10.1109/eurosp48549.2020.00046

Cited by 22 publications

(22 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Shorter certificate lifespan is a healthier security practice [40], but might lead to functional and security problems as, e.g., management and operational costs increase [13]. Over the past several years, the security community has been advocating for shorter certificate expiry windows for the web.…”

Section: Expiry Windowsmentioning

confidence: 99%

Comparative Analysis of DoT and HTTPS Certificate Ecosystems

Jahromi¹,

Abdou²

2021

Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web

Self Cite

View full text Add to dashboard Cite

Systemd-resolved", among others, have implemented DoT stub-resolvers [16]. As a result, DoT queries have increased over the Internet since 2018 [27]. Similar to securing web (HTTPS) and email (S/MIME), DoT in the Internet relies on the Internet's Public Key Infrastructure (PKI) and associated Certification Authorities (CAs) for signing and delivering resolvers' standard X.509 certificates.On security, we investigate whether DoT would be susceptible to classic (or historic) PKI shortcomings, such as invalid/self-signed certificates, weak cryptographic parameters, or fraudulent certificates issued by compromised CAs. Over time, browsers enhanced HTTPS security by stringent certificate validation and indispensable demand of security features, like the placement of certificates in Certificate Transparency (CT) logs [38], [6]; CAs have accordingly been steppingup their issuance standards. It is unclear how many of the browser-implemented reinforcements for HTTPS are adopted in DoT, and how the relatively lax security in DoT affects issued certificates. For example, successful authentication [4] and encryption are unnecessary in DoT depending on the client's configured usage profile (see opportunistic mode in RFC 7858 [42]).We present results upon comparing a random sample of DoT and HTTPS certificates collected from Rapid7 [32]. Particularly, this paper contributes results upon comparing DoT and HTTPS certificates for the following aspects: Distribution and characteristics of certificate issuers (Sec. IV). Certificate parameters, including validity windows and cipher-suites (Sec. V). Proportion and distribution of certificates in CT-logs (Sec. VI).Our results highlight non-major differences between both ecosystems, including differences in: the dominant CA, certificate validity, and cryptographic properties. The proportion of invalid certificates appears almost similar in both ecosystems, likewise the expiry windows and cryptographic functions. We also found almost equivalent rates of CT-log inclusion in both ecosystems. These results suggest that so far, the deployment and usage of DoT certificates in practice appears promising, and not significantly affected by the lack of strict security checks in sub-resolvers.

show abstract

Section: Expiry Windowsmentioning

confidence: 99%

Comparative Analysis of DoT and HTTPS Certificate Ecosystems

Jahromi¹,

Abdou²

2021

Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web

Self Cite

View full text Add to dashboard Cite

show abstract

“…Certificate revocation should be an integral part of any PKI design, but it is a vast and active research area in and of itself [9]. Several revocation schemes have been proposed in academic literature in the last few years, but browser vendors have also developed and deployed their own schemes [45], [37].…”

Section: On the Multi-certificate Approachmentioning

confidence: 99%

F-PKI: Enabling Innovation and Trust Flexibility in the HTTPS Public-Key Infrastructure

Chuat,

Krähenbühl,

Mittal

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

We present F-PKI, an enhancement to the HTTPS public-key infrastructure that gives trust flexibility to both clients and domain owners while giving certification authorities (CAs) means to enforce stronger security measures. In today's web PKI, all CAs are equally trusted, and security is defined by the weakest link. We address this problem by introducing trust flexibility in two dimensions: with F-PKI, each domain owner can define a domain policy (specifying, for example, which CAs are authorized to issue certificates for their domain name) and each client can set or choose a validation policy based on trust levels. F-PKI thus supports a property that is sorely needed in today's Internet: trust heterogeneity. Different parties can express different trust preferences while still being able to verify all certificates. In contrast, today's web PKI only allows clients to fully distrust suspicious/misbehaving CAs, which is likely to cause collateral damage in the form of legitimate certificates being rejected. Our contribution is to present a system that is backward compatible, provides sensible security properties to both clients and domain owners, ensures the verifiability of all certificates, and prevents downgrade attacks. Furthermore, F-PKI provides a ground for innovation, as it gives CAs an incentive to deploy new security measures to attract more customers, without having these measures undercut by vulnerable CAs.

show abstract

“…To improve the performance of the open journal system in disseminating information, we need a system to overcome this. [22]…”

Section: Problem Analysismentioning

confidence: 99%

Utilization of Blockchain Technology for Management E-Certificate Open Journal System

Agustin¹,

Aini²,

Khoirunisa³

et al. 2020

ATM

View full text Add to dashboard Cite

The application of blockchain technology in e-certificates in the open journal system is needed to validate and distribute managed e-certificates in each journal issue. With tools in the form of conceptualized and managed blockcerts allows users to use and verify the authenticity of e-certificates that are closely linked to the blockchain. Observation on the open journal system and applied blockchain tools in the form of blockcerts as a place to issue e-certificates with guaranteed security so that e-certificates are verified as well as managed data. Issuance of e-certificates is still considered unsafe because it can be easily forged. Specifically, this study produced two benefits, namely: (1) Issuance of e-certificates in an open journal system is more verified, data is managed and there will not be duplications or even falsification of e-certificates. (2) The reputation of the open journal system is better with a sense of trust. This research uses library study method by implementing e-certificate in an open journal system with blockchain technology tools such as blockcerts. In order that the results of the e-certificate issuance go well and to avoid any crime that threatens the authenticity of the e-certificate, this blockchain is used to guarantee that the e-certificate is safe and not easily falsified, duplicated or even easily replaced by those not granted access rights. By using blockchain technology, the data collected will be well managed and not easily falsified.

show abstract

SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust

Cited by 22 publications

References 34 publications

Comparative Analysis of DoT and HTTPS Certificate Ecosystems

Comparative Analysis of DoT and HTTPS Certificate Ecosystems

F-PKI: Enabling Innovation and Trust Flexibility in the HTTPS Public-Key Infrastructure

Utilization of Blockchain Technology for Management E-Certificate Open Journal System

Contact Info

Product

Resources

About