through h4x0r3d's eyes

#SSL fix aims to mend huge cracks in 'Net's foundation of trust

Under the Mutually Endorsing CA Infrastructure proposal, end users would rely on Notaries to confirm the validity of digital certificates presented by Google Mail and other SSL-protected websites.

Open-source software developer Kai Engert has proposed an overhaul to the Internet’s SSL authentication system, aiming to minimize the damage that would result from the compromise of one of the authorities trusted by major browsers.

Under version 2 (PDF) of Engert’s Mutually Endorsing CA Infrastructure proposal, people connecting to Google Mail, Twitter and other sites protected by SSL would draw on one of three randomly selected notaries to verify that the digital credential being presented is valid. By comparing the SSL certificate’s contents to data contained in the voucher returned by the notary, the person’s Web browser or e-mail program could quickly spot credentials that have been forged, even when they’ve been signed using the private key of a legitimate certificate authority. The notaries—or “voucher authorities” as they’re called—would be made up of existing CAs.

“The introduction and requirement of vouchers has the benefit that controlling a single CA will no longer be sufficient,” Engert, a software developer at Red Hat and a contributor to the Mozilla Project’s security team, wrote in the proposal. “If the presence of a valid voucher were mandatory, at least two CAs would have to be involved to create a working rogue identity, one CA signing the certificate, another CA using its VA to produce a voucher.”

At a minimum, the vouchers would contain a cryptographic hash of the certificate the end user wants to access, a single IP address used by the site, a timestamp recording when the data was collected, and a digital signature using the underlying VA’s private key. It might also include data concerning intermediate certificates used by the SSL certificate, recent OCSP—or online certificate status protocol—responses for the certificate and intermediate certificates, and proof that the VA signing certificate hasn’t been revoked.

Fractures in the Web’s foundation of trust

Critics have complained for years that the web of trust used to prevent eavesdropping on webmail, banking transactions, and other sensitive Internet-based sessions is hopelessly broken. With more than 600 entities authorized to mint certificates that are trusted by major browsers, all it takes is the compromise of one of them for an attacker to forge a credential for any site. That point was dramatically underscored last year when hackers breached Netherlands-based DigiNotar and created counterfeit credentials for Google Mail, Mozilla’s add-ons download site, and other sensitive services. The Gmail certificate alone was used to snoop on an estimated 300,000 Gmail users, an audit later showed.

Since then, a flurry of competing alternatives and enhancements to the fractured SSL system have surfaced. Among them is Convergence, proposed by Moxie Marlinspike, a researcher who has repeatedly exposed serious flaws in the underlying SSL protocol. Convergence relies on a loose confederation of notaries that independently vouch for the validity of a given SSL certificate. One of the key benefits of the system is a “trust agility” that allows users to query specific notaries they trust.

It also provides privacy protections not available with regular SSL. Under the current system, certificate authorities track huge numbers of requests for SSL-protected websites and map them to individual IP addresses. Convergence uses two separate notaries that are intentionally kept in the dark when vouching for a certificate. One notary gets to see the IP address of the Convergence user but not the SSL certificate she wants validated. The other one sees the certificate but not the IP address.

Last year, Convergence got a strong endorsement from security firm Qualys, when it deployed two notary servers. Developers for the Google Chrome, meanwhile, have said they have no plans to add it to the browser.

Google researchers have proposed their own fixes (PDF) for the ailing SSL system. Under their new system, CAs would be required to publish the cryptographic details of every credential they sign to a publicly accessible log that’s also been cryptographically signed to guarantee its accuracy. Some CAs have baulked at the proposal, saying it would require them to part with proprietary customer data. The Google plan would also place technical burdens on websites and browser makers, these critics have said.

The latest proposal comes a day after Ivan Ristic of Qualys released a set of SSL/TLS deployment best practices (PDF) that administrators can follow to avoid common configuration mistakes. He said that his company has conducted surveys and found that two-thirds of all SSL servers are badly set up and that of the remaining third “many have application-level issues that fully compromise SSL.”

“The truth is that most experts are attracted to the CA trust problem, but, in reality, most SSL installations fail because of configuration and implementation errors,” he added.

“Like speaking with a corpse in your mouth”

The changes envisioned by Engert are in many ways similar to Convergence, except that notaries would be limited to existing CAs and would be chosen randomly by the client software rather than by the end user. Marlinspike characterized the difference as a major shortcoming.

“This is just Convergence without the good parts,” he wrote in an email. “The problem we need to solve is the lack of trust agility in the CA system. Speaking about solutions to the CA system which don’t provide trust agility is like speaking with a corpse in your mouth.”

The proposed fix is also receiving a chilly reception from some CAs. Comodo Senior Scientist Phillip Hallam Baker wrote: “It might help if implemented. But probably not very much. Having two parties do essentially the same check in the same way is not likely to result in much reduction in risk.”

In his own email to Ars, Engert said the proposal is an update to one he first floated (PDF) at a security conference late last year.

“The document v2 is the result of thinking about the initial ideas more, taking into consideration the thoughts and feedback that I had received from various sources,” he wrote. “I’m hoping my proposal can be helpful inspiration for finding a solution for the trust problem.”