Re: [Acme] Threat model for claiming domains

Hey Tony,

I just got around to thinking about this for a moment.  Obviously, our
baseline here should be whatever the CAs are doing today, since we have
empirical evidence that those methods are more or less OK.  I did a quick
and dirty empirical survey of the top few CAs this afternoon:

https://docs.google.com/a/ipv.sx/document/d/1KVKIS6abA2KL-yHvFsMql6U3qUjVhgO6p19Hzci0vQo/edit?usp=sharing

For the most part, they rely on sending an email to either the registered
WHOIS contact, or something like admin@domain.  GlobalSign supports
validation based on a DNS record or a <meta> tag in index.html.

With regard to your concern about services colocated on the same IP
(presumably for simpleHttps and DVSNI validation): This seems to mostly be
addressed by not allowing the ACME client to specify the port that the ACME
server connects to.  That means that the attacker has to control not only
something on the box, but the default port for HTTP or HTTPS.  If that's
not the case, normal routing based on the Host header or SNI should ensure
that the validation request goes to the right place.

Nonetheless, I agree that more analysis would be useful, across all the
validation methods.

--Richard

On Mon, Dec 1, 2014 at 7:33 PM, Tony Arcieri <bascule@gmail.com> wrote:
>
> Is there a published threat model for claiming domains? I haven't been
> able to find it, but I'd certainly like to read it!
>
> If we simply accept a service running on the same IP that a given DNS name
> points to, there seems ample opportunity to register certificates for
> services colocated on the same IP.
>
> --
> Tony Arcieri
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme
>
>