Re: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt

On Thursday 03 Nov 2011 12:57:14 Miller, Timothy J. wrote:
> On 11/3/11 7:37 AM, "Phillip Hallam-Baker" <hallam@gmail.com> wrote:
> >That was the old thinking. It is not the current thinking.
> 
> Maybe not yours, but so far I can't seem to grasp exactly why you think
> that way.
> 
> >In the DigiNotar case, whitelisting could have allowed the issue to be
> >detected much earlier.
> 
> Ok, how?  Give me a scenario.

http://isc.sans.edu/diary.html?storyid=11512

"Some of the CA servers have had parts of their logs deleted, leading to 
DigiNotar not knowing what certificates were issued."

"The OCSP server's working at DigiNotar has been reversed since Sept 1st. 
Normally these servers respond with good to all certificates except those on 
the CRL (a blacklist). The OCSP now operates in whitelist mode: it will call 
all unknown certificates signed by DigiNotar as revoked (a whitelist). 
Hence we need to make sure to use the OCSP server to validate DigiNotar 
certificates -should we want/need to- and not rely on the published CRLs 
anymore."

> >The authoritative source for status information is and always has been
> >the CA certificate database. At present the specs are defective in not
> >supporting disclosure of 'does not exist'.
> 
> DigiNotar and Comodo were attacked through compromised Registration
> Authority account credentials.  The attacker in these cases was acting as
> an authorized RA.  This means that as far as internal processes at the CA
> are concerned, the fraudulent certificates were properly issued and had
> entries in the CA database.

In the Comodo case, yes, the fraudulent certificates did have entries in our CA 
database.  They were detected and revoked within a few hours of being issued.

> Detecting which certificates were frauds required checking the CA database
> against data external to the CA--e.g., paperwork, email, payment records,
> etc.--because the CA database itself was at question.  So where does the
> whitelist fit in again?
> 
> 
> -- T
> 
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix

Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
  3rd Floor, 26 Office Village, Exchange Quay,
  Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by replying
to the e-mail containing this attachment. Replies to this email may be
monitored by Comodo for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no liability
can be accepted and the recipient is requested to use their own virus checking
software.