Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Yoav Nir <[e-mail]>]

On Jun 8, 2011, at 7:58 PM, Marsh Ray wrote:

> On 06/08/2011 03:37 AM, Yoav Nir wrote:
>> 
>> What did Comodo fail to do?
> 
> If this question is seriously being asked by one as knowledgeable as 
> Yoav :-), it suggests to me that the problem is being way over-thinked. 
> So forgive me, I'm just going to re-state this bluntly:
> 
> The entire value proposition of PKI is based on the trusted root CAs 
> refusing to issue fraudulent certs and in this case Comodo, a trusted 
> root, failed to refuse to issue certain fraudulent certs.

Similarly, the value proposition of the DMV is to not issue a driver's license with the name "Marsh Ray" to people who are not Marsh Ray. These days you don't even have to know how to drive.

There is an established "best practice" for how the DMV ascertains who you are: they examine birth certificates, they check street address, etc.

Suppose I go to some RA or CA, and ask for a certificate for www.yoavnir.com, what are they going to do to check?

Obviously, they can check the whois database. This has:

> Registrant:
>    Yoav Nir
> 
>    Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
>    Domain Name: YOAVNIR.COM
> 
>    Domain servers in listed order:
>       NS1.GISIGHT.CO.IL
>       NS2.GISIGHT.CO.IL
> 
> 
>    For complete domain details go to:
>    http://who.godaddy.com/whoischeck.aspx?Domain=YOAVNIR.COM


So far, so good. The registrant name is indeed "Yoav Nir". But we're probably doing this through web or email, so how can they know that I'm actually the same "Yoav Nir"?  Or a "Yoav Nir" at all?  We can check through the link to godaddy (I've removed some of the information):

> Registrant:
> Yoav Nir
> Amir 1 N/A N/A Kibbutz Amir N/A,12140 Fax. [phone] 
> 
> Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
> Domain Name: YOAVNIR.COM
> Created on: 14-Sep-08
> Expires on: 14-Sep-12
> Last Updated on: 25-Jun-10
> 
> Administrative Contact:
> Nir, Yoav [e-mail]
> Amir 1 N/A N/A Kibbutz Amir N/A,12140 Fax. [phone] 
> Tel. [phone]
> 
> Technical Contact:
> Ltd., Interspace [e-mail]
> 19 Yad Harutzim St. Netanya null,42505 Tel. [phone] 

This gives some new information. We have an administrative contact: "[e-mail]" and a technical contact: "[e-mail]"

I have never actually bought an SSL certificate, so I don't know, but I'll have to assume that part of the automated process involves email to one of these addresses. There are also phone numbers, but I can't imagine a DV certificate that costs $10-$40 involving an international phone call by a human.

That's where I would fail. I don't control these email addresses, and the site belongs to another Yoav Nir who's in a totally different line of business.

This is the simple check that a diligent CA can do. But this is as long as the CA is a single entity. 

I don't know of any best practices document that says anything about the division of responsibility between the CA and RA. Is it OK to have only the RA perform the whois check?  Sure, but then what is the added value of the CA?  The reason I like CAA is that it gives an extra layer of security for the CA to perform even assuming that the RA has been subverted.

The way things stand now, I don't see what Comodo could have done differently technically. Sure, we can say that they should not have had a business relationship with an RA that was so easily hackable. Similarly, Verisign should now have allowed rapidssl to use such bad practices. But at the time of the attack, I don't see what check Comodo could have done.


Others (like Peter Gutmann and Bruce Schneier) have written about this before. The model for HTTPS security is what's broken, not a particular CA. There are just too many single points of failure. CAA is an attempt to make the existing model somewhat better, by adding another layer of security - a security check that the CA can do after the RA has already approved the transaction. DANE is a more revolutionary solution that aims to replace or supplement the existing model. I think both have value, with CAA having value much sooner.

Yoav