Re: [TLS] [certid] fyi: paper on compelled, certificate creation attack and applicable appliance

[Daniel Kahn Gillmor <[e-mail]>]

On 03/25/2010 01:40 PM, Marsh Ray wrote:
> The only reason that the world isn't up-in-arms about it is that 59% of
> PCs are pwned by malware already, making the slightly more complicated
> mitm attack unnecessary.
> 
> However, there are important uses of SSL/TLS other than end user web
> browsers. These are probably better off with just the minimal number of
> trusted roots on the clients. But if you're going to the trouble of
> reconfiguring your clients anyway, why not just set up your own private CA?

Running your own X.509 CA works if your goal is only
intra-organizational communication.  As soon as you want to federate
communication with external organizations, running your own CA is
insufficient with X.509, because the model only allows a single
certifier per certificate.

>> There is nothing we can do besides examining chain of trust manually
>> and watching for certificate changes.
> 
> We could implement our protocols such that the remote peer is required
> to satisfy multiple chains of trust.
> 
> When a chain is only as strong as its weakest link, it's best to have
> several of them (in a redundant configuration).

This is possible today using out-of-band OpenPGP certification, which
permits multiple certifiers per certificate.

 http://web.monkeysphere.info/

We currently have it working bidirectionally for openssh and
unidirectionally (firefox browsers can authenticate servers) for https.
 More is coming soon, and feedback is welcome, particularly from folks
who are interested in TLS mechanisms.

>> The TOFU technology described
>> there is quite obvious, i always wondered why ssh has it and browsers
>> do not.
> 
> In theory, SSH's approach is inferior to SSL's PKI. In practice it's not
> inferior only to the extent that the user is good at scrutinizing the
> new keys he gets presented.
> 
> If you want that behavior in a web browser, just delete all your trusted
> root certs and add a persistent explicit trust whenever you see a cert
> the first time. (I have tried this in Firefox)

I believe you can do this system-wide with firefox and other
mozilla-based browsers by removing the nssckbi shared library
(/usr/lib/nss/libnssckbi.so on debian, a .dll someplace on windows),
which provides the pre-defined list of root CAs.

	--dkg