Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Marsh Ray <[e-mail]>]

On 06/08/2011 03:37 AM, Yoav Nir wrote:
>
> What did Comodo fail to do?

If this question is seriously being asked by one as knowledgeable as 
Yoav :-), it suggests to me that the problem is being way over-thinked. 
So forgive me, I'm just going to re-state this bluntly:

The entire value proposition of PKI is based on the trusted root CAs 
refusing to issue fraudulent certs and in this case Comodo, a trusted 
root, failed to refuse to issue certain fraudulent certs.

> The RA is handing contact with the customer, so it's their job to
> make sure that the customer is in fact the owner of the domain name
> in the certificate request.

These legal agreements and auditing procedures only amount to one thing: 
after the victim has been (possibly irreparably) harmed by the issuance 
of a fraudulent certificate, then some legal entity is in a technical 
violation of contract with some other legal entity.

In this case, I've heard of no serious repurcussions other than the loss 
of image to the CA and the RAs. Certainly significant for Comodo, but 
most of the press coverage doesn't even mention the names of the hacked RAs.

Is the CA suing any hacked RA for breach of contract? Are they even 
terminating their agreements?

Are browser vendors removing any root CAs or blacklisting any sub-CAs 
due to this?

What are the costs paid for this debacle as perceived by others with the 
authority to cause the immediate issuance of certs?  Most importantly, 
will these costs always be perceived higher than the immediate gain of a 
corrupt transaction? This is not to suggest any corruption in this case 
of course, but it is surely not going unnoticed for the future that the 
CA, the RAs, and the individuals involved all demonstrated effective 
deniability.

This seems like a good test case to either support or refute the 
arguments of those who claim that policies, auditing, and legal 
agreements between CAs/RAs/subCAs are an effective way to produce strong 
security.

- Marsh