Re: [TLS] Certificate validation can of worms

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Apr 8, 2014 at 12:05 PM, Watson Ladd <[e-mail]> wrote:

>> The requirement to mark the certificate critical enabled the NSA
>> attack on Microsoft in the Flame malware attack. Marking the bit
>> critical makes it impossible to issue a certificate with that
>> extension as about half a billion deployed devices don't support name
>> constraints.
>
> ?? Flame was a MD5 collision. Nothing saves you from that one.

Had name constraints been deployable and deployed, the Microsoft CA
that the NSA attacked could have been locked down to mitigate the
consequences of a breach.


>> The consensus model does not really work when a specification has been
>> poisoned by an attacker who can block changes to correct the spec.
>> Fortunately IETF specifications are not definitive, industry practice
>> is. The industry consensus on this point is unanimous: name
>> constraints need not be marked critical.
>
> Which makes them useless: the point of name constraints is that I can
> issue a name constrained certificate without issuing a global
> intermediate CA certificate. If the extension is not marked critical,
> then I've issued a global intermediate CA certificate for those who
> don't check it, and so need to be just as strict as if it was an
> intermediate CA certificate, so I might as well not bother with the
> constraint.

Again, you don't get the idea that redundant controls have value. Even
though I have full control over the signing key for a sub-ca, there is
no reason for the sub-ca to have the power to issue any cert so why
grant it?

Least privilege is a powerful tool. The IETF had no business telling
people they couldn't use it.

You have no idea what my requirements or constraints are. So why
presume to tell us what is or is not useful?

The IETF was following an outdated mode of security thinking. One that
is unfortunately very common in US government contractor circles.


A MUST is only justified when there is a serious negative consequence
from not following it. There is no serious consequence that follows
from not marking a name constraint critical in the context in which it
is now used in the industry.

The clear industry consensus is that name constraints MAY be marked as
non-critical.

-- 
Website: http://hallambaker.com/