IETF Logo Mail Archive

Re: [Trans] [therightkey] Dealing with fraudulent certificates via certificate reputation

Anoosh Saboori <ansaboor@microsoft.com> Fri, 28 February 2014 00:09 UTC

Return-Path: <ansaboor@microsoft.com>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD1081A0693; Thu, 27 Feb 2014 16:09:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nbFtC9STt5O7; Thu, 27 Feb 2014 16:09:41 -0800 (PST)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) by ietfa.amsl.com (Postfix) with ESMTP id 39D3D1A0675; Thu, 27 Feb 2014 16:09:40 -0800 (PST)
Received: from BL2PR03MB467.namprd03.prod.outlook.com (10.141.92.23) by BL2PR03MB308.namprd03.prod.outlook.com (10.141.68.26) with Microsoft SMTP Server (TLS) id 15.0.893.10; Fri, 28 Feb 2014 00:09:38 +0000
Received: from BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) by BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) with mapi id 15.00.0883.010; Fri, 28 Feb 2014 00:09:38 +0000
From: Anoosh Saboori <ansaboor@microsoft.com>
To: Ben Laurie <benl@google.com>
Thread-Topic: [therightkey] Dealing with fraudulent certificates via certificate reputation
Thread-Index: AQHPMveDNG7tget80U+9jLu2RXaAKprJy79g
Date: Fri, 28 Feb 2014 00:09:37 +0000
Message-ID: <3d3218434709470cb720c71d76e560f4@BL2PR03MB467.namprd03.prod.outlook.com>
References: <873b20cac6834d9cb347dee1e131dad2@BL2PR03MB467.namprd03.prod.outlook.com> <CABrd9SQRQVH2YuoWzQDqFj6YvxjHuUJfDF30fUTANXy-d4tTYQ@mail.gmail.com>
In-Reply-To: <CABrd9SQRQVH2YuoWzQDqFj6YvxjHuUJfDF30fUTANXy-d4tTYQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [2001:4898:80e0:ee43::3]
x-forefront-prvs: 0136C1DDA4
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(24454002)(189002)(377454003)(13464003)(51704005)(199002)(69226001)(80022001)(15202345003)(81686001)(74316001)(95416001)(19580395003)(94946001)(65816001)(59766001)(77982001)(81542001)(80976001)(63696002)(86362001)(81342001)(74366001)(94316002)(83322001)(19580405001)(85306002)(4396001)(15975445006)(93516002)(93136001)(53806001)(31966008)(54356001)(561944002)(90146001)(92566001)(83072002)(74662001)(56776001)(74502001)(79102001)(76576001)(74706001)(33646001)(76482001)(51856001)(47736001)(47976001)(2656002)(81816001)(50986001)(49866001)(87266001)(54316002)(95666003)(46102001)(76796001)(47446002)(74876001)(87936001)(85852003)(24736002)(3826001); DIR:OUT; SFP:1101; SCL:1; SRVR:BL2PR03MB308; H:BL2PR03MB467.namprd03.prod.outlook.com; CLIP:2001:4898:80e0:ee43::3; FPR:6E3EF2A4.9EF3EFC2.FFD30D33.48CA3F2D.202F2; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (: microsoft.com does not designate permitted sender hosts)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/IrI_ibNw03RHCACQFxmQAQDNT9o
Cc: Anthony Nadalin <tonynad@microsoft.com>, "therightkey@ietf.org" <therightkey@ietf.org>, "trans@ietf.org" <trans@ietf.org>, Melinda Shore <melinda.shore@gmail.com>, Nelly Porter <nellyp@exchange.microsoft.com>, Magnus Nystrom <mnystrom@microsoft.com>
Subject: Re: [Trans] [therightkey] Dealing with fraudulent certificates via certificate reputation
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Feb 2014 00:09:45 -0000

Thank you, Ben. In the blog, there are few suggestions around how site owners can be notified when changes to their certificates  are detected. This technically allows the site owner to be in full control of decision making with respect to "his" certificates and decide whether newly reported certificates are fraudulent or not. This solution has some interesting privacy preserving properties to it that we would like to present at the WG meeting. You are right that the goal of this proposal is not to provide public logs.

-----Original Message-----
From: Ben Laurie [mailto:benl@google.com] 
Sent: Wednesday, February 26, 2014 5:35 AM
To: Anoosh Saboori
Cc: Melinda Shore; trans@ietf.org; Magnus Nystrom; Anthony Nadalin; therightkey@ietf.org; Nelly Porter
Subject: Re: [therightkey] Dealing with fraudulent certificates via certificate reputation

On 25 February 2014 02:01, Anoosh Saboori <ansaboor@microsoft.com> wrote:
> Hello,
>
> We would like to introduce certificate reputation, which was shipped as part of IE 11. This feature aims to address  some of the issues with Web PKI that were raised by Diginotar and Comodo incidents. We asked to take few minutes on the trans WG meeting in the next IETF meeting to present this feature and chairs requested us to start a thread on this in WG mailing list. Please see below for description of this feature.
>
> http://blogs.technet.com/b/pki/archive/2014/02/22/a-novel-method-in-ie
> 11-for-dealing-with-fraudulent-digital-certificates.aspx

I think this is great stuff, but is it appropriate for trans? It doesn't involve a public log at all (why not?) - perhaps better suited for the tls WG meeting? Or are you considering aligning with the goals of the trans WG?

v2.23.0 | Report a Bug | By Email