Subject: [pkix] fyi: Sovereign Keys: an EFF proposal for more secure TLS authentication

From: =JeffH <[email-masked]>
Date: Mon, 21 Nov 2011 16:25:57 -0800

Of possible interest...

Subject: [SSL Observatory] Sovereign Keys: an EFF proposal for more secure
	TLS authentication
From: Peter Eckersley <[email-masked]>
Date: Fri, 18 Nov 2011 14:31:42 -0800
To: [email-masked]

For quite a while at EFF, we've been pondering different possible solutions to
the structural insecurities that are present in PKIX (and, to a lesser but
still quite significant extent, DNSSEC).

This year, our thinking solidified around an idea for using append-only data
structures to store keys.  We are publishing this proposal for the first time
today:

https://eff.org/sovereign-keys

On that page you can find links to a high level overview and detailed design
docs.  The design has a number of nice features, including very strong
resistance to server impersonation attacks and automatic failover to secure
routing methods (ideally, Tor hidden services) when server impersonation
occurrs.

It should be read as a long-term, moderately ambitious proposal.  Even if the
Internet community likes this design or something similar, less systematic
solutions (various forms of pinning, Perspectives/Convergence, the
Decentralized SSL Observatory) will certainly remain necessary and important
for at least a number of years.

-- 
Peter Eckersley                            [email-masked]
Technology Projects Director      Tel  +1 415 436 9333 x131
Electronic Frontier Foundation    Fax  +1 415 436 9993

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 28 Nov 2011 13:49:47 +0000

I really don't see a heck of a lot of conceptual difference between this
proposal and several current and past proposals.  Functionally this is
just pushing the name binding back to a separate  level from the CA, only
now I need to trust both the CA and the Registrar to run things correctly.

Personally I think client-side incorporation of continuity-of-use data
into trust management--either individually or supported by independent
inspection points (see Perspectives, Convergence, or even Google's
Certificate Catalog,
http://googleonlinesecurity.blogspot.com/2011/04/improving-ssl-certificate-
security.html)--probably nets 80% of the benefit and will be much easier
to accomplish in the decentralized Internet.  Yes, there  are observed
issues with current practices at server-side (ref. the SK proposal
Appendix A.3 and the cited blog from Andy Steingruebl), but if a
continuity-type model gains traction operational practice *will* change
and those false positives resolve themselves.

Finally this statement bugs me:

"""
Generalising from the above problem, Perspectives and Convergence rely on
parties other than the domain holder to characterise what state the
domain's operational deployment /should/ be in
"""

This ignores (common?) situation where site owner and domain owner can be
different entities.

-- T

On 11/21/11 6:25 PM, "=JeffH" <[email-masked]> wrote:

>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix