Subject: Re: [saag] [Cfrg] Further MD5 breaks: Creating a rogue CAcertificate

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2009 00:45:19 -0500

--On Thursday, January 08, 2009 05:21:22 PM +1300 Peter Gutmann 
<[email-masked]> wrote:

> Even then it's a rather indirect approach that doesn't really target the
> guilty party since you're scaring the user who is supposed to exert
> pressure on the site which is then supposed to pressure the CA for a fix.

This cuts to the root of the problem: there are no contractual relations 
between a relying party and the cartificate authorities upon whom he 
relies.  As a result, there is no incentive for certificate authorities to 
adopt practices which benefit the relying party.  Instead, the incentive is 
to adopt practices which benefit the CA and its customers, which are the 
parties to whom it issues certificates (but _not_ the parties to whom only 
other CA's issue certificates).

Perhaps a solution to this is a new model.  Under the new model, each 
relying party who chooses to participate would punt the trust anchors that 
come with his or her browser or other software, and instead subscribe to a 
trust anchor service, which for a fee provides a regularly-maintained list 
of trust anchors, or perhaps a single trust anchor which signs "root" CA 
certificates and for which a well-maintained OCSP server is provided.  Such 
a trust anchor service would be an obvious candidate for bundling with ISP 
services or for sale by security software vendors.

The trust anchor service, then, reaches agreements with the various 
certificate authorities, under which the CA is included in the list of 
trust anchors in exchange for the CA agreeing to maintain practices which 
are acceptable to the trust anchor provider.  Note that some browser 
vendors already do essentially this, except that the CA has no contractual 
obligation to the browser vendor to meet the cirteria for inclusion in the 
trust anchor list on an ongoing basis, and the browser vendor has no 
contractual obligation to the users of its product to include only those 
CA's which meet a suitable set of criteria.

-- Jeff

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 08 Jan 2009 20:23:55 +1300

Jeffrey Hutzelman <[email-masked]> writes:

>Perhaps a solution to this is a new model.  

A good start...

>which for a fee provides 

... and it just failed right there.

Peter :-).

---

From: "Liaquat Khan" <[email-masked]>
Date: Thu, 8 Jan 2009 10:35:31 +0400

Jeff, what you describe is similar to the concept of a "validation
authority", which has been around for a while.  A VA service has a
contractual relationship with RPs, and is responsible for responding on
trustworthiness of certificates (and/or signatures).  XKMS/SCVP/DSS
protocols support this concept.  There is at least one commercial entity
(our partner DNV), which is offering such a service currently:
http://www.dnv.com/services/verification/vas/index.asp   

Importantly in addition to validating the trustworthiness of the
certificate, DNV also offer a security quality rating for the certificate
(based on the CA's audited policy/practices, hash and public key algorithms
used and key lengths etc.).  Such a quality rating service is important in
examples like this where a certificate is trusted because it chains to a
trust anchor, but is not considered acceptable because it fails a minimum
quality rating required by the RP. 

However although Ascertia offers products which interface with Validation
Authority service providers, the standard browser is not yet capable of this
and is unlikely to be for some time.  

Regards,
LK 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Jeffrey Hutzelman
Sent: 08 January 2009 09:45
To: Peter Gutmann; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [saag] [Cfrg] Further MD5 breaks: Creating a rogue
CAcertificate

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2009 07:31:09 -0500

> ... and it just failed right there.

Perhaps, but it's fairly well essential.  That fee is the basis for the 
trust anchor provider's contractual obligation to the end user.  Drop that, 
and the whole thing falls apart.

Note that charging a fee for this service is not absurd.  Lots of people 
(consumers) pay fees for up-to-date lists of virus signatures, phishing 
sites, spam-blocking rules, and so on.

-- Jeff

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 09 Jan 2009 02:17:44 +1300

>sites, spam-blocking rules, and so on.

Conceptually it's not absurd, but how are you going to persuade a billion-odd
users that they need to pay for something that they've been conditioned to get
for free?  Will you promise to indemnify them against identity theft (via
phishing) if they sign up to your service?  What value-add will you offer that
will convince the drool-and-click masses to pay for your service?

Peter.

---

From: Theodore Tso <[email-masked]>
Date: Thu, 8 Jan 2009 08:57:52 -0500

On Fri, Jan 09, 2009 at 02:17:44AM +1300, Peter Gutmann wrote:
> 
> Conceptually it's not absurd, but how are you going to persuade a
> billion-odd users that they need to pay for something that they've
> been conditioned to get for free?  Will you promise to indemnify
> them against identity theft (via phishing) if they sign up to your
> service?  What value-add will you offer that will convince the
> drool-and-click masses to pay for your service?

Especially since the market has already come up with a solution that
involves the merchants and the credit card companies bearing the
burden of most fraud losses...

							- Ted

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2009 09:08:22 -0500

--On Friday, January 09, 2009 02:17:44 AM +1300 Peter Gutmann 
<[email-masked]> wrote:

> billion-odd users that they need to pay for something that they've been
> conditioned to get for free?  Will you promise to indemnify them against
> identity theft (via phishing) if they sign up to your service?  What
> value-add will you offer that will convince the drool-and-click masses to
> pay for your service?

Convince the insurance companies to give discounts on "identity theft" 
insurance (yes, this product exists and is pretty common; it covers the 
costs of tracking down and fixing the results of fraud that, under the 
present system, are borne _not_ by the banks or merchants but by the 
individual who was impersonated).

Convince the security software companies to add this service to their 
bundles.  Plenty of people buy that stuff.

Convince the banks to change their rules to make you responsible for 
unauthorized access if it would have been prevented by such a service and 
you weren't using one.

-- Jeff

---

From: "Timothy J. Miller" <[email-masked]>
Date: Thu, 8 Jan 2009 08:20:59 -0600

> sites, spam-blocking rules, and so on.

Actually, most consumers keep these up-to-date only as long as the free 
trial period given to them when they bought the computer lasts, and then 
cease to care.

The core business for these companies is business contracts.

-- Tim

---

From: Theodore Tso <[email-masked]>
Date: Thu, 8 Jan 2009 09:50:58 -0500

On Thu, Jan 08, 2009 at 08:16:33AM -0600, Eric Gray wrote:
> 	The notion of merchants and bankers "bearing the burden" is a
> great fiction - at least if you're considering them as a group.  In
> individual cases, individual merchants/bankers will absorb losses,
> but either that means they go out of business (which we see
> sometimes) or they survive to defray their losses by charging
> consumers more for their products and services.

I didn't say it was a good way to run a railroad --- just as having
more and more people read their news on-line for free, while reporters
are paid via a business model that depends on rapidly diminishing
advertising revenues for print and on-line banner ads, plus the
vanishingly small number of people willing to pay for dead-tree
versions of newspapers is a great way of running things.

But the problem is very similar; if at least in the US, consumers are
used to a model where they only pay for the costs of fraud via a
surcharge which is hidden in the cost of the on-line merchant's
prices, how do you convince them that it is worthwhile to pay for a
trust certification service?  Especially given that a merchant is
still going to have to pay the 3% credit card fee to the credit card
companies, which ends up showing up in the price of goods and/or
services?

> 	Since the consumer ultimately pays the price in any case,
> perhaps a good argument can be made for paying a portion of it up
> front?

>From a public policy POV, perhaps.  How you actually convince the
consumers, merchants, credit card companies, and the rest of the
system to transition from the current scheme to this new scheme is
much more difficult than writing an RFC, alas.  (And as we all know,
writing and publishing RFC is no guarantee that the market will listen
to us.)

						- Ted

---

From: Theodore Tso <[email-masked]>
Date: Thu, 8 Jan 2009 11:34:30 -0500

On Thu, Jan 08, 2009 at 09:11:21AM -0600, Eric Gray wrote:
> 	As a result, some organizations already pay for news-feeds
> from known (verifiably) reliable sources. Because on-line news is
> also valuable because it's quickly delivered.  No matter how you 
> get it, it's not necessarily free.

Some do; some of us even subscribe to dead-tree versions of the
newspapers even though we do most of our reading on-line, on the
general theory that it's good public policy to support the Fourth
Estate (since they serve a critical function keeping the government
honest), even though we do most of our news reading online.  The
problem is very few people are willing to pay for on-line news when
they can get the New York Times at http://www.nytimes.com (and many
other news sources) for free.

> 	As the Heinlein acronym "TANSTAAFL" says, there ain't no
> such thing as a free lunch.  And I suspect that an increasingly
> large number of people are coming to really understand that.

Yes, but there are a huge number of people who are used to receiving a
lot of these services either for free, or bundled into prices (which
have gotten cheaper as a result of e-commerce).  This is basically the
classic Tragedy of the Commons problem; how many people can *honestly*
say that they've never gone to Best Buy or Circuit City to examine
some device or gadget in person, and then gone on to buy it on-line
because it was cheaper?  And did so even though it should be *obvious*
that the TANSTAAFL principle applied, and would in the long-run lead
to the weakening or disappearance of the bricks-and-morter stores?

       		    		     	 - Ted

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 8 Jan 2009 10:20:55 -0800

Folks: is rehashing the blue-sky discussions of how to create a better trust model for SSL without a stable proposal to look at really a good use of the the CFRG, SAAG, S/MIME, and PKIX mailing lists?

If you want to be serious about this, please write an Internet Draft and set up a mailing list for the discussion. Invite people from these lists to join, and maybe announce revisions to your draft. Be sure to invite people from the Mozilla security community: they are having their own (perpetually repeating) discussion of this, again without a stable document to comment on.

We *can* change the security model, but not with the current method of discussion-without-focus.

--Paul Hoffman, Director
--VPN Consortium

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 09 Jan 2009 15:27:35 +1300

"Eric Gray" <[email-masked]> writes:

>Since the consumer ultimately pays the price in any case, perhaps a good
>argument can be made for paying a portion of it up front?

And how are you going to convince the consumer of this?  They get "free"
protection currently with their credit cards, and now they have to pay for it?

(In fact there's already been a case of this failing in the past, when banks
asked customers to pay a little extra to get their photos put on their credit
cards for fraud protection.  Went down like a lead zeppelin).

Anything that involves customers having to pay for something that they
consider as a right to get for free is going to fail before it even starts.
That's actually not as bad as it sounds since it's one of the few hard-and-
fast design guidelines for this area, unlike most other things ("this may or
may not work, depending on the circumstances").

Peter.