Server-side Adoption of Certificate Transparency Carl Nykvist, - - PowerPoint PPT Presentation

▶
server side adoption of certificate transparency
SMART_READER_LITE
LIVE PREVIEW

Server-side Adoption of Certificate Transparency Carl Nykvist, - - PowerPoint PPT Presentation

Mar 03, 2023 381 likes •1.12k views

Server-side Adoption of Certificate Transparency Carl Nykvist, Linkping University Linus Sjstrm, Linkping University Josef Gustafsson, Linkping University Niklas Carlsson, Linkping University Proc. PAM , Berlin, Germany, Mar. 2018

slide-1
SLIDE 1

Server-side Adoption of Certificate Transparency

Carl Nykvist, Linköping University Linus Sjöström, Linköping University Josef Gustafsson, Linköping University Niklas Carlsson, Linköping University

  • Proc. PAM, Berlin, Germany, Mar. 2018
slide-2
SLIDE 2

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS

slide-3
SLIDE 3

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

slide-4
SLIDE 4

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

slide-5
SLIDE 5

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s User need to trust FB’s public key is FBs

slide-6
SLIDE 6

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s User need to trust FB’s public key is FB’s

slide-7
SLIDE 7

Motivation and high-level problem

  • Private and confidential communication important
  • Billions of devices
  • Millions of services
  • Certification Authorities (CAs) issue certificates
  • Proof of identity (signed with their private key)

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

slide-8
SLIDE 8

Motivation and high-level problem

  • If CAs in our trust (root) store (e.g., Symantec/

Verisign) tells us that a public key belongs to Google,

  • ur browsers (and us) trust that this is the case

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

slide-9
SLIDE 9

Motivation and high-level problem

  • If CAs in our trust (root) store (e.g., Symantec/

Verisign) tells us that a public key belongs to Google,

  • ur browsers (and us) trust that this is the case

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Trusted CA This is Google’s public key …

slide-10
SLIDE 10

Motivation and high-level problem

  • However, mistakes happen ...
  • E.g., in Oct. 2015, Google discovered (using CT) that

Symantec had issued test certificates for 76 domains that they did not own (including Google domains) and another 2,458 unregistered domains …

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Symantec (Trusted CA) This is Google’s public key … Some server

slide-11
SLIDE 11

CT: Emerging trust-monitoring solution

  • Since then, Google has demanded that Symantec logs

all their certificates in public (append-only) CT logs

  • Since Jan. 2015, the Chrome browser requires all EV

certificates be logged in 1 Google log and 1 other log

  • Mozilla planning to make similar demands
  • Both Chrome and Mozilla expected to implement policies

for DV certificates too …

slide-12
SLIDE 12

CT: Emerging trust-monitoring solution

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Symantec (Trusted CA) This is Google’s public key … Some server

slide-13
SLIDE 13

CT: Emerging trust-monitoring solution

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Symantec (Trusted CA) This is Google’s public key … Some server CT log

slide-14
SLIDE 14

CT: Emerging trust-monitoring solution

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Symantec (Trusted CA) This is Google’s public key … Some server ... and here is a proof that the cert has been logged. CT log

S S

slide-15
SLIDE 15

CT: Emerging trust-monitoring solution

E.g., HTTPS does HTTP over TLS User need to trust Google’s public key is Google’s

Symantec (Trusted CA)

Certificate

Some server

Signed Certificate Timestamp (SCT)

L

S

slide-16
SLIDE 16

Signed Certificate Timestamps (SCTs)

  • SCTs delivered three different ways
  • X.509v3 extension
  • TLS extension
  • OSCP stapling
  • In this paper, we characterize and compare
  • Server-side usage of these methods
  • Client-side performance of these methods
slide-17
SLIDE 17

Background

slide-18
SLIDE 18

Certification of public keys

slide-19
SLIDE 19

Certification of public keys

slide-20
SLIDE 20

Certification of public keys

Browser Server

slide-21
SLIDE 21

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)

R R

CA Browser Server

slide-22
SLIDE 22

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)

R R

CA Browser Server CA

R R

slide-23
SLIDE 23

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)

R R

CA Browser Server

slide-24
SLIDE 24

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)
  • CAs use private key to sign certs for servers/domains
  • Certs are proof that public key belongs to server/domain

R L L

CA Browser Server

slide-25
SLIDE 25

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)
  • CAs use private key to sign certs for servers/domains
  • Certs are proof that public key belongs to server/domain
  • Signature of certs can be validated using keys in root store

R L

CA Browser Server

L

slide-26
SLIDE 26

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)
  • CAs use private key to sign certs for servers/domains
  • Certs are proof that public key belongs to server/domain
  • Signature of certs can be validated using keys in root store

R L R L

CA Browser Server

L

slide-27
SLIDE 27

Certification of public keys

R L R L

CA Browser Server

L

This is server X’s public key, signed with private key

  • f CA

Trust store include CA’s root cert (and public key)

slide-28
SLIDE 28

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)
  • CAs use private key to sign certs for servers/domains
  • Certs are proof that public key belongs to server/domain
  • Signature of certs can be validated using keys in root store
  • In practice, many
  • Many CAs, servers
  • Varying trust+security

R L R L

CA Browser Server

L

slide-29
SLIDE 29

Certification of public keys

  • Browsers have trust stores with root certs (of CAs)
  • CAs use private key to sign certs for servers/domains
  • Certs are proof that public key belongs to server/domain
  • Signature of certs can be validated using keys in root store
  • In practice, many
  • Many CAs, servers
  • Varying trust+security
slide-30
SLIDE 30

Certification Transparency (CT)

slide-31
SLIDE 31

Certification Transparency (CT)

Log Log Log Log

L S S S

  • Logs
  • Public record of certs
  • Append only (Merkle trees)
  • Create SCTs
  • SCTs
  • Proof cert is logged
slide-32
SLIDE 32

Certification Transparency (CT)

Log Log Log Log

L S S S

  • Logs
  • Public record of certs
  • Append only (Merkle trees)
  • Create SCTs
  • SCTs
  • Proof cert is logged
slide-33
SLIDE 33

Certification Transparency (CT)

Log Log Log Log

L S S S

  • Logs
  • Public record of certs
  • Append only (Merkle trees)
  • Create SCTs
  • SCTs
  • Proof cert is logged
slide-34
SLIDE 34

Certification Transparency (CT)

Log Log Log Log

L S S S

  • Logs
  • Public record of certs
  • Append only (Merkle trees)
  • Create SCTs
  • SCTs
  • Proof cert is logged
slide-35
SLIDE 35

Three SCT delivery methods

slide-36
SLIDE 36

Three SCT delivery methods

slide-37
SLIDE 37

Three SCT delivery methods

slide-38
SLIDE 38

Three SCT delivery methods

slide-39
SLIDE 39

Bigger picture

slide-40
SLIDE 40

Log Log Log Log Monitor

L S S

Bigger picture

  • Last year’s (PAM ‘17)
  • Monitor: All public logs
  • Campus measurements:

All HTTPS sessions for a week

  • This paper (PAM ’18)
  • Server-side SCT usage
  • Client-side performance
  • Other related work
  • Gasser et al. (PAM ‘18),

Amann et al. (IMC ‘17), VanderSloot et al.(IMC ‘16)

slide-41
SLIDE 41

Bigger picture

  • Last year’s (PAM ‘17)
  • Monitor: All public logs
  • Campus measurements:

All HTTPS sessions for a week

  • This paper (PAM ’18)
  • Server-side SCT usage
  • Client-side performance
  • Other related work
  • Gasser et al. (PAM ‘18),

Amann et al. (IMC ‘17), VanderSloot et al.(IMC ‘16) Log Log Log Log Monitor

L S S S

Alexa top 1M SCTs

slide-42
SLIDE 42

Results

slide-43
SLIDE 43

Dataset overview

  • Method
  • Alexa top-1M
  • Two snapshots: May 31 (2017) and Oct. 6 (2017)
  • Single machine, 600 parallel threads (approx. 4 hours)
  • SCT usage increase across all methods
  • X.509v3 dominates (easiest method for server domains)

4+ months

slide-44
SLIDE 44

Popularity-based breakdown

slide-45
SLIDE 45

Popularity-based breakdown

May 2017 Oct 2017

slide-46
SLIDE 46

Popularity-based breakdown

  • SCT usage highest among most popular domains
  • TLS usage highest among most popular domains
slide-47
SLIDE 47

Popularity-based breakdown

  • SCT usage highest among most popular domains
  • TLS usage highest among most popular domains
slide-48
SLIDE 48

Popularity-based breakdown

  • SCT usage highest among most popular domains
  • TLS usage highest among most popular domains
slide-49
SLIDE 49

Number of SCTs per certificate

  • Many SCTs per certificate
  • TLS typically has 2 or 3
  • The other have higher diversity
slide-50
SLIDE 50

Number of SCTs per certificate

  • Many SCTs per certificate
  • TLS typically has 2 or 3
  • The other have higher diversity
slide-51
SLIDE 51

Number of SCTs per certificate

  • Many SCTs per certificate
  • TLS typically has 2 or 3
  • The other have higher diversity
slide-52
SLIDE 52

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind)
slide-53
SLIDE 53

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind)
slide-54
SLIDE 54

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind ...)
slide-55
SLIDE 55

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind ...)
slide-56
SLIDE 56

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind ...)
slide-57
SLIDE 57

Log usage

  • A few dominating logs
  • Big differences in TLS frequency among CA logs
  • Wosign almost only TLS
  • Aviator (frozen on Nov 29, 2016) almost only X.509v3
  • Again, TLS is increasing (but way behind ...)
slide-58
SLIDE 58

Certificate type

  • X.509v3 dominates EV
  • Rush to get a solution ...
  • Simplest method
  • OV certificates have highest fraction TLS
  • Google issued domains largest fraction here (7,858 / 8,374)
  • Comodo dominates TLS in DV (19,458 / 21,378)
slide-59
SLIDE 59

Certificate type

  • X.509v3 dominates EV
  • Rush to get a solution ...
  • Simplest method
  • OV certificates have highest fraction TLS
  • Google issued domains largest fraction here (7,858 / 8,374)
  • Comodo dominates TLS in DV (19,458 / 21,378)
slide-60
SLIDE 60

Certificate type

  • X.509v3 dominates EV
  • Rush to get a solution ...
  • Simplest method
  • OV certificates have highest fraction TLS
  • Google issued domains largest fraction here (7,858 / 8,374)
  • Comodo dominates TLS in DV (19,458 / 21,378)
slide-61
SLIDE 61

Certificate type

  • X.509v3 dominates EV
  • Rush to get a solution ...
  • Simplest method
  • OV certificates have highest fraction TLS
  • Google issued domains largest fraction here (7,858 / 8,374)
  • Comodo dominates TLS in DV (19,458 / 21,378)
slide-62
SLIDE 62

Signatures (and keys)

  • RSA dominates all but TLS
  • TLS include 65% ECDSA signed and Elliptic Curve (EC) keys
  • Non-SCTs weaker signatures (and shorter keys)
slide-63
SLIDE 63

Signatures (and keys)

  • RSA dominates all but TLS
  • TLS include 65% ECDSA signed and Elliptic Curve (EC) keys
  • Non-SCTs weaker signatures (and shorter keys)
slide-64
SLIDE 64

Signatures (and keys)

  • RSA dominates all but TLS
  • TLS include 65% ECDSA signed and Elliptic Curve (EC) keys
  • Non-SCTs weaker signatures (and shorter keys)
slide-65
SLIDE 65

Signatures (and keys)

  • RSA dominates all but TLS
  • TLS include 65% ECDSA signed and Elliptic Curve (EC) keys
  • Non-SCTs weaker signatures (and shorter keys)
slide-66
SLIDE 66

Handshake and delivery times

  • TLS much faster than

the other methods

  • X.509v3 similar to

non-SCT

slide-67
SLIDE 67

Handshake and delivery times

  • TLS much faster than

the other methods

  • X.509v3 similar to

non-SCT

slide-68
SLIDE 68

Handshake and delivery times

  • TLS much faster than

the other methods

  • X.509v3 similar to

non-SCT

slide-69
SLIDE 69

Handshake and delivery times

  • Google fastest, with

short tail

  • Comodo and other

TLS domains both

  • utperform X.509

domains

  • TLS much faster than

the other methods

  • X.509v3 similar to

non-SCT

slide-70
SLIDE 70

Byte overhead

  • The SCT bundles have negligible byte overhead
  • Otherwise SCT byte differences mostly due to bundle sizes

and other differences dominated by the certificates themselves (keys included)

slide-71
SLIDE 71

Conclusions

  • SCT analysis: current status and trend
  • Two snapshots (May and Oct. 2017) of Alexa top-1M
  • SCT usage is highest among the very top domains,

hopefully pushing others to follow

  • Majority of domains selects simplest solution (X.509v3)
  • Fastest delivery method (TLS) is used by organizations

(e.g., Google) that appear to provide much faster connection establishment and handshake times

  • SCT delivery has low overhead
  • Positive and encouraging trends in the adoption
  • Overall increase in use of SCTs
  • Use of SCTs goes hand-in-hand with a reduced use of

weak signatures and public keys

  • Big players such as Google are pushing the adoption
slide-72
SLIDE 72

Niklas Carlsson (niklas.carlsson@liu.se)

www.ida.liu.se/~nikca/

Thanks for listening!

Server-side Adoption of Certificate Transparency

Carl Nykvist, Linus Sjöström, Josef Gustafsson, Niklas Carlsson