Efficient gossip protocols for verifying the consistency of Certificate logs

Abstract

Abstract-The level of trust accorded to certification authorities has been decreasing over the last few years as several cases of misbehavior and compromise have been observed. Logbased approaches, such as Certificate Transparency, ensure that fraudulent TLS certificates become publicly visible. However, a key element that log-based approaches still lack is a way for clients to verify that the log behaves in a consistent and honest manner. This task is challenging due to privacy, efficiency, and deployability reasons. In this paper, we propose the first (to the best of our knowledge) gossip protocols that enable the detection of log inconsistencies. We analyze these protocols and present the results of a simulation based on real Internet traffic traces. We also give a deployment plan, discuss technical issues, and present an implementation.

A First Look at the CT Landscape: Certificate Transparency Logs in Practice

“…In addition, by comparing with the certificates, keys, and domains observed in 232 million HTTPS sessions on a university network, we demonstrate how the coverage of the crawled logs captures the certificates observed during typical internet usage and that popular domains appear to be more willing to pay the extra cost of EV certificates. Future work could try to intercept the exchange of SCTs, so to also capture the potential validation that clients could do directly with the CT logs or the additional protection against partitioning that gossiping [6,21] and client-to-client communication may offer.…”

“…Again, the newer logs (with fewer entries) stick out with a large fraction SHA1 certificates. These certificates have been added relatively recently and include a large fraction weaker self-signed SHA1 test certificates from Google CT. One explanation that the outphasing of SHA1 is taking a long time is that many service providers, including Facebook and Twitter, are concerned that millions of users with older devices would lose access to their services and therefore want to delay the outphasing of SHA1 6 . With Facebook and Twitter only being responsible for 287 and 9 of the 250,000 most recently logged SHA1 certificates in the Pilot log, many other service providers also appear to be stalling.…”

DECIM: Detecting Endpoint Compromise In Messaging

“…This would allow the attacker to play man-in-the-middle attacks, preventing the sender and receiver ever exchanging information about the log digests they have. In DECIM, users can detect such attacks by gossiping with their contacts, for example, through an out-of-band channel as used in Signal [12], or through a gossip protocol [26]- [28] as recommended by Google CT [18] and CONIKS [7]. Such a procedure will ensure that the log maintainer is not misbehaving.…”

BlockPKI: An Automated, Resilient, and Transparent Public-Key Infrastructure

“…Although the log's contents can be consulted and proved to be consistent, log servers can choose to ignore queries. Finally, to avoid a split-world attack, in which a malicious log server would show inconsistent versions of the log to different clients, a gossip protocol is needed [10]. Consequently, in order to tolerate a malicious or compromised CA, every certificate issuance should involve multiple CAs and all operations should be logged securely and in a fully distributed way.…”