PBCert: Privacy-Preserving Blockchain-Based Certificate Status Validation Toward Mass Storage Management

Abstract

In the recent years, the vulnerabilities of conventional public key infrastructure are exposed by the real-world attacks, such as the certificate authority's single-point-of-failure or clients' private information leakage. Aimed at the first issue, one type of approach is that multiple entities are introduced to assist the certificate operations, including registration, update, and revocation. However, it is inefficient in computation. Another type is to make the certificate information publicly visible by bringing in the log servers. Nevertheless, the data synchronization among log servers may lead to network latency. Based on the second approach, the blockchain-based public key infrastructure schemes are proposed. Through these type of schemes, all the certificate operations are stored in the blockchain for public audit. However, the issue of revoked certificates' status storage is worth paying attention, especially in the setting with massive certificates. In addition, the target web server that a client wants to access is exposed in the process of certificate status validation. In this paper, we propose a privacy-preserving blockchain-based certificate status validation scheme called PBCert to solve these two issues. First, we separate the revoked certificates control and storage plane. Only the minimal control information (namely, certificate hashes and related operation block height) is stored in the blockchain and it uses external data stores for the detailed information about all revoked certificates. Second, we design an obscure response to the clients' certificate status query for the purpose of privacy preserving. Through the security analysis and experiment evaluation, our scheme is significant in practice. INDEX TERMSPublic key infrastructure, blockchain, revocation mechanism, privacy-preserving.

Cross-Certification Towards Distributed Authentication Infrastructure: A Case of Hyperledger Fabric

“…Yao et al [25] developed a privacy-preserving blockchainbased certificate status validation scheme (PBCert). It stores certificate operations in a blockchain to support public audits and efficient revocation checking, which uses the online certificate status protocol.…”

“…In these scenarios, the attack is successful if is not detected by the verifier via VAL-Tx because the purpose of the attacker is to make trust . Cecoin [17] BlockPGP [18] Bubbles of Trust [19] CTB [22] CertLedger [23] PBCert [25] Meta-PKI (this work) This section considers an attack in which the attacker takes over a Meta-CA and adds to the CA_CERT section of the ledger.…”

Attack-Resilient TLS Certificate Transparency

“…CertChain adopted the Ouroboros [44] as a consensus algorithm, which relies on CA and bookkeeper's reputation for a leader selection. PBCert [45] identified shortcomings in CertChain and proposed enhancement to mitigate the issues. CertLegder [41] presented a PKI framework where all certificate-related operations and data are handled on a blockchain medium.…”

SCM: Secure and accountable TLS certificate management

“…Certchain uses Ouroboros 60 as consensus algorithms, which is based on the ranking of a bookkeeper or a CA for a leader selection. PBCert 61 identified and mitigated some privacy‐ and efficiency‐related issues through the separation of certificate revocation control and storage plane. However, PBCert uses data structure and consensus algorithm of Certchain, which is vulnerable to MitM attacks in case of a dishonest bookkeeper 18 …”