Progress in Simulating Water Well Performance on Mars

Hoffman, Stephen J.; Andrews, Alida; Watts, K.D.; Lever, J. H.

doi:10.2514/6.2020-4040

Cited by 1 publication

(1 citation statement)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also propose a standardized mechanism for primary root stores to quickly push changes (both routine certificate additions/removals and GCCs) to derivatives. These mechanisms will help minimize the vulnerability window after a root CA is deprecated, the incompatibility window when a new root CA becomes trusted [30], and the discrepancy between the all-or-nothing trust of derivatives and the more nuanced trust of primary root stores.…”

Section: Introductionmentioning

confidence: 99%

No Root Store Left Behind

Larisch,

Aqeel,

Chung

et al. 2023

Proceedings of the 22nd ACM Workshop on Hot Topics in Networks

View full text Add to dashboard Cite

When a root certificate authority (CA) in the Web PKI misbehaves, primary root-store operators such as Mozilla and Google respond by distrusting that CA. However, full distrust is often too broad, so root stores often implement partial distrust of roots, such as only accepting a root for a subset of domains. Unfortunately, derivative root stores (e.g., Debian and Android) that mirror decisions made by primary root stores are often out-of-date and cannot implement partial distrust, leaving TLS applications vulnerable.We propose augmenting root stores with per-certificate programs called General Certificate Constraints (GCCs) that precisely control the trust of root certificates. We propose that primary root-store operators write GCCs and distribute them, along with routine root certificate additions and removals, to all root stores in the Web PKI. To justify our arguments, we review specific instances of CA certificate mis-issuance over the last decade that resulted in partial distrust of roots that derivative root stores were unable to precisely mirror. We also review prior work that illustrates the alarming lag between primary and derivative root stores. We discuss preliminary designs for GCC deployment and how GCCs could enable pre-emptive restrictions on CA power. CCS Concepts• Security and privacy → Web protocol security; Logic and verification; • Networks → Transport protocols.

show abstract

Section: Introductionmentioning

confidence: 99%