PKI

Question 1

X509

Answer 1

Defines Structure for public key certificates

Question 2

Trust Root model

Answer 2

monopoly model: single root of trust
oligarchy model: numerous roots of trust
SCION: Per-domain trust root configuration

Question 3

Approaches to improve TLS

Answer 3

• Let’s Encrypt
• Extended Validation
• HTTP Strict Transport Security (HSTS)
• Certificate Revocation List (CRL)
• Online Certificate Status Protocol (OCSP)
• DNS Based Authentication of Named Entities (DANE)
• HTTP Public-Key Pinning
• Certificate Transparency (CT)

Question 4

Let’s Encrypt

Answer 4

provide free cer1ficates with automatic domain validation, issuance, and renewal
ISSUE: prefix hijacking

Question 5

HSTS

Answer 5

HTTP Strict Transport Security: allows servers to declare that their clients should only use HTTPS (for a specified period)

Question 6

HPKP

Answer 6

The server sends a set of public keys to the client. These keys should be the only ones used for connections to this domain.
ISSUES:
- Trust on First use
- Lost keys
- Pinning renewal before max age is reached can end up in self DoS

Question 7

Certificate Revocation

Answer 7

• After a private key is disclosed
• Trusted employee / administrator leaves corporation
• Certificate expiration time is usually chosen too long (updating certificates is a lot of work)
  ISSUE: CAP theorem Consistency, Availability and Partition tolerance not all possible.

Question 8

OCSP

Answer 8

Online Certificate Status Protocol to verify certificate status, ensure certificate is valid and has not been revoked.
ISSUES:
- Optimistic treatment of OCSP failure
- OCSP can leak browsing information
Solution: OCSP stapling

Question 9

OCSP Stapling:

Answer 9

Server gets signed-timestamped OCSP response from CA and verifies the validity of the cert to the client

Question 10

DANE

Answer 10

DNS-Based Authentication of Named Entities, Use DNS Sec to bind certificates to names
1. CA constraints: clients should only accept certs by these CAs
2. Cert constraints: clients should only accept this cert
3. Trust anchor assertion: clients should use domain-provided trust anchor to validate certificates for that domain
ISSUE: heavy reliance on dnssec

Question 11

Certificate Transparency CT

Answer 11

make cert public knowledge and hold CAs accountable. CT log is add only (Merkle Tree)
- log can be cryptographically verified (Merkle Tree)

Question 12

ARPKI

Answer 12

• Domains obtain cert with mult signatures from different CAs
  Integrity Log Server(ILS) logs domains certificates

Question 13

SCT

Answer 13

Signed certificate timestamp

• issued by log server as promise to add cert to the log
• is used by domain owner to show validity of cert, before cert is added to log

Question 14

problems of SCT with malicious log and CA

Answer 14

• log can issue SCT without adding it to the log, and therefore convince client that cert is valid.
• can be detected by client or CA by checking in retrospect if cert was added

Question 15

branched log attack

Answer 15

log server adds cert to log view 1 but not log view 2. the log server replies with view 1 to client but with view 2 to CA. CA will not detect any forged certs and client accepts cert as valid.

Question 16

privacy problem of log server

Answer 16

log server knows all domains a client wants to access