Certificate transparency

From Wikipedia, the free encyclopedia

Certificate Transparency is an open framework for monitoring and auditing digital certificates. Through a system of certificate logs, monitors, and auditors, Certificate Transparency allows web site users and domain owners to identify mistakenly or maliciously issued certificates and to identify certificate authorities (CAs) that have gone rogue.

Background

Flaws in the current system of digital certificate management became evident in recent high-profile security and privacy breaches caused by fraudulent certificates. Ben Laurie and Adam Langley conceived certificate transparency and an implementation of the framework is being developed as an open source project.

Advantages

One of the problems with digital certificate management is that fraudulent certificates take a long time to be spotted, reported and revoked by the browser vendors. Certificate Transparency would help by making it impossible for a certificate to be issued for a domain without the domain owner knowing. Certificate transparency does not require side channel communication to validate certificates as do some competing technologies such as Online Certificate Status Protocol (OCSP) and Convergence. Certificate Transparency also operates without the need to trust a third party.

Certificate transparency logs

Certificate transparency depends on verifiable Certificate transparency logs. A log appends new certificates to an ever-growing Merkle hash tree.[1] To be seen as behaving correctly, a log must:

  • Verify that each submitted certificate or precertificate has a valid signature chain leading back to a trusted root Certificate Authority certificate.
  • Refuse to publish certificates without this valid signature chain.
  • Store the entire verification chain from the newly accepted certificate back to the root certificate.
  • Present this chain for auditing upon request.

A log may accept certificates that are not yet fully valid and certificates that have expired.

Certificate transparency monitors

Monitors act as clients to the log servers. Monitors check logs to make sure they are behaving correctly. An inconsistency is used to prove that a log has not behaved correctly, and the signatures on the log's data structure (the Merkle tree) prevent the log from denying that misbehavior.

Certificate transparency auditors

Auditors also act as clients to the log servers. Certificate transparency auditors use partial information about a log to verify the log against other partial information they have.[2]

Certificate Authority Implementation

In September, 2013, Digicert became the first certificate authority to implement Certificate Transparency.[3]

Google is currently running a pilot Certificate Transparency log. Google has announced that it will deploy at least 3 production CT logs in December 2013. Soon after the production logs are deployed, the Google Chrome browser will begin enforcing Certificate Transparency for Extended Validation (EV) Certificates.

References

  1. ↑ Laurie, et al. "RFC 6962 - Certificate Transparency Section 3". The Internet Engineering Task Force. Retrieved 2013-11-20. 
  2. ↑ Laurie, et al. "RFC 6962 - Certificate Transparency Section 5.4". The Internet Engineering Task Force. Retrieved 2013-11-20. 
  3. ↑ "DigiCert Announces Certificate Transparency Support". Dark Reading. Retrieved 2013-11-12. 

External links

  • Internet Engineering Task Force RFC Document
  • Certificate-transparency.org
This article is issued from Wikipedia. The text is available under the Creative Commons Attribution/Share Alike; additional terms may apply for the media files.