Improving PKI Solution Analysis in Case of CA Compromisation
Total Page：16
File Type：pdf, Size：1020Kb
Master Game and Media Technology Improving PKI Solution analysis in case of CA compromisation Samira Zaker Soltani January 2013 Utrecht University Faculty Computer Science Deloitte Nederland Deloitte Risk Services Supervisors: Gerard Tel - Univeristy Utrecht Henk Marsman - Deloitte Nederland To my mother, for she is the reason. Abstract Creating a secure connection on the Internet is made possible through the usage of certificates, binding an entity to its public key. These certificates can be issued by any of the Certificate Authorities (CA), where each CA has the same privileges. During the last year, we have seen many CA compromises, resulting into the issuance of fraudulent certificates. Fraudulent certificates can be used, in combination with the man-in-the-middle attack, to eavesdrop the communications of Internet users. This research focuses on solutions that can remove or limit the impact of a CA com- promisation and provides a description and analysis of each solution. The solutions have been chosen through interviews and literature. Among the discussed solutions are Public Key Pinning, Sovereign Keys, Certificate Transparency, Perspectives & Convergence, DANE, and MCS. In order to identify each solution’s advantages and disadvantages, we have created a metric of aspects. The aspects have been categorized into security, usability, and costs. The focus of this research has been on security, since that is the aspect in Public Key Infrastructure we are trying to solve. The results indicate that Certificate Transparency and DANE are the most promis- ing solutions for limiting the risks of a compromised CA. Further research will be needed to complete each solution, since both solutions are not yet ready for deploy- ment. v Preface This document presents my master thesis for Game and Media Technology at the Utrecht University. The research and work was done between July 2012 and Jan- uary 2013 at the Security & Privacy team of Deloitte Nederland in Amstelveen. My supervisors were Henk Marsman from Deloitte Nederland and Gerard Tel from Utrecht University. Acknowledgment I am grateful to Gerard Tel for his guidance during this master thesis, the inspir- ing discussions, encouragements, and for giving me the freedom to take this project into the direction that I found most interesting. I would also like to express my sincere appreciations to Henk Marsman for his extensive vision, great wisdom, and for helping me to better structure my master thesis. I would also like to thank the interviewees, who helped me to develop the indispensable information that was needed for this research. Without the interviewees, this master thesis would not have been the same. Finally, I would like to thank my colleges for the enlightening discussions, remarks, and for the overall atmosphere that made my stay at Deloitte very pleasant and enjoyable. Samira Zaker Soltani vii Contents Abstract v Acknowledgments vii 1. Introduction 1 1.1. Motivation . .3 1.1.1. DigiNotar . .4 1.2. Goal . .6 1.2.1. Research questions . .6 1.2.2. Research restrictions . .7 1.3. Approach . .7 1.3.1. Solution aspects . .7 2. Public Key Infrastructure 11 2.1. Overview . 11 2.2. Cryptography . 11 2.2.1. Symmetric key cryptography . 12 2.2.2. Public key cryptography . 12 2.3. Public Key Infrastructure . 16 2.4. Certificates . 18 2.4.1. X.509 . 18 2.4.2. Certificate Validation . 20 2.4.3. Certification Path . 22 2.5. Certificate Authority (CA) . 23 2.5.1. Cross-domain certification . 24 2.6. PKI weaknesses . 24 2.6.1. Audit reports . 25 2.6.2. Automatic processes . 26 2.6.3. Trust anchor . 26 2.6.4. Trust in CAs . 27 2.6.5. The weakest link . 27 2.6.6. Competition between CAs . 28 3. Companies and certificates 29 3.1. Risks of certificates . 30 ix 3.2. Measurements . 31 3.2.1. Prevent . 31 3.2.2. Detect . 32 3.2.3. Limit . 32 3.2.4. Correct . 32 4. Game companies 35 4.1. Cheating classification . 36 4.2. Possible solutions . 37 4.2.1. Game level solutions . 37 4.2.2. Application level solutions . 38 4.2.3. Protocol level solutions . 40 4.2.4. Infrastructure level solutions . 41 4.3. Games & PKI . 41 4.3.1. Authenticator: How does it work? . 42 5. Possible PKI solutions 43 5.1. Overview . 43 5.2. Public Key Pinning . 45 5.2.1. Analysis . 46 5.2.2. Solution aspects . 47 5.3. Perspectives & Convergence . 49 5.3.1. Analysis . 52 5.3.2. Solution aspects . 54 5.4. Sovereign Keys . 55 5.4.1. Analysis . 58 5.4.2. Solution aspects . 60 5.5. Certificate Transparency (CT) . 62 5.5.1. Analysis . 64 5.5.2. Solution aspects . 65 5.6. DNS-based Authentication of Named Entities (DANE) . 67 5.6.1. Analysis . 71 5.6.2. Solution aspects . 72 5.7. Multiple Certificate Signatures (MCS) . 74 5.7.1. Solution aspects . 76 6. Conclusion 79 A. Appendix: Interviews 83 A.1. Roland van Rijswijk and Gijs van den Broek - SURFnet . 83 A.1.1. Introduction ................................... 83 A.1.2. Current PKI model . 85 A.1.3. DNSsec . 86 x A.2. Program Manager Information Security - Governmental organization 89 A.3. Cooperative Information Security Officer - The Company . 91 A.3.1. Possible solutions to PKI . 92 A.4. Dr. Benne de Weger - University Eindhoven . 93 A.4.1. Solutions . 94 A.5. Pablo Valcárcel and Tanausú Cerdeña Hernández - Geosophic . 95 A.6. Co-founder - Game company . 97 A.7. Game hacker . 98 A.7.1. Possible security solutions and their drawbacks . 99 A.7.2. How do you perform reverse engineering . 101 A.7.3. Certificates . 101 A.8. Game developer - Game company . 101 A.8.1. Security Issues . 102 A.8.2. Banning cheaters . 103 A.8.3. Platforms . 104 A.8.4. Which data would be put in the cloud, if this was possible? . 104 Bibliography 105 xi 1. Introduction Internet security has become more and more important since the Internet started changing our world and E-commerce became a part of our business and personal life. In the late 90’s, Public Key Infrastructures (PKIs) were widely recognized as an essential ingredient to provide secure electronic communications and transactions in open environments [FB00, FW98]. The most important goal of PKI is to secure the communication between parties in an insecure public network, such as the Internet, and make sure the parties communicate with the parties they think they are communicating with. In the last year, however, PKI has shown not to be as bullet proof as we hoped it would be. PKI works through the use of certificates, which can be thought of as digital pass- ports. These digital passports are issued by Certificate Authorities (CAs) to various parties. A certificate guarantees a party’s identity, allowing the party to identify itself towards users on the Internet. Users can validate the certificate authenticity by checking if the certificate has been issued by a trusted CA. Once the certificate has been validated, the user can start communicating with the party corresponding to the certificate. If a CA is not trusted by the user, they can refuse to start a communication with the party presenting the certificate. To not burden users with the choice between the approximately 600 CA organizations in the world, this choice is performed by the user’s browser and operating system software. Most users will never change these settings and keep trusting the default set of CAs [Lan11f]. PKI has a design weakness though, granting all CAs to issue certificates for any domain, which will be accepted by users trusting the CA. Compromised, but still trusted CAs, can issue certificates for any domain and use these certificates to de- ceive users into thinking the certificates are from the righteous party. This means that when a by browsers trusted CA is compromised, many users will trust the fraudulently issued certificates. This weakness was shown in practice when DigiNotar, a trusted CA, was com- promised and used to issue fraudulent certificates for domains such as Google and Yahoo! in 2011. Using these certificates, the attackers could, for example, pretend to be a legitimate website, where visitors would submit their credentials such as username and password, as the presented certificates seemed valid. Although the chance of a CA compromisation was thought to be very little, after some trusted CAs were compromised in 2011, with the most important incident being the DigiNotar compromisation in July 2011 [Dig12], it became clear that this 1 Chapter 1 Introduction was not the case. The incidents revealed some interesting problems in PKI, regard- ing trust anchor management, the dependency of the complete Internet PKI on the weakest trusted CA, the lack of preparation at companies when a CA compromisa- tion occurs and many more weaknesses. Of course, if the compromised CA would be detected immediately, there would be little to no problem, depending on the time frame. However, if we take DigiNotar as an example, we can see it took a couple of months before the trust in DigiNotar was revoked by all browser and operating system vendors, giving the hacker enough time to use the fraudulently issued certificates. The only thing we know for sure, regarding the DigiNotar incident, is that the OCSP requests were mostly from Iran [Pri11]. OCSP is an Internet protocol used to obtain the status of a certificate. When users want to know the status of a certificate, they can send an OCSP re- quest to the corresponding CA. The CA will then answer whether the certificate is still valid or not. In the case of DigiNotar, they were able to revoke most of the fraudulently issued certificates.