2 Fixed math on #4
source | link

why do we not require websites to be validated by, say, 3 certificates of independent CAs?

Here are a few reasons:

  1. Cost. Purchasing certificates is already somewhat expensive*; tripling that expense - and forcing purchasers to wade deeper into the pool of potential CAs, where they usually start at the cheap end - would not be welcomed.

  2. Complexity. Currently, if a certificate expires, the site is offline or degraded until IT can scurry around and fix it. It happens surprisingly often given that expiration dates are known and can be planned for. Your proposal would triple the number of certificates that need to be installed correctly, that need to be replaced before expiration, that need correct certificate chains... Some of this stuff is hard enough today with just one CA!

  3. Compatibility. The TLS protocols do not specify a method of operation where multiple certificates must be validated, so you'd have to update or replace the protocol being used, which will take years. There's no way to specify to the client that this particular server requires multi-certificate validation, so downgrade attacks are trivial - again, you'd need to create a method, and then wait years for support to percolate out.

  4. Certificate Pinning. Your idea says "Let's assume the CA model is broken, and as a solution increase our dependence upon the CA model." If one CA can be compromised, why not threetwo (assuming a 2/3 majority wins in your model)? At that point you'll start saying, "Well, obviously we want to trust Entrust more than the Consolidated Republik of Tadpolistan" - at which point you've reached Certificate Pinning, which is already a thing.

  5. WoT else? The other natural conclusion you'll reach, when you decide that some CAs are more trustworthy than others, is that there should be a method of incorporating reputability. This is called the Web of Trust, and is a competing model to the Centralized Trust of CAs today. One implementation of the WoT method is the Perspectives Project, which is an interesting approach to the same problem you describe (and which works in complement to, and in compatibility with, the existing CA model).

* Before someone jumps up and says "Startcom!" or "Let's Encrypt," please remember that businesses drive the CA model today. They pay significant amounts of money, and some of them purchase thousands of certs annually. The cost impact needs to be considered against all players. (And even on the low end, if you want a free cert, now you would have to find 3 reputable free providers, when finding one was already a challenge.)

why do we not require websites to be validated by, say, 3 certificates of independent CAs?

Here are a few reasons:

  1. Cost. Purchasing certificates is already somewhat expensive*; tripling that expense - and forcing purchasers to wade deeper into the pool of potential CAs, where they usually start at the cheap end - would not be welcomed.

  2. Complexity. Currently, if a certificate expires, the site is offline or degraded until IT can scurry around and fix it. It happens surprisingly often given that expiration dates are known and can be planned for. Your proposal would triple the number of certificates that need to be installed correctly, that need to be replaced before expiration, that need correct certificate chains... Some of this stuff is hard enough today with just one CA!

  3. Compatibility. The TLS protocols do not specify a method of operation where multiple certificates must be validated, so you'd have to update or replace the protocol being used, which will take years. There's no way to specify to the client that this particular server requires multi-certificate validation, so downgrade attacks are trivial - again, you'd need to create a method, and then wait years for support to percolate out.

  4. Certificate Pinning. Your idea says "Let's assume the CA model is broken, and as a solution increase our dependence upon the CA model." If one CA can be compromised, why not three? At that point you'll start saying, "Well, obviously we want to trust Entrust more than the Consolidated Republik of Tadpolistan" - at which point you've reached Certificate Pinning, which is already a thing.

  5. WoT else? The other natural conclusion you'll reach, when you decide that some CAs are more trustworthy than others, is that there should be a method of incorporating reputability. This is called the Web of Trust, and is a competing model to the Centralized Trust of CAs today. One implementation of the WoT method is the Perspectives Project, which is an interesting approach to the same problem you describe (and which works in complement to, and in compatibility with, the existing CA model).

* Before someone jumps up and says "Startcom!" or "Let's Encrypt," please remember that businesses drive the CA model today. They pay significant amounts of money, and some of them purchase thousands of certs annually. The cost impact needs to be considered against all players. (And even on the low end, if you want a free cert, now you would have to find 3 reputable free providers, when finding one was already a challenge.)

why do we not require websites to be validated by, say, 3 certificates of independent CAs?

Here are a few reasons:

  1. Cost. Purchasing certificates is already somewhat expensive*; tripling that expense - and forcing purchasers to wade deeper into the pool of potential CAs, where they usually start at the cheap end - would not be welcomed.

  2. Complexity. Currently, if a certificate expires, the site is offline or degraded until IT can scurry around and fix it. It happens surprisingly often given that expiration dates are known and can be planned for. Your proposal would triple the number of certificates that need to be installed correctly, that need to be replaced before expiration, that need correct certificate chains... Some of this stuff is hard enough today with just one CA!

  3. Compatibility. The TLS protocols do not specify a method of operation where multiple certificates must be validated, so you'd have to update or replace the protocol being used, which will take years. There's no way to specify to the client that this particular server requires multi-certificate validation, so downgrade attacks are trivial - again, you'd need to create a method, and then wait years for support to percolate out.

  4. Certificate Pinning. Your idea says "Let's assume the CA model is broken, and as a solution increase our dependence upon the CA model." If one CA can be compromised, why not two (assuming a 2/3 majority wins in your model)? At that point you'll start saying, "Well, obviously we want to trust Entrust more than the Consolidated Republik of Tadpolistan" - at which point you've reached Certificate Pinning, which is already a thing.

  5. WoT else? The other natural conclusion you'll reach, when you decide that some CAs are more trustworthy than others, is that there should be a method of incorporating reputability. This is called the Web of Trust, and is a competing model to the Centralized Trust of CAs today. One implementation of the WoT method is the Perspectives Project, which is an interesting approach to the same problem you describe (and which works in complement to, and in compatibility with, the existing CA model).

* Before someone jumps up and says "Startcom!" or "Let's Encrypt," please remember that businesses drive the CA model today. They pay significant amounts of money, and some of them purchase thousands of certs annually. The cost impact needs to be considered against all players. (And even on the low end, if you want a free cert, now you would have to find 3 reputable free providers, when finding one was already a challenge.)

1
source | link

why do we not require websites to be validated by, say, 3 certificates of independent CAs?

Here are a few reasons:

  1. Cost. Purchasing certificates is already somewhat expensive*; tripling that expense - and forcing purchasers to wade deeper into the pool of potential CAs, where they usually start at the cheap end - would not be welcomed.

  2. Complexity. Currently, if a certificate expires, the site is offline or degraded until IT can scurry around and fix it. It happens surprisingly often given that expiration dates are known and can be planned for. Your proposal would triple the number of certificates that need to be installed correctly, that need to be replaced before expiration, that need correct certificate chains... Some of this stuff is hard enough today with just one CA!

  3. Compatibility. The TLS protocols do not specify a method of operation where multiple certificates must be validated, so you'd have to update or replace the protocol being used, which will take years. There's no way to specify to the client that this particular server requires multi-certificate validation, so downgrade attacks are trivial - again, you'd need to create a method, and then wait years for support to percolate out.

  4. Certificate Pinning. Your idea says "Let's assume the CA model is broken, and as a solution increase our dependence upon the CA model." If one CA can be compromised, why not three? At that point you'll start saying, "Well, obviously we want to trust Entrust more than the Consolidated Republik of Tadpolistan" - at which point you've reached Certificate Pinning, which is already a thing.

  5. WoT else? The other natural conclusion you'll reach, when you decide that some CAs are more trustworthy than others, is that there should be a method of incorporating reputability. This is called the Web of Trust, and is a competing model to the Centralized Trust of CAs today. One implementation of the WoT method is the Perspectives Project, which is an interesting approach to the same problem you describe (and which works in complement to, and in compatibility with, the existing CA model).

* Before someone jumps up and says "Startcom!" or "Let's Encrypt," please remember that businesses drive the CA model today. They pay significant amounts of money, and some of them purchase thousands of certs annually. The cost impact needs to be considered against all players. (And even on the low end, if you want a free cert, now you would have to find 3 reputable free providers, when finding one was already a challenge.)