OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old certificate and switch to a new one, and clients should be aware of the revocation.

However, what if I don't know that my private key has been compromised? Are there any measures for detecting if my key is being used by an unauthorized party? Or ways to defend against MITM in such a scenario?

  • 1
    How would you exploit Certificate Transparency to detect how many other servers use the exact same key as yours? – curiousguy Apr 26 '19 at 18:15
  • I don't think you would. As I understand it, what CT does is prevent new certs being issued for your domain without your knowledge. It doesn't tell you anything about where your existing certs are being used – duggulous Apr 26 '19 at 19:09

It is currently impossible. The solution is to simply use short certificate lifetimes. Even if it is stolen, it will only allow for a short window of opportunity, which a detection system would allow for as well.

Additionaly, you may just make copying hard by either using some hardware solution or at least some precautions that would isolate the key from the rest of the system.

Finally if you are not talking about a web service but an app, you can implement another layer of protection, for examle e2e encryption or just some ratcheting key with the server. You may even be able to implement some of that for web in javascript.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.