5

A student asked me a good question today when I was explaining the concept of certificates chain.

As I said "if a CA is compromised by an attacker he can emit false certificates for the entities the CA is allowed to sign (e.g all the *.fr)",
he asked me : "why not signing each certificate by more than one CA, let's say 3, so the compromise of only one CA is not sufficient to break the trust and the likeliness to have three CA compromised is far far less than only one."

I think the question is good. Even if it's not currently permitted by the x509 standard, it remains a valid criticism of the current model.
I don't see why the proposed model would not be better but maybe I miss something ?

To be effective this way will need that the 3 signatures were mandatory or that specific DNS record mentions that the certificates for this domain need 3 signatures to be valids.

EDIT: close to Why do we not require websites to have several independent certificates?

9
  • 3
    As far as I know, it is possible that a certificate has two CA's. This is called Cross-Signing.
    – user163495
    Sep 22, 2020 at 13:45
  • 1
    @VipulNair: Not everything with CA is about making money by having more market share. Just have a look at Let's Encrypt which offers certificates for free - with no strings attached. Sep 22, 2020 at 13:56
  • 2
    @MechMK1: Cross-signing means that if one CA is compromised the certificate is still trusted due to the other CA. This question is different - the use case here is that if even one of the CAs is compromised the certificate should no longer be trusted. Sep 22, 2020 at 13:59
  • 5
    Almost but not quite a dupe of Why do we not require websites to have several independent certificates?
    – gowenfawr
    Sep 22, 2020 at 14:15
  • 1
    The first thing that comes to mind about this is this as t it would increase cost for a certificate a lot and add many more paths for failure / mistakes. In other words do the benefits outweigh the costs...
    – LvB
    Sep 22, 2020 at 19:30

1 Answer 1

2

I don't see why the proposed model would not be better but maybe I miss something ?

The approach of requiring multiple valid trust anchors instead of one is a sound approach in theory and is actually used in practice within OpenPGP. There the trust into a key depends on how many trusted endorsers have signed the key and how much trust one itself has into these trusted endorsers etc - a web of trust.

Unfortunately, while this concept is useful in theory, it adds lots of complexity on multiple levels. The technical implementation is likely less a problem as the example of OpenPGP shows. In the simplest case the whole process of CA's would work like before but the TLS server would send multiple leaf certificates with multiple chains like suggested in Why do we not require websites to have several independent certificates?. See also Multiple CAs signing a single Cert/CSR?.

But apart from the technical issues: how many certificates should be required in which context and from which CA. Are there any CA which are more trusted than others, depending on the context (like CA from China are less trust in US and CA from US are less trusted in China). How many less trusted CA together can achieve the same trust level as one more trusted CA etc. One cannot expect this decision from most end users, so browser makers and certificate authorities have to make the decision for the end user - with many discussions and likely also nasty politics involved. In other words: there is lots of organizational complexity on top of the technical problem and this is likely the harder one to solve.

And what is actually the gain for the end user? If it is about reducing the risk into a single CA (i.e. compromise) - there are other approaches for this. With CAA one can restrict which CA is allowed to issue certificates for one owns domain (although this is only checked by the CA itself), Certificate Transparency ensures that no "hidden" certificates are in use but everything is done in the public, blacklisting of CA or sub-CA which showed problems contains the impact of a compromise. This is far from perfect, but much less complex and disruptive then the proposed approach.

In summary: the approach by itself is sound. Implementation in practice is limited by technical and organizational problems. Also additional hardening of the PKI system was done by other approaches already so that there is less need to implement such approach.

Not the answer you're looking for? Browse other questions tagged .