6

I am not very knowledgeable about CA certificates, but I thought these things mainly said "The public key for bank X is Y, and this is verified by CA Z".

Once you've bought this certificate, there is no need to be in touch with the CA, and thus they have no need to keep their generating computers connected to the internet, no? Then why were hackers able to steal the private keys from Comodo and DigiNotar ? (there must have been a good reason to keep those computers connected to the internet?)

Improve this question
5
  • 1
    I don't think I understand your question. Your assumption that private keys of either Comodo or DigiNotar have been stolen is definitely wrong however. The private keys are still safe but the hackers were able to make CA's hardware sign their certificates. At least for DigiNotar this happened indirectly, the computers in question didn't have a direct connection to the Internet.
    – Wladimir Palant
    Sep 8, 2011 at 13:53
  • @WladimirPalant - I think the question really comes down to "Why are the signing servers not air-gapped?". While they may not be directly connected to the Internet, they're still (obviously) accessible via Internet-connected computers. This should not happen.
    – Iszi
    Sep 8, 2011 at 14:04
  • Basically then, why isn't the CA hardware kept in a safe location, disconnected from any network ? I mean, the generation of new certificates could be done manually by transfering the request by a usb stick?
    – billcarson
    Sep 8, 2011 at 14:05
  • 3
    @billcarson: That's what we're all asking, aren't we? But well, apparently some of the alleged security is actually not enforced in practice. Yes, this is probably a textbook example of criminal negligence.
    – Piskvor left the building
    Sep 9, 2011 at 10:55
  • 1
    Feel free to go ask nuclear researchers in Iran about how secure air-gapped networks can be. The problem is general sloppiness at some(all?) of the CAs. Air-gapping is merely a band-aid over one symptom.
    – devnul3
    Dec 6, 2011 at 22:33

3 Answers 3

Reset to default
8

The CA key should be well protected against physical attacks, because you do not want it to get stolen. It is an extremely valuable asset, since the corresponding public key has been embedded in widespread operating systems. So it must lie in a tamper resistant device (a Hardware Security Module), and that module should be in a bunker with guards.

On the other hand, it makes little sense to have a protected bunker if the employees just enter and exit it all day long. For a commercial CA which issues hundreds or more of certificates every day, the employees who handle the identity verification procedure and decide that the certificate should be issued must be, in practice, located "elsewhere". So now the device with the signature key is linked to the employees through some sort of network.

Physically private networks are extremely expensive, so everybody just uses "the Internet" and some sort of cryptographic protection for that link (e.g. SSL). So there you have it: the CA is "on the Internet" because it would be impractical (i.e. very expensive) to do otherwise.

Also, a CA should periodically publish Certificate Revocation Lists, that it signs with its private key. This also requires a regular network connection. You could do it with a daily/weekly manual transfer with a USB key, but human employees are not cheap, contrary to a crontab and an ethernet cable.

Good CA use a two-tier system with an offline root, which is used only once per year (this time by entering the bunker) to issue sub-CA certificates to the machines which actually do the common certificate signing.

Improve this answer
1
  • You note "expensive" and "not cheap" as the main points. I'd say that "being forced out of business due to complete loss of trust" isn't exactly profitable either (as for the current fallout: just wait until DN's customers start suing DN, now that's going to be expensive as hell).
    – Piskvor left the building
    Sep 9, 2011 at 10:59
2

CA hardware cannot be entirely isolated from the Internet - it needs to sign certificates somehow. And even if certificate requests are transported via USB sticks (or pigeons) - it is still a form of communication. There is not much difference between "signing servers are on an isolated network and only this server (connected to the Internet) is allowed to talk to them via this API" and "signing servers are on an isolated network and this server (connected to the Internet) will store certificate requests for them that this intern will then carry over on an USB stick". If that intern doesn't check the contents of the USB stick manually then you don't gain anything. And checking incoming signing requests manually can also be done if there is a network connection, only more comfortably. In fact, the DigiNotar hacker claims that this is exactly how StartCom detected (and stopped) his attack.

Improve this answer
7
  • 1
    Well, if the requests for new certificates come in over the internet, then I agree. However, the whole point of a CA is that they verify the authenticity of their clients; this is something which should not be done just over email, but in real life. In that case, certificate requests could be handled in paper form. (I know, I am probably a bit too idealistic about this, but seeing how much these people ask for a cert...)
    – billcarson
    Sep 8, 2011 at 15:05
  • @billybob: Sure, I simplified the request validation step. But it involves pretty significant communication of CA employees with the customer (particularly for EV certificates) and this cannot realistically be done without Internet connection (a CA who only accepts printed letters will go out of business immediately). So you can isolate the signing step but the request validation step remains a vulnerability.
    – Wladimir Palant
    Sep 8, 2011 at 15:30
  • Actually there is a lot of difference between using a standard network connection and a restricted connection with a controlled interface. If implemented correctly, the restricted connection reduces the exposure of the communication and the restricted interface reduces the vulnerability of the assets in the signing server. If there were no difference then no one would use firewalls as the firewall would provide no protection to the local network.
    – this.josh
    Sep 8, 2011 at 18:43
  • @this.josh: I don't think that I said anything different. But it just doesn't make sense to kill the connection and replace it by "USB sticks" - same effect can be achieved with a firewall or whatever.
    – Wladimir Palant
    Sep 9, 2011 at 5:18
  • 1
    @Wladimir Palant: It may, psychologically - it emphasizes that this is indeed an offline, manually initiated action, and that it's not done over the wire for a reason. It's slow, but "there are enough fast insecure algorithms already"; note that it would require subverting the employees - subverting the firewall only takes knowing that the DC admin password is P@ssw0rd (or what was it).
    – Piskvor left the building
    Sep 9, 2011 at 11:16
2

The short answer is that CAs compete with the convenience and ease with which certificates can be issued. Bulk customers want turn arounds measured in minutes for issuing certificates to domains that have already been verified.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.