There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference.

While there have been attempts by the NSA and others to "hack" or otherwise exploit root certicate authorities; is there anything preventing the NSA from becoming a Root CA itself?

It certainly has the resources and expertise, and could "suggest" to major OS vendors to add its Root CA to the default trust store list (which is large enough that it may not be noticed by anyone..?)

If it is feasible, what would the implications be? Could they essentially Man-in-the-Middle attack most HTTPS connections without a warning? (Perhaps not Dragnet-type interception, but close?) Or create a fake commercial root CA as obviously people would be suspicious if it had NSA plastered all over it?

  • 9
    In this context I like to cite once again (I did in a post on 23.9.2014) Ross J. Anderson who wrote in Sec.19.5.3 of his well-known book "Security Engineering", Wiley, 2001, the following: "In short, while public key infrastructures can be useful in some applications, they are unlikely to be the universal solution to security problems as their advocates seem to believe. They don't tackle most of the really important issues at all." – Mok-Kong Shen Oct 21 '14 at 10:31
  • 4
    Note that the NSA has two tasks: ensure information security of the US (not just the government, also commerce and really the entire population) and gather information from outside the US. For task #1, it makes perfect sense for them to become a root CA for no nefarious reasons. – Jörg W Mittag Oct 21 '14 at 21:16
  • 3
  • 2
  • 1
    @Jörg W Mittag: For task #1 it makes perfect sense to become a CA, (or more likely stealing the keys of other CA's) for totally nefarious reasons - industrial espionage to serve US companies. Barring another Snowden (one that actually releases things that might be harmful to the US government), when secrecy is lifted in somewhere around 2100, I believe this is what we will find was happening. – JKAbrams Nov 15 '14 at 8:19
up vote 228 down vote accepted

It is already done:

FPKI root in Windows' "trusted CA" store

It is the FPKI root CA, under explicit and full control of the US government. Windows already trusts it by default.

Before you flip out and begin to delete root CA certificates, burn your computer's motherboard, or drink a gallon of vodka, think about what it means. It means that the US government could technically emit a fake certificate for any SSL site that you are browsing -- but with a certificate chain that would point back to the US government. That is the point of having a "trusted CA" in the client: so that the client may validate a certificate chain. Therefore, such a forged site would hardly be a discreet way to eavesdrop on communications. All it would take would be a single user clicking on the padlock icon, reviewing the certificate chain, notice the FPKI root, and mock Obama on Twitter.

Pushing your own root CA in the "trusted store" of your victims is not an adequate way to spy on people without them noticing. Although it is a government agency, the NSA as a whole is usually not that stupid.

  • 52
    Whilst I agree overall with Thomas' statement about the indiscretion of this type of spying - it's still not without serious concerns. They could selectively serve a doctored certificate for specific IPs at specific times only. Few normal browsers log every cert chain they've encountered. Additionally, subversion of back-end HTTPS is even worse; such as between mobile apps and the cloud, or between enterprise SOAP and embedded systems. Almost every programming framework I know of trusts all Root CAs equally unless a rare security minded programmer strips out the defaults (explicit opt-out). – LateralFractal Oct 21 '14 at 0:12
  • 47
    You don't even have any assurances that GoDaddy, or for that matter, any other CA, is not run by the NSA, except maybe asking nicely if they're actually run by the NSA, and if they say "yes", then it's true. They could easily start a company to work as a CA, and then, since it's a profitable venture, never report its expenses back to Congress. – Ernie Oct 21 '14 at 17:13
  • 7
  • 11
    @Thomas I think you cherry picked a blatantly obvious root CA. That one could easily be in there to access US government sites. What about the other ones that are covert, less obvious or have obscure names? I do not think this accounts for the scenario where NSA simply uses some of their $10.8B p.a. black budget to setup a shell corporation and purchase existing CAs like Verisign. Or just sends US based CAs a National Security Letter for a copy of the private key. – NDF1 Oct 22 '14 at 20:35
  • 4
    Is this certificate only installed in US ? I don't have this root certificate on my Windows 8.1 computer in France. – Kedare Nov 17 '14 at 14:22

The NSA could and probably already has gone -- using a USA PATRIOT Act demand letter, or other similar legislative tool -- to all the major CAs in the United States (e.g. VeriSign, GeoTrust, etc.) and demanded that they remit their private root keys to "No Such Agency", "for purposes of 'national security'".

Of course, all such requests must (per PATRIOT Act law) be kept secret, and the CAs must lie to the public about their having complied with the request, or the chief executive officers of the CAs (and any of their underlings involved) are subject to long prison terms (with the trial, if any, conducted in camera in secret courts).

None of the above is unfounded speculation; it is based on well-known U.S. laws, which two successive U.S. administrations (Bush and Obama) have refused to change in any meaningful way, and in view of the Snowden revelations it would be extremely foolish to assume that this scenario hasn't already happened.

So yes -- the simple answer is, "the NSA doesn't need to do anything special to set up a root CA; because it can easily impersonate any of the existing (American) ones, at will".

  • 34
    This is pure speculation, with no citations. There are a lot of misconceptions out there about what the PATRIOT act actually says, and this looks like yet another instance of that. Speculation about legal matters from non-legal experts, without citations or evidence to back it up, is not very useful. – D.W. Oct 21 '14 at 18:44
  • 15
    Here is your citation @D.W. I disagree with your statement because what user53510 said is exactly what is likely happening. – NDF1 Oct 22 '14 at 20:40
  • 10
    @D.W. from the citation, the part "the CAs must lie to the public about their having complied with the request" comes from "Patriot Act reauthorization statutes". I think that part is an important aspect. – Volker Siegel Oct 23 '14 at 4:30
  • 7
    @Joshua Isn't it exactly what happened to Lavabit? The ruling very clearly said that yes, destroying a business is of no concern. – Andrey Tarantsov Oct 24 '14 at 11:54
  • 2
    I am not going down a slippery slope, the NSA is. – Joshua Nov 4 '14 at 18:38

No. In addition to the obvious government Root CAs in your trust stores; the NSA is a spy agency and as such has likely already stolen the private keys of several other CAs. If they are devious, they'd steal the private keys of other government CAs for potential false flag operations.

Additionally, unless every operating system and browser explicitly locks their updates to a specific CA or certificate only, they could use any Root CA they own or control to add a new anonymous CA (e.g. Issuer: Voldemort) to a trust store so that future back-tracing goes precisely nowhere.

  • That's an interesting one about hijacking update mechanisms to add imaginary CAs... and entirely possible :( – Mark K Cowan Oct 23 '14 at 13:04
  • The updater in most OSes won't log which root CA added the new one? – ike Oct 23 '14 at 17:46
  • @ike Likely not; for if they did then they are recognising the problem, and would simply pin the updater to a specific root or leaf certificate in the first place. – LateralFractal Oct 23 '14 at 21:56

They don't need to offer another certificate which points to them. They just need the private key of the server certificate to eavesdrop on the communication, which is probably easy to obtain if you have that kind of resources.

  • 1
    A single server key may be easier to obtain, but a CA would allow for a lot more than any single website or service to be eavesdropped on – user2813274 Oct 20 '14 at 20:54
  • 3
    yeah, but paying off one guy at each CA is probably easier to achieve than throwing MITM attacks with a legit root certificate and hoping nobody sees the difference. Unless of course they have already broken the ciphers, then it doesn't matter anyway. – user59089 Oct 20 '14 at 21:00
  • It may be easier to pull off, but when someone discovers what happened, it's bad for business, intentional or not. – mpontillo Oct 20 '14 at 22:31
  • To decrypt a message you need the private key of the intended reader. Although it could be different for every conversation initiated (it can be discarded when the conversation is over), usually it isn't. – CompanyDroneFromSector7G Oct 22 '14 at 15:16
  • 2
    You haven't thought this through. How is it easier to obtain the millions (10s or 100s of millions?) of server certificates in use, and coordinate getting the right one to the right place on demand for use, when they could just get themselves control of even a single root CA and manufacture fake certificates to order? – mc0e Oct 26 '14 at 18:18

protected by D.W. Oct 21 '14 at 18:45

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.