Abstract
The steadily growing number of certification authorities (CAs) assigned to the Web Public Key Infrastructure (Web PKI) and trusted by current browsers imposes severe security issues. Apart from being impossible for relying entities to assess whom they actually trust, the current binary trust model implemented with the Web PKI makes each CA a single point of failure. In this paper, we present the concept of trust views to manage variable trust levels for exactly those CAs actually required by a relying entity. This reduces the set of trusted CAs and minimizes the risk to rely on malicious certificates issued due to CA failures or compromises.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Braun, J., Rynkowski, G.: The potential of individualized trusted root stores: Minimizing the attack surface in the light of ca failures. Cryptology ePrint Archive, Report 2013/275 (2013), http://eprint.iacr.org/
Carnegie Mellon University. Perspectives Project, http://perspectives-project.org/ (visited July 2012)
Chadwick, D.W., Basden, A.: Evaluating trust in a public key certification authority. Computers & Security 20(7), 592–611 (2001)
Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., Polk, W.: RFC 5280 – Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 (Proposed Standard) (2008)
Eckersley, P., Burns, J.: The (Decentralized) SSL Observatory. Invited talk at 20th USENIX Security Symposium (August 2011)
The EFF SSL Observatory, https://www.eff.org/observatory
Ellison, C., Schneier, B.: Ten Risks of PKI: What You’re Not Being Told About Public Key Infrastructure. Computer Security Journal 16(1), 1–7 (2000)
Evans, C., Palmer, C., Sleevi, R.: Public Key Pinning Extension for HTTP. Internet-Draft (2013)
Gutmann, P.: Pki: it’s not dead, just resting. Computer 35(8), 41–49 (2002)
Gutmann, P.: Engineering Security (2013), Book draft available online at http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf
h online. Flame – oversights and expertise made for Windows Update worst case scenario, http://h-online.com/-1614234 (visited July 2012)
h online. Fake Google certificate is the result of a hack, http://h-online.com/-1333728 (visited November 2011)
Herley, C.: So long, and no thanks for the externalities: the rational rejection of security advice by users. In: Proceedings of the 2009 Workshop on New Security Paradigms Workshop, NSPW 2009, pp. 133–144. ACM, New York (2009)
Holz, R., Braun, L., Kammenhuber, N., Carle, G.: The ssl landscape: a thorough analysis of the x.509 pki using active and passive measurements. In: Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference, IMC 2011, pp. 427–444. ACM, New York (2011)
Huang, J., Nicol, D.: A calculus of trust and its application to pki and identity management. In: IDTrust 2009, pp. 23–37. ACM, New York (2009)
ICSI. The ICSI Certificate Notary (2013), http://notary.icsi.berkeley.edu/
Jøsang, A.: A logic for uncertain probabilities. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 9, 279–311 (2001)
Jøsang, A., Ismail, R.: The beta reputation system. In: Proceedings of the 15th Bled Electronic Commerce Conference (2002)
Jøsang, A., Ismail, R., Boyd, C.: A survey of trust and reputation systems for online service provision. Decision Support Systems 43, 618–644 (2007)
Jøsang, A.: An algebra for assessing trust in certification chains. In: Proceedings of the Network and Distributed Systems Security Symposium (NDSS 1999). The Internet Society (1999)
Marlinspike, M.: Convergence, http://convergence.io/ (visited July 2012)
Maurer, M.-E., Luca, A.D., Kempe, S.: Using data type based security alert dialogs to raise online security awareness. In: SOUPS, p. 2 (2011)
Maurer, U.M.: Modelling a Public-Key Infrastructure. In: Martella, G., Kurth, H., Montolivo, E., Bertino, E. (eds.) ESORICS 1996. LNCS, vol. 1146, pp. 325–350. Springer, Heidelberg (1996)
PSYC. Certificate Patrol, http://patrol.psyced.org/
Ries, S.: Extending bayesian trust models regarding context-dependence and user friendly representation. In: Proceedings of the 2009 ACM Symposium on Applied Computing, pp. 1294–1301. ACM, New York (2009)
Ries, S., Habib, S.M., Mühlhäuser, M., Varadharajan, V.: Certainlogic: A logic for modeling trust and uncertainty (short paper). In: McCune, J.M., Balacheff, B., Perrig, A., Sadeghi, A.-R., Sasse, A., Beres, Y. (eds.) Trust 2011. LNCS, vol. 6740, pp. 254–261. Springer, Heidelberg (2011)
Ruohomaa, S., Kutvonen, L., Koutrouli, E.: Reputation management survey. In: Seventh International Conference on Availability, Reliability and Security (ARES 2007), pp. 103–111 (2007)
Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., Cranor, L.F.: Crying wolf: An empirical study of ssl warning effectiveness (2009), http://static.usenix.org/event/sec09/tech/full_papers/sunshine.pdf
Wazan, A.S., Laborde, R., Barrère, F., Benzekri, A.: A formal model of trust for calculating the quality of x.509 certificate. Security and Communication Networks 4(6), 651–665 (2011)
Wazan, A.S., Laborde, R., Barrère, F., Benzekri, A.: The x.509 trust model needs a technical and legal expert. In: ICC, pp. 6895–6900 (2012)
Weaver, G.A., Rea, S., Smith, S.W.: A computational framework for certificate policy operations. In: Martinelli, F., Preneel, B. (eds.) EuroPKI 2009. LNCS, vol. 6391, pp. 17–33. Springer, Heidelberg (2010)
Zhang, Y., Hong, J.I., Cranor, L.F.: Cantina: a content-based approach to detecting phishing web sites. In: WWW 2007: Proceedings of the 16th International Conference on World Wide Web, pp. 639–648. ACM, New York (2007)
Zimmermann, P.R.: The official PGP user’s guide. MIT Press, Cambridge (1995)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Braun, J., Volk, F., Buchmann, J., Mühlhäuser, M. (2014). Trust Views for the Web PKI. In: Katsikas, S., Agudo, I. (eds) Public Key Infrastructures, Services and Applications. EuroPKI 2013. Lecture Notes in Computer Science, vol 8341. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-53997-8_9
Download citation
DOI: https://doi.org/10.1007/978-3-642-53997-8_9
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-53996-1
Online ISBN: 978-3-642-53997-8
eBook Packages: Computer ScienceComputer Science (R0)