certificate transparency saba eskandarian, eran messeri ...saba/slides/ctpriv.pdf · summary ct is...

Certificate Transparency with Privacy

Saba Eskandarian, Eran Messeri, Joe Bonneau, Dan Boneh Stanford Google NYU Stanford

Certificate Authorities

Public Key

Certificate Authorities

Public Key

CertificateCertificate

CA

apo-CA-lypse

Outline

● Certificate Transparency

● Redaction of private subdomains

● Privacy-preserving proof of misbehavior

Certificate Transparency (CT)

Idea: public, verifiable log of all certificates

Public Key


CA



Public Key


CA

Log

...



Public Key

Certificate, SCTCertificate, SCT

CA

Log

...

Certificate

SCT



Public Key

Certificate, SCTCertificate, SCT

CA

Log

...

Certificate

SCT

CT logging required by chrome for all sites starting October 2017!

Transparency and Privacy?

Outline




CA

Redaction: keeping secrets on a public log

Request Certificatesecret.facebook.com

Precertificatesecret.facebook.com

SCTsecret.facebook.com

Certificate, SCTsecret.facebook.com

Log

...

Problem: secret.facebook.com is publicly visible on the log!

CA

Redaction: keeping secrets on a public log

Log

...

Request Certificatesecret.facebook.com

Precertificatesecret.facebook.com

SCTsecret.facebook.com

Certificate, SCTsecret.facebook.com

Redacted

Redacted

Problem: secret.facebook.com is publicly visible on the log!

Usage:

c ← Commit(m, r)

Verify(c, m, r)

Security Properties:

Hiding: given commitment Commit(m, r), can’t find m

Binding: given commitment Commit(m, r), can’t decommit to m’ ≠ m

Tools: Commitments

r

val

Commit(m, r)

Usage:

c ← Commit(m, r)

Verify(c, m, r)




Tools: Commitments

r

Usage:

c ← Commit(m, r)

Verify(c, m, r)




Tools: Commitments

r

valr

Verify( , val, r)

Subdomain Redaction via Commitments

Request Certificate

secret.facebook.comsecret.facebook.com

Log

...

CA


Request Certificate


Log

...

Precertificate

secret.facebook.com

CA


Request Certificate


Log

...

Precertificate

secret.facebook.com

SCT

secret.facebook.com

.facebook

.com

CA


Request Certificate


Log

...

Precertificate

secret.facebook.com

SCT

secret.facebook.com

Certificatesecret.facebook.com

SCT: secret.facebook.comSCT Opening: .facebook

.com

CA


Page Request: secret.facebook.com




SCT: secret.facebook.comSCT Opening:



Verify( , secret, )


SCT: secret.facebook.comSCT Opening:

SecurityHow can a monitor still check the log?

Knowledge of number of entries per domain owner reveals extra certificates

Why can’t a malicious site or CA reuse an existing redacted SCT?

Binding property of commitment

Outline




Privacy-Compromising Proof of Exclusion

1 2 3 4 5 6 7 8 9 10Log

Excluded SCT

secret.facebook.com

Goals● Auditor proves to vendor that an SCT is missing from log● Auditor does not reveal domain name, vendor only learns that log is

misbehaving


misbehaving

Then:

● Vendor can investigate log● Vendor can blindly revoke missing certificate (by pushing a revocation value

to all browsers)


misbehaving

Then:

● Vendor can investigate log● Vendor can blindly revoke missing certificate (by pushing a revocation value

to all browsers)

Assumption: timestamps in order

What Does Auditor Prove?

1 2 3 4 5 6 7 8 9 10Log

Excluded SCT


1t=4

2t=18

3t=21

4t=27

5t=30

6t=38

7t=41

8t=42

9t=50

10t=59

Log

t=25Excluded SCT

Assumption: timestamps in order


1t=4

2t=18

3t=21

4t=27

5t=30

6t=38

7t=41

8t=42

9t=50

10t=59

Log

t=253t=21

4t=27


1t=4

2t=18

3t=21

4t=27

5t=30

6t=38

7t=41

8t=42

9t=50

10t=59

Log

What about privacy?!

t=253t=21

4t=27

Tools: Additively Homomorphic Commitments

val2val1


val2val1 +


val2val1 val1+val2+ =

Tools: Zero-Knowledge Proofs

A


=A B


=

0 < < 5

A B

AA


=

0 < < 5

A B

AA

valvalsk

Proof of Exclusion

1t=4

2t=18

3t=21

4t=27

5t=30

6t=38

7t=41

8t=42

9t=50

10t=59

Log


t=253t=21

4t=27

Proof of Exclusion

1t=4

2t=18

3t=21

4t=27

5t=30

6t=38

7t=41

8t=42

9t=50

10t=59

Log


X Y Z

Index(X)Time(X)

Index(Z)Time(Z)

Time(Y)

Proof of Exclusion

Y

X

Z

Index(X) Index(Z)

Time(Z)Time(X)

Proof of Exclusion

Time(Y)

+ 1 =

< <Y

X

Z

Index(X) Index(Z)

Time(Z)Time(X)

Proof of Exclusion

Time(Y)

+ 1 =

< <Y

X

Z

Are these numbers really from the log?

543

1211

Proof of Exclusion

+ 1 =

< <Y

X

Z

hehehe...

Proof of Exclusion

Needed for proof

X

Index(X) Time(X)

skH

Proof of Exclusion

New signatures from log

Needed for proof

X

Index(X) Time(X)

H(x)+Index(X) H(x) H(x)+Time(X)

skI skT

Proof of Exclusion


Needed for proof

X

Index(X) Time(X)

H(X)

skH


skI skT

Proof of Exclusion


Needed for proof

X

Index(X) Time(X)

H(X)+ +

skH


skI skT

Proof of Exclusion


Needed for proof

X

Index(X) Time(X)

H(X)H(x)+Index(X) H(x)+Time(X)+ +

skH


skI skT

Performance Numbers

Online Costs

Proof Size: 333 kB

Time to generate: 5.0 seconds

Time to verify: 2.3 seconds

Offline Costs (storage)

Growth of log entry: 480 bytes

Growth of SCT: 160 bytes

Revocation notice size: 32 bytes

Summary● CT is an exciting new feature of our web infrastructure

● Transparency raises new privacy concerns

● Work on privacy-preserving solutions to two issues:

○ Compatibility between CT and need for private domain names

○ Reporting CT log misbehavior without revealing private information

See paper for details and security proofs: https://arxiv.org/pdf/1703.02209.pdf

https://arxiv.org/pdf/1703.02209.pdf

certificate transparency saba eskandarian, eran messeri ...saba/slides/ctpriv.pdf · summary ct is...

Documents