Comment by chrisjj

2 days ago

> the blocking by CT logs is to prevent the logs from being spammed by forged certificates. However, it also means there will be no place to record forged certificates found in the wild.

This is indeed huge. Allegedly forged certs aren't spam and do need to be logged. Refusal to log them is a dereliction of duty and will righly undermine trust in the system.

5 comments

chrisjj

Reply
amluto  2 days ago

The whole premise of CT logs is that issuance of a cert is an action taken by the CA or at least by the HSM holding the private key. If the entire private key leaks, which appears to be what happened here, then the existence of a certificate containing a valid signature means nothing at all. The CT log might as well record that every possible string of bytes has been signed.

  • chrisjj  2 days ago

    "Certificate Transparency logs are "append-only" and publicly-auditable ledgers of certificates being created, updated, and expired." https://certificate.transparency.dev/logs/

    Secretly excluding some issued with a key leak that "appears to be what happened" is not transparency.

    CT aren't supposed to be gatekeepers.

    If the problem is spam then the solution should be antispam - regardless of allegations of leak.

    • amluto  2 days ago

      CT logs are supposed to be useful. They serve at least two major purposes: visibility and auditing. Assuming that a CA is remotely well behaved, a site owner can trust that, if a certificate has been issued, then it's in the CT log. An auditor can read a complete record of certificates issued by a CA and attempt to determine whether they all follow the rules. And a CA that issues certificates without logging them is quite likely to get caught. Some browsers won't even accept certificates that aren't logged. And anyone who sees a signed certificate that isn't in the log holds evidence that the CA is misbehaving.

      Once the private key has been leaked, this is basically all pointless.

      Can a site owner trust that a certificate in their name has been logged? Of course not! An attacker could be signing it on the fly.

      Can an auditor read the complete record? The complete record is kind of meaningless if the private key is leaked. But the auditor already knows that the private key is leaked!

      Will the CA get caught if they issue a cert that isn't in the log? Yes! In fact, all newly signed certs won't be in the log.

      Will browsers that check for log inclusion be protected? Yes, because newly signed certs won't be in the log.

      Will anyone who sees a signed cert that isn't in the log hold evidence of misbehavior? Yes!

      One might argue that the actual change to the CT system that should be made is a way for a CT operator to insert a statement into the append-only log that they believe a signing key to be compromised and that they will therefore no longer accept certificates signed by that key.

      1 reply →