ARPKI: Attack resilient public-key infrastructure

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2014, Pages 382-393

  Basin, David ^a   Cremers, Cas ^b   Kim, Tiffany Hyun Jin ^c   Perrig, Adrian ^a   Sasse, Ralf ^a   Szalachowski, Pawel ^a  

^a ETH ZURICH   (Switzerland)

^b UNIVERSITY OF OXFORD   (United Kingdom)

^c CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Attack resilience; Certificate validation; Formal validation; Public log servers; Public Key Infrastructure; TLS

Indexed keywords

NETWORK SECURITY; THALLIUM;

ATTACK RESILIENCES; CERTIFICATE VALIDATIONS; FORMAL VALIDATION; LOG SERVER; PUBLIC KEY INFRASTRUCTURE;

PUBLIC KEY CRYPTOGRAPHY;

EID: 84910602699     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2660267.2660298     Document Type: Conference Paper

References (29)

1. ARPKI: Full implementation, formal model, and security properties. http://www.netsec.ethz.ch/research/arpki.
2. Convergence. http://convergence.io/.
3. Public Key Pinning. http://www.imperialviolet. org/2011/05/04/pinning.html, May 2011.
4. Public Key Pinning Extension for HTTP. http://tools.ietf.org/html/draft-ietf-websec-key-pinning-01, December 2011.
5. Martín Abadi, Andrew Birrell, Ilya Mironov, Ted Wobber, and Yinglian Xie. Global authentication in an untrustworthy world. In Petros Maniatis, editor, HotOS. USENIX Association, 2013.
6. Daniel J Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. High-speed high-security signatures. Journal of Cryptographic Engineering, 2(2):77-89, 2012.
7. Robert Biddle, Paul C van Oorschot, Andrew S Patrick, Jennifer Sobey, and Tara Whalen. Browser interfaces and extended validation SSL certificates: an empirical study. In Proceedings of the 2009 ACM workshop on Cloud computing security, pages 19-30. ACM, 2009.
8. D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, and W. Polk. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 (Proposed Standard), May 2008.
9. Paul Ducklin. The TURKTRUST SSL certificate fiasco-what really happened, and what happens next? http://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/, January 2013.
10. Peter Eckersley. Sovereign Key Cryptography for Internet Domains. https://git.eff.org/?p=sovereign-keys.git;a= blob;f=sovereign-key-design.txt;hb=HEAD.
11. Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh, and Vitaly Shmatikov. The most dangerous code in the world: validating SSL certificates in non-browser software. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 38-49. ACM, 2012.
12. Paul Hoffman and Jakob Schlyter. The DNS-based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA. http://tools.ietf.org/html/rfc6698, August 2012. IETF RFC 6698.
13. R. Housley, W. Polk, W. Ford, and D. Solo. Internet X.509 Public Key Infrastructure: Certificate and Certificate Revocation List (CRL) Profile. Technical Report RFC 3280, Internet Engineering Task Force, April 2002.
14. Emilia Kasper. Fast elliptic curve cryptography in OpenSSL. In Financial Cryptography and Data Security, volume 7126 of LNCS, pages 27-39. Springer, 2012.
15. Tiffany Hyun-Jin Kim, Lin-Shung Huang, Adrian Perrig, Collin Jackson, and Virgil Gligor. Accountable Key Infrastructure (AKI): A Proposal for a Public-Key Validation Infrastructure. In Daniel Schwabe, Virgílio A. F. Almeida, Hartmut Glaser, Ricardo A. Baeza-Yates, and Sue B. Moon, editors, Proceedings of the International World Wide Web Conference (WWW), May 2013.
16. Adam Langley. Overclocking SSL. https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html, June 2010.
17. Ben Laurie and Emilia Kasper. Revocation Transparency. http://sump2.links.org/files/RevocationTransparency.pdf.
18. Ben Laurie, Adam Langley, and Emilia Kasper. Certificate Transparency. http://tools.ietf.org/pdf/rfc6962.pdf, June 2013. IETF RFC 6962.
19. Moxie Marlinspike and Trevor Perrin. Trust Assertions for Certificate Keys. http://tack.io/draft.html, May 2012.
20. Simon Meier, Benedikt Schmidt, Cas Cremers, and David Basin. The TAMARIN Prover for the Symbolic Analysis of Security Protocols. In Computer Aided Verification, 25th International Conference, CAV 2013, Princeton, USA, Proc., volume 8044 of LNCS, pages 696-701. Springer, 2013.
21. Joseph Menn. Key internet operator VeriSign hit by hackers. http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z820120202, January 2012.
22. M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams. X.509 Internet Public Key Infrastructure Online Certificate Status Protocol-OCSP. Internet Request for Comments 2560, June 1999.
23. Paul Roberts. Phony SSL certificates issued for Google, Yahoo, Skype, others. http://threatpost.com/phony-ssl-certificates-issued-google-yahoo-skype-others-032311/, March 2011.
24. Mark D. Ryan. Enhanced certificate transparency and end-to-end encrypted mail. In Proceedings of NDSS. The Internet Society, 2014.
25. Benedikt Schmidt, Simon Meier, Cas Cremers, and David Basin. Automated analysis of Diffie-Hellman protocols and advanced security properties. In Computer Security Foundations Symposium (CSF), pages 78-94. IEEE, 2012.
26. Toby Sterling. Second firm warns of concern after Dutch hack. http://news.yahoo.com/second-firm-warns-concern-dutch-hack-215940770.html, September 2011.
27. Pawel Szalachowski, Stephanos Matsumoto, and Adrian Perrig. PoliCert: Secure and Flexible TLS Certificate Management. In Proceedings of the ACM Conference on Computer and Communications Security (CCS). ACM, November 2014.
28. Emin Topalovic, Brennan Saeta, Lin-Shung Huang, Collin Jackson, and Dan Boneh. Towards Short-Lived Certificates. In Web 2.0 Security and Privacy, May 2012.
29. Dan Wendlandt, David G. Andersen, and Adrian Perrig. Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing. In Proceedings of USENIX Annual Technical Conference, June 2008.