<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>In a reply to Paul on [1], and Tony on [metzdowd, awaiting mod approval], I detailed a realization that Certificate Transparency (CT), does not seem to detect certificate mis-issuance even if clients are able to successfully gossip Signed Tree Heads (STHs) as per [2].</div><div><br></div><div>Steve Kent noticed this problem [3] (see explanation below) in his OP to [1], although he didn't investigate whether gossip would fix it or not.</div><div><br></div><div><div>[1] <a href="http://www.ietf.org/mail-archive/web/trans/current/msg00588.html">http://www.ietf.org/mail-archive/web/trans/current/msg00588.html</a></div><div>[2] <a href="http://www.ietf.org/proceedings/90/slides/slides-90-trans-2.pdf">http://www.ietf.org/proceedings/90/slides/slides-90-trans-2.pdf</a></div></div><div>[3] <a href="http://www.ietf.org/mail-archive/web/trans/current/msg00534.html">http://www.ietf.org/mail-archive/web/trans/current/msg00534.html</a></div><div><br></div><div>Why gossip doesn't work.</div><div apple-content-edited="true">===================</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The realization is that a rouge CA can do its thing and generate a fraudulent cert to MITM connections *and* log this cert to a log *and* still get away with MITM undetected even with clients gossiping STHs.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">STHs are used to generate consistency proofs, but consistency proofs just tell you that you're the log you're currently looking at includes everything what you saw previously (from an older Merkle tree).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The audit proofs just tell you that a certificate exists in a log. It doesn't tell you that a certificate is fraudulent. There's nothing preventing fraudulent certs from existing in a log. The proof will tell you it's there, but it won't tell you it's fraudulent.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">For more on how these proofs work, see Google's documentation here:</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><a href="http://www.certificate-transparency.org/log-proofs-work">http://www.certificate-transparency.org/log-proofs-work</a></div><div apple-content-edited="true"><br></div><div apple-content-edited="true">So now, Clog MITM's millions of users, they gossip STHs, it stops MITMing them, they see the original cert, they exchange the same STHs (which don't change just because clients see the original cert).</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">The only thing that could detect this are the Monitors, but they aren't going to save you because they would need to monitor *all* logs for *all* domains and alert *everyone* about those changes (difficult enough, you'd need a... b-b-b-blockchain) and get those alerts safely (without censorship or tampering) to everyone on Earth.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Game Over for Certificate Transparency?</div><div apple-content-edited="true">================================</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Unless I'm mistaken, this seems to be Game Over.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Given that another human being also independently saw this problem [3], I am feeling confident enough to share this on this list.</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">Maybe the blockchain can save CT, but if it does, people will realize that they don't need Certificate Transparency, so it seems like game over either way.</div><div apple-content-edited="true"><div><br></div><div>Cheers,</div><div>Greg Slepak</div></div><div apple-content-edited="true"><br></div><div apple-content-edited="true"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <br></body></html>