Abstract
Recent security incidents indicate that certificate authorities (CAs) might be compromised to sign certificates with fraudulent information. The fraudulent certificates are exploited to launch successful TLS man-in-the-middle (MitM) attacks, even when TLS clients strictly verify the server certificates. Various security-enhanced certificate verification schemes have been proposed to defend against fraudulent certificates, such as Pinning, CAge, CT, DANE, and DoubleCheck. However, none of the above schemes perfectly solves the problem, which hinders them from being widely deployed. This paper analyzes these schemes in terms of security, usability and performance. Based on the analysis, we propose Elaphurus, an integrated security-enhanced certificate verification scheme on the TLS client side. Elaphurus is designed on top of Pinning, while integrating other schemes to eliminate their disadvantages and improving the overall security and usability. We implement the prototype system with OpenSSL. Experimental results show that it introduces a reasonable overhead, while effectively enhancing the security of certificate verification.
This work was partially supported by Cyber Security Program of National Key RD Plan of China (No. 2017YFB0802100), National Cryptography Development Fund (No. MMJJ20180221), and 13th Five-year Informatization Plan of Chinese Academy of Sciences (No. XXH13507-01).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
In Chinese, Elaphurus is the hybrid of cow, deer, donkey, and horse. So we name the integrated scheme Elaphurus.
- 2.
However, the design of Elaphurus needs to handle the scenarios that some security-enhanced verification schemes (e.g., CT and DANE) are not deployed.
References
Alicherry, M., Keromytis, A.: DoubleCheck: multi-path verification against man-in-the-middle attacks. In: 14th IEEE ISCC (2009)
Amann, J., et al.: Mission accomplished? HTTPS security after DigiNotar. In: 17th IMC (2017)
Arends, R., et al.: IETF RFC 4033 - DNS security introduction and requirements
Basin, D., et al.: ARPKI: attack resilient public-key infrastructure. In: 21th ACM CCS (2014)
Bates, A., et al.: CertShim: securing SSL certificate verification through dynamic linking. In: 21th ACM CCS (2014)
Biilmann, M.: Be afraid of HTTP public key pinning (HPKP) (2016). https://www.smashingmagazine.com/be-afraid-of-public-key-pinning
Cooper, D., et al.: IETF RFC 5280 - Internet X.509 public key infrastructure certificate and certificate revocation list (CRL) profile (2008)
Evans, C., et al.: IETF RFC 7469 - Public key pinning extension for HTTP (2015)
Hallam-Baker, P., Stradling, R.: IETF RFC 6844 - DNS certification authority authorization (CAA) resource record (2013)
Hoffman, P., Schlyter, J.: IETF RFC 6698 - The DNS-based authentication of named entities (DANE) transport layer security (TLS) protocol: TLSA (2012)
Internet Society: DANE test sites. https://www.internetsociety.org/resources/deploy360/dane-test-sites
Kasten, J., Wustrow, E., Halderman, J.A.: CAge: taming certificate authorities by inferring restricted scopes. In: Sadeghi, A.-R. (ed.) FC 2013. LNCS, vol. 7859, pp. 329–337. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39884-1_28
Kim, T., et al.: Accountable key infrastructure (AKI): a proposal for a public-key validation infrastructure. In: 22nd WWW (2013)
Langley, A.: Public key pinning (2011). https://www.imperialviolet.org/2011/05/04/pinning.html
Laurie, B., et al.: IETF RFC 6962 - Certificate transparency (2013)
Liu, X., Li, B., Wang, C., Lin, J.: An integrated security-enhanced PKI certificate verification scheme. Appl. Res. Comput. (2019). (in Chinese)
Marlinspike, M.: Trust assertions for certificate keys (2013). http://tack.io/draft.html
Morton, B.: More Google fraudulent certificates (2014). https://www.entrust.com/google-fraudulent-certificates/
Oltrogge, M., et al.: To pin or not to pin: helping APP developers bullet proof their TLS connections. In: 24th USENIX Security (2015)
O’Neill, M., et al.: TrustBase: an architecture to repair and strengthen certificate-based authentication. In: 26th USENIX Security (2017)
OpenSSL Software Foundation: OpenSSL: Cryptography and SSL/TLS toolkit. https://www.openssl.org
Ristic, I.: Is HTTP public key pinning dead? (2016). https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead
Soghoian, C., Stamm, S.: Certified lies: detecting and defeating government interception attacks against SSL (Short Paper). In: Danezis, G. (ed.) FC 2011. LNCS, vol. 7035, pp. 250–259. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-27576-0_20
Stark, E., et al.: Does certificate transparency break the web? Measuring adoption and error rate. In: 40th IEEE S&P (2019)
Szalachowski, P., et al.: PoliCert: secure and flexible TLS certificate management. In: 21th ACM CCS (2014)
Tor project: anonymity online. https://www.torproject.org/index.html
Vandersloot, B., et al.: Towards a complete view of the certificate ecosystem. In: 16th IMC (2016)
Wendlandt, D., et al.: Perspectives: improving SSH-style host authentication with multi-path probing. In: USENIX ATC (2008)
Wikipedia: Dig for querying domain name system (DNS) servers. https://en.wikipedia.org/wiki/Dig_(command)
Wilson, K.: Distrusting new CNNIC certificates (2015). https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Li, B., Wang, W., Meng, L., Lin, J., Liu, X., Wang, C. (2020). Elaphurus: Ensemble Defense Against Fraudulent Certificates in TLS. In: Liu, Z., Yung, M. (eds) Information Security and Cryptology. Inscrypt 2019. Lecture Notes in Computer Science(), vol 12020. Springer, Cham. https://doi.org/10.1007/978-3-030-42921-8_14
Download citation
DOI: https://doi.org/10.1007/978-3-030-42921-8_14
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-42920-1
Online ISBN: 978-3-030-42921-8
eBook Packages: Computer ScienceComputer Science (R0)