Certificate Transparency with Privacy Saba Eskandarian, Eran - PowerPoint PPT Presentation

Certificate Transparency with Privacy Saba Eskandarian, Eran Messeri, Joe Bonneau, Dan Boneh Stanford Google NYU Stanford

Certificate Authorities Public Key

Certificate Authorities Public Key Certificate CA Certificate

apo-CA-lypse

apo-CA-lypse

Outline ● Certificate Transparency ● Redaction of private subdomains ● Privacy-preserving proof of misbehavior

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Public Key Certificate CA Certificate

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Log Public Key Certificate CA Certificate ...

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Log Public Key Certificate CA Certificate ...

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Log Certificate Public Key Certificate, SCT CA Certificate, SCT SCT ...

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Log Certificate Public Key Certificate, SCT CA Certificate, SCT SCT ...

Certificate Transparency (CT) Idea : public, verifiable log of all certificates Log Certificate Public Key Certificate, SCT CA Certificate, SCT SCT ... CT logging required by chrome for all sites starting October 2017!

Transparency and Privacy?

Outline ● Certificate Transparency ● Redaction of private subdomains ● Privacy-preserving proof of misbehavior

Redaction: keeping secrets on a public log Log CA Request Certificate secret.facebook.com Precertificate secret.facebook.com SCT secret.facebook.com Certificate, SCT ... secret.facebook.com Problem: secret.facebook.com is publicly visible on the log!

Redaction: keeping secrets on a public log Log CA Request Certificate secret.facebook.com Precertificate secret.facebook.com Redacted SCT Redacted secret.facebook.com Certificate, SCT ... secret.facebook.com Problem: secret.facebook.com is publicly visible on the log!

Tools: Commitments Usage: val c ← Commit(m, r) Verify(c, m, r) Commit(m, r) r Security Properties: Hiding : given commitment Commit(m, r), can’t find m Binding : given commitment Commit(m, r), can’t decommit to m’ ≠ m

Tools: Commitments Usage: c ← Commit(m, r) Verify(c, m, r) r Security Properties: Hiding : given commitment Commit(m, r), can’t find m Binding : given commitment Commit(m, r), can’t decommit to m’ ≠ m

Tools: Commitments Usage: val r c ← Commit(m, r) Verify(c, m, r) r Verify( , val, r) Security Properties: Hiding : given commitment Commit(m, r), can’t find m Binding : given commitment Commit(m, r), can’t decommit to m’ ≠ m

Subdomain Redaction via Commitments Log CA Request Certificate secret.facebook.com secret.facebook.com ...

Subdomain Redaction via Commitments Log CA Request Certificate Precertificate secret.facebook.com secret.facebook.com secret.facebook.com ...

Subdomain Redaction via Commitments Log CA Request Certificate Precertificate secret.facebook.com secret.facebook.com secret.facebook.com SCT ... secret.facebook.com .facebook .com

Subdomain Redaction via Commitments Log CA Request Certificate Precertificate secret.facebook.com secret.facebook.com secret.facebook.com SCT Certificate secret.facebook.com ... secret.facebook.com SCT: secret.facebook.com SCT Opening: .facebook .com

Subdomain Redaction via Commitments Page Request: secret.facebook.com

Subdomain Redaction via Commitments Page Request: secret.facebook.com Certificate secret.facebook.com SCT: secret.facebook.com SCT Opening:

Subdomain Redaction via Commitments Page Request: secret.facebook.com Certificate secret.facebook.com SCT: secret.facebook.com SCT Opening: Verify( , secret , )

Security How can a monitor still check the log? Knowledge of number of entries per domain owner reveals extra certificates Why can’t a malicious site or CA reuse an existing redacted SCT? Binding property of commitment

Outline ● Certificate Transparency ● Redaction of private subdomains ● Privacy-preserving proof of misbehavior

Privacy-Compromising Proof of Exclusion Log 1 2 3 4 5 6 7 8 9 10 Excluded SCT secret.facebook.com

Privacy-Compromising Proof of Exclusion Log 1 2 3 4 5 6 7 8 9 10 Excluded SCT secret.facebook.com

Goals ● Auditor proves to vendor that an SCT is missing from log ● Auditor does not reveal domain name, vendor only learns that log is misbehaving

Goals ● Auditor proves to vendor that an SCT is missing from log ● Auditor does not reveal domain name, vendor only learns that log is misbehaving Then: ● Vendor can investigate log ● Vendor can blindly revoke missing certificate (by pushing a revocation value to all browsers)

Goals ● Auditor proves to vendor that an SCT is missing from log ● Auditor does not reveal domain name, vendor only learns that log is misbehaving Then: ● Vendor can investigate log ● Vendor can blindly revoke missing certificate (by pushing a revocation value to all browsers) Assumption: timestamps in order

What Does Auditor Prove? Log 1 2 3 4 5 6 7 8 9 10 Excluded SCT

What Does Auditor Prove? Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 Excluded t=25 SCT Assumption: timestamps in order

What Does Auditor Prove? Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 Excluded t=25 SCT Assumption: timestamps in order

What Does Auditor Prove? Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 3 4 t=25 t=21 t=27

What Does Auditor Prove? Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 3 4 What about t=25 t=21 t=27 privacy?!

Tools: Additively Homomorphic Commitments val 1 val 2

Tools: Additively Homomorphic Commitments + val 1 val 2

Tools: Additively Homomorphic Commitments + = val 1 val 2 val 1 +val 2

Tools: Zero-Knowledge Proofs A

Tools: Zero-Knowledge Proofs = A B

Tools: Zero-Knowledge Proofs = A B 0 < < 5 A A

Tools: Zero-Knowledge Proofs = A B val val sk 0 < < 5 A A

Tools: Zero-Knowledge Proofs = A B val val sk 0 < < 5 A A

Tools: Zero-Knowledge Proofs = A B val val sk 0 < < 5 A A

Proof of Exclusion Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 3 4 What about t=25 t=21 t=27 privacy?!

Proof of Exclusion Log 1 2 3 4 5 6 7 8 9 10 t=4 t=18 t=21 t=27 t=30 t=38 t=41 t=42 t=50 t=59 X Y Z Index(X) Index(Z) What about Time(Y) Time(X) Time(Z) privacy?!

Proof of Exclusion X Y Z

Proof of Exclusion + 1 = Index(X) Index(Z) X Y < < Time(X) Time(Y) Time(Z) Z

Proof of Exclusion + 1 = Index(X) Index(Z) X Y < < Time(X) Time(Y) Time(Z) Z

Proof of Exclusion + 1 = Index(X) Index(Z) X Y < < Time(X) Time(Y) Time(Z) Z

Proof of Exclusion + 1 = Index(X) Index(Z) X Y Are these < < numbers really Time(X) Time(Y) Time(Z) from the log? Z

Proof of Exclusion + 1 = 11 12 X Y < < 3 4 5 Z hehehe...

Proof of Exclusion X Needed for proof Index(X) Time(X)

Proof of Exclusion X New H(x)+Index(X) H(x) H(x)+Time(X) signatures from log sk I sk H sk T Needed for proof Index(X) Time(X)

Proof of Exclusion X New H(x)+Index(X) H(x) H(x)+Time(X) signatures from log sk I sk H sk T H(X) Needed for proof Index(X) Time(X)

Proof of Exclusion X New H(x)+Index(X) H(x) H(x)+Time(X) signatures from log sk I sk H sk T + + H(X) Needed for proof Index(X) Time(X)

Proof of Exclusion X New H(x)+Index(X) H(x) H(x)+Time(X) signatures from log sk I sk H sk T + + H(x)+Index(X) H(X) H(x)+Time(X) Needed for proof Index(X) Time(X)

Proof of Exclusion X New H(x)+Index(X) H(x) H(x)+Time(X) signatures from log sk I sk H sk T + + H(x)+Index(X) H(X) H(x)+Time(X) Needed for proof Index(X) Time(X)

Performance Numbers Online Costs Offline Costs (storage) Proof Size: 333 kB Growth of log entry: 480 bytes Time to generate: 5.0 seconds Growth of SCT: 160 bytes Time to verify: 2.3 seconds Revocation notice size: 32 bytes

Summary ● CT is an exciting new feature of our web infrastructure ● Transparency raises new privacy concerns ● Work on privacy-preserving solutions to two issues: ○ Compatibility between CT and need for private domain names ○ Reporting CT log misbehavior without revealing private information See paper for details and security proofs: https://arxiv.org/pdf/1703.02209.pdf