No domain left behind is Lets Encrypt democratizing encryption? M. - PowerPoint PPT Presentation

. . . . . . . . . . . . . . No domain left behind is Let’s Encrypt democratizing encryption? M. Aertsen 1 , M. Korzyński 2 , G. Moura 3 1 National Cyber Security Centre The Netherlands 2 Delft University of Technology The Netherlands 3 SIDN Labs The Netherlands . . . . . . . . . . . . . . . . . . . . . . . . . . ICANN58, Tech day

. . . . . . . . . . . . . . . . More than half of web traffjc nowadays is encrypted Yet that leaves out a lot of people without HTTPS Firefox telemetry 1 Chrome telemetry 2 1 https://telemetry.mozilla.org/ , plot based on Let’s Encrypt stats page . . . . . . . . . . . . . . . . . . . . . . . . 2 https://www.google.com/transparencyreport/https/metrics/

. . . . . . . . . . . . . . . . . Certifjcates are required for encryption on the web Obtaining and deploying certifjcates is not free 3 https://letsencrypt.org 4 https://ietf-wg-acme.github.io/acme/ . . . . . . . . . . . . . . . . . . 5 https://certbot.eff.org/ . . . . . ▶ Cost: purchase, deployment and renewal ▶ Complexity: request, deployment (at scale) Let’s Encrypt 3 aims to make encrypted traffjc ubiquitous ▶ Reducing certifjcate cost of purchase, renewal to zero ▶ Automation of request, issuance and deployment (ACME: protocol 4 and clients, e.g. Certbot 5 )

. . . . . . . . . . . . . . . . No domain left behind Is Let’s Encrypt democratizing encryption? Research question “In its fjrst year of certifjcate issuance, has Let’s Encrypt been successful in democratizing encryption?” Approach . . . . . . . . . . . . . . . . . . . . . . . . ▶ Analyze issuance in the fjrst year of Let’s Encrypt ▶ Show adoption trend from various perspectives ▶ Analyze coverage for the lower-cost end of the market

. . . . . . . . . . . . . . . Contribution We show that players Encrypt certifjed domains (shared hosting) their fjrst expiration (90 days) And fjnd that . . . . . . . . . . . . . . . . . . . . . . . . . Let’s Encrypt has indeed started to democratize encryption. ▶ 98% of certifjcates are issued outside Alexa 1M ▶ yet issuance is not restricted to lower end of the market ▶ Let’s Encrypt ’s growth is attributed to adoption by major ▶ 3 hosting providers are responsible for 47% of the Let’s ▶ Issuance is dominantly for the lower-cost end of the market ▶ The majority of certifjcates are correctly renewed after

. . . . . . . . . . . . Methodology . Period covered One year of Let’s Encrypt certifjcate issuance, Sept 2015-2016 Results based on FQDNs reduced to 2LD/3LD form depending on availability per TLD registry Datasets Certifjcates Certifjcate transparency Domain to IP mapping Farsight DNSDB Organization mapping Methodology from previous work, us- . . . . . . . . . . . . . . . . . . . . . . . . . . . ing whois data & Maxmind GEOIP2 ▶ e.g. example.org (2LD) or example.co.uk (3LD),

. . . . . . . . . . . . . . . . . . 98% of certifjcates are issued outside Alexa 1M … . . . . . . . . . . . . . . . . . . . . . . % of total usage of Let's Encrypt 100% Alexa 1M Alexa 100k 10% Alexa 10k Alexa 1k 1% 0.1% 0.01% 0.001% Sep '15 Nov '15 Jan '16 Mar '16 May '16 Jul '16 Sep '16

. . . . . . . . . . . . . . . . . . …yet issuance is not restricted to lower end of market . . . . . . . . . . . . . . . . . . . . . . % of domains using Let's Encrypt 20% Alexa 1M Alexa 100k Alexa 10k 15% Alexa 1k DNSDB 10% 5% 0% Sep '15 Nov '15 Jan '16 Mar '16 May '16 Jul '16 Sep '16

. . . . . . . . . . . . . . . . . Growth is attributed to adoption by major players 3 hosting providers are responsible for 47% of the Let’s Encrypt certifjed domains November 2015 . . . . . . . . . . . . . . . . . . . . . . . September 2016 known domains 0 127M 14K Let's Encrypt domains 0 60K organisations

. . . . . . . . . . . . . . . . . Growth is attributed to adoption by major players 3 hosting providers are responsible for 47% of the Let’s Encrypt certifjed domains November 2015 September 2016 . . . . . . . . . . . . . . . . . . . . . . . known domains known domains 0 127M 0 205M 14K 4.4M Let's Encrypt domains Let's Encrypt domains 0 60K 0 66K organisations organisations

. . . . . . . . . . . . . . . . . Growth is attributed to adoption by major players 3 hosting providers are responsible for 47% of the Let’s Encrypt certifjed domains November 2015 . . . . . . . . . . . . . . . . . . . . . . . September 2016 known domains 0 127M 14K Let's Encrypt domains 0 60K organisations

. . . . . . . . . . . . . . . . . . Issuance is dominantly for web hosting So far, no surprises . . . . . . . . . . . . . . . . . . . . . . 100% unknown cdn % of Let's Encrypt domains isp 80% hosting other parking 60% edu ddos-protection gov 40% 20% 0% S O N D J F M A M J J A S a u u e e p u e c o e n a a n l b p t r g p v c r y ' ' ' 1 ' 1 ' ' 1 ' 1 ' ' 1 ' 1 ' ' ' 1 1 1 1 6 1 1 6 1 6 5 6 6 5 5 5 6 6 6 6

. . . . . . . . . . . . . . . . . Over 90% of domains in hosting are on shared hosting Issuance is dominantly for the lower-cost end of the market . . . . . . . . . . . . . . . . . . . . . . . % of LE domains in hosting 100% shared hosting non-shared hosting 80% 60% 40% 20% 0% S O N D J F M A M J J A S a u u e e c o e p u e n a a n l b p t v c r g p r y ' 1 ' ' ' ' ' 1 ' ' ' 1 ' 1 ' 1 1 ' 6 ' 1 1 1 1 1 1 1 6 6 5 6 6 5 5 5 6 6 6 6

. . . . . . . . . . . . . . . . . . Let’s Encrypt certifjcates are valid for 90 days The majority of certifjcates are correctly renewed after their fjrst expiration . . . . . . . . . . . . . . . . . . . . . . 1 Fraction of FQDN coverage continuous gap ≤ 1 week 0.8 0.6 0.4 0.2 0 90 180 270 360 days since initial issuance of certi fi cate

. . . . . . . . . . . . . . Summary We fjnd that Let’s Encrypt has indeed started to democratize encryption Certifjcate issuance in the fjrst year of Let’s Encrypt (shared hosting) X.509 certifjcates before certifjcates for their customers in bulk large number of domains three large hosting companies (Sept 2016) after the fjrst issuance of the certifjcate 6 . . . . . . . . . . . . . . . . . . . . . . 6 Let’s Encrypt certifjcates expire after three months . . . . ▶ used widely, dominated by the low-cost share of the market ▶ which would be unlikely to deploy the complex and costly ▶ enables big hosting providers to issue and deploy ▶ thus quickly and automatically enable encryption across a ▶ e.g. 47% of Let’s Encrypt certifjed domains are hosted at ▶ 70% of the Let’s Encrypt certifjed domains remain active

. . . . . . . . . . . . In conclusion . Future work require prior knowledge of domains served (SNI) Contact details Maarten Aertsen maarten.aertsen@ncsc.nl Maciej Korzyński maciej.korczynski@tudelft.nl Giovane Moura giovane.moura@sidn.nl For more information, including related work & references, . . . . . . . . . . . . . . . please see arXiv:1612.03005 (pending publication) . . . . . . . . . . . . ▶ extend measurement period ▶ issued versus deployed ▶ active scans on shared hosting ▶ use by malicious actors

. . . . . .. . . . . . . .. . . . . . . .. . . . . . . .. . . .. . . . . .

. . . . . . . . . . . . . . . . . . Absolute and relative growth Time series for FQDNs, domains, and DNSDB ratio . . . . . . . . . . . . . . . . . . . . . . 10% 14M FQDNs (absolute) unique certi fi ed domains domains (absolute) 12M domains (relative) 10M 1% % of DNSDB 8M 6M 0.1% 4M 2M 0 0.01% Sep '15 Nov '15 Jan '16 Mar '16 May '16 Jul '16 Sep '16