RevCast : Fast, Private Certificate Revocation over FM radio Aaron Schulman Stanford University Dave Levin Neil Spring University of Maryland University of Maryland
Authentication in the PKI
Authentication in the PKI I want an encrypted connection.
Authentication in the PKI I want an encrypted connection. Certificate #12 Signed by CA:
Authentication in the PKI I want an encrypted connection. The CA ( ) Certificate #12 attests that is controlled by Signed by CA:
Authentication in the PKI Is bound to ? The CA ( ) Certificate #12 attests that is controlled by Signed by CA:
Authentication in the PKI Is bound to ? The CA ( ) Certificate #12 attests that Trusted Root CAs is controlled by Signed by CA:
Authentication in the PKI Is bound to ? The CA ( ) Certificate #12 attests that Trusted Root CAs ✔ is controlled by Signed by CA:
Revocation in the PKI Certificate #12 Trusted Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Trusted Certificate #12 Root CAs Signed by CA: C
Revocation in the PKI Revocation Trusted Certificate #12 Certificate #12 Root CAs Signed by CA: Signed by CA: C
Revocation in the PKI Revocation Trusted The CA ( ) breaks Certificate #12 Certificate #12 Root CAs the binding of with Signed by CA: Signed by CA: C
Revocation in the PKI Revocation Trusted The CA ( ) breaks Certificate #12 Certificate #12 Root CAs the binding of with ✔ Signed by CA: Signed by CA: C
Revocation in the PKI Revocation Trusted ❌ The CA ( ) breaks Certificate #12 Certificate #12 Root CAs the binding of with ✔ Signed by CA: Signed by CA: C
Revocation in the PKI Revocation Trusted ❌ The CA ( ) breaks Certificate #12 Certificate #12 Root CAs the binding of with ✔ Signed by CA: Signed by CA: C
Revocation in the PKI One revocation every 1.1 seconds for all CAs on the Internet Revocation Trusted ❌ The CA ( ) breaks Certificate #12 Certificate #12 Root CAs the binding of with ✔ Signed by CA: Signed by CA: C
Every device needs revocations Revocation Certificate #12 Signed by CA: C
Every device needs revocations Revocation Certificate #12 Signed by CA: C
Properties of revocation systems
Properties of revocation systems 10s Timeliness Clients’ revocation state should be up-to-date, ideally within 10s of seconds
Properties of revocation systems $ $ 10s $ $ $ $ Timeliness Low-cost dissemination The distribution Clients’ revocation mechanism must scale state should be with CAs, certificates, up-to-date, ideally and clients within 10s of seconds
Properties of revocation systems $ $ 10s $ $ $ $ Timeliness Privacy Low-cost dissemination The distribution Clients’ revocation Users’ browsing mechanism must scale state should be habits should not with CAs, certificates, up-to-date, ideally have to be revealed and clients within 10s of seconds
Properties of revocation systems It is generally regarded that no system can possibly achieve all three. $ $ 10s $ $ $ $ Timeliness Privacy Low-cost dissemination The distribution Clients’ revocation Users’ browsing mechanism must scale state should be habits should not with CAs, certificates, up-to-date, ideally have to be revealed and clients within 10s of seconds
Properties of revocation systems It is generally regarded that no system can possibly achieve all three. $ $ 10s $ $ $ $ Timeliness Privacy Low-cost dissemination ✔ ✔ ✔ The distribution Clients’ revocation Users’ browsing mechanism must scale state should be habits should not with CAs, certificates, up-to-date, ideally have to be revealed RevCast and clients within 10s of seconds
Existing revocation systems Certificate CRL CA Revocation Lists Client 124, 24 21, 2521 (CRL) Online Certificate Revocation CA Certificate #12 Status Protocol Client Signed by CA: (OCSP) Certificate #12 Certificate #12 CA Org Short lived certs Client Signed by CA: Signed by CA: Still ok Still ok CA OCSP Stapling Org Client Certificate #12 Certificate #12 Signed by CA: Signed by CA:
CRL CA Client 124, 24 21, 2521 Revocation CA Certificate #12 Client Signed by CA: Certificate #12 Certificate #12 CA Org Client Signed by CA: Signed by CA: Still ok Still ok CA Org Client Certificate #12 Certificate #12 Signed by CA: Signed by CA:
Existing revocation systems ❌ ❌ ✔ CRL CA CRLs Client 124, 24 21, 2521 ❌ ❌ ✔ Revocation CA OCSP Certificate #12 Client Signed by CA: ❌ ✔ * ✔ Certificate #12 Certificate #12 CA Short lived Client Org Signed Signed ❌ ✔ ✔ Still ok Still ok Stapling CA Org Certificate #12 Certificate #12 Client Signed Signed
Existing revocation systems ❌ ❌ ✔ CRL CA CRLs Client 124, 24 21, 2521 ❌ ❌ ✔ Revocation CA OCSP Certificate #12 Client Signed by CA: ❌ ✔ * ✔ Certificate #12 Certificate #12 CA Short lived Client Org Signed Signed ❌ ✔ ✔ Still ok Still ok Stapling CA Org Certificate #12 Certificate #12 Client Signed Signed All of these protocols rely on unicast transmission of revocations
Unicast is not well suited for distributing revocations Doesn’t scale to distributing to every device on the Internet Failures are benign indication of connectivity issues (soft-fail) Multicast revocation is also flawed (Sybils, MITM, DoS)
RevCast We propose broadcasting revocations over FM RDS Revocation Certificate #12 Signed by CA: Tower: http://cityspottercards.com/
RevCast We propose broadcasting revocations over FM RDS Revocation Certificate #12 Signed by CA: Tower: http://cityspottercards.com/
FM RDS coverage is ideal for disseminating revocations 200,000 150,000 100,000 50,000 0 • Transmitters are where people are • Up to 10 million people per tower
Properties of revocation systems $ $ $ $ $ $ Low-cost dissemination Privacy One transmission Radio broadcasts covers up to 10 million are inherently & Under-monotized receiver anonymous
Properties of revocation systems $ $ $ $ $ $ Low-cost dissemination Privacy One transmission Radio broadcasts covers up to 10 million are inherently & Under-monotized receiver anonymous
Properties of revocation systems Solved . Let’s go party like it’s 1989! $ $ $ $ $ $ Low-cost dissemination Privacy One transmission Radio broadcasts covers up to 10 million are inherently & Under-monotized receiver anonymous
10s Timeliness? One tiny problem. RDS has an effective bitrate of 421.8 bps .
Rest of the talk RevCast protocol - fitting revocations in 421.8 bps Evaluate RevCast with 2 months of revocations
Revoking over FM RDS Radio CAs Receivers station
Revoking over FM RDS Radio CAs Receivers station 1 R 2 R 3 R
Revoking over FM RDS Radio CAs Receivers station 1 R 3 2 2 1 R R R R 3 R
Losses can go undetected Radio CAs Receivers station 1 R 2 R 3 2 1 R R R 3 R
Losses can go undetected Radio CAs Receivers station 1 R 2 R 3 2 1 R R R ❌ 3 R
Losses can go undetected Radio CAs Receivers station 1 R ❌ 2 R 3 2 1 R R R ❌ 3 R
Losses can go undetected Radio CAs Receivers station 1 R ❌ 2 R 3 2 1 R R R ❌ 3 R GoDaddy didn’t revoke
Making losses detectible with “nothing now” Radio CAs Receivers station 1 R 3 2 2 1 R Nn R R 3 Nn
Making losses detectible with “nothing now” Radio CAs Receivers station 1 R 3 2 2 1 R Nn R R 3 Nn GoDaddy says they didn’t revoke
Making losses detectible with “nothing now” Radio CAs Receivers station 1 R 3 2 2 1 R Nn R R ❌ 3 Nn GoDaddy says they didn’t revoke
Making losses detectible with “nothing now” Radio CAs Receivers station 1 R ❌ 3 2 2 1 R Nn R R ❌ 3 Nn GoDaddy says they didn’t revoke
Making losses detectible with “nothing now” Radio CAs Receivers station 1 R ❌ 3 2 2 1 R Nn R R ❌ 3 Nn Danger!!! I am not up- to-date with GoDaddy
Sleeping receivers can lose synchronization Radio CAs Receivers station 1 R 3 2 2 1 R Nn R R Z Z Z 3 Nn Z
Sleeping receivers can lose synchronization Radio CAs Receivers station 1 R 3 2 2 1 R Nn R R 3 Nn What did I miss?
Recommend
More recommend
