Firefox and Self-調印するd Certs

見解／翻訳／版 1.01 - 2010-11-04

In summer 2008 there was a lot of discussion on the topic of Firefox's 警告s about SSL 証明書s which are 無効の or not 調印するd by a known 当局 ("self-調印するd"). Comment, 申し込む／申し出ing さまざまな levels of support or 批評, （機の）カム from Lauren Weinstein, Robert Accettura, Slashdot (twice), PC World, Nat Tuck, BetaNews, and Pingdom. I also had a 類似の, やめる heated discussion over dinner at 明言する／公表する of the 地図／計画する 2008. People also seemed 怪しげな of the 動機づけs behind Firefox's 承認 of EV 証明書s.

This page explains why Firefox's SSL UI was designed the way it was, and why we think it's 権利.

安全 = Encryption * Authentication

Before we begin, we must understand that 安全 = Encryption * Authentication. World-class encryption * 無 authentication = 無安全. This is an 絶対決定的な point which sadly is not しっかり掴むd by many 関係者s in the 審議. There's no point in encrypting your data with a secret 重要な if you don't know whose 重要な it is and who you are sending it to. That is a recipe for a Man in the Middle attack. Lauren Weinstein said:

But in many 状況／情勢s, we're not 関心d about 身元 in particular, we just want to get the basic https: crypto stream up and running.

But there is no such 状況／情勢. If you don't know who you are talking to, then encryption is useless because you could be talking to an 攻撃者. (Self-調印するd certs 現実に do 供給する some ways for you to know who you are talking to in a 限られた／立憲的な fashion, and we'll come on to those.) If you don't do anything to check whether you are talking to who you think you are, or if you do the wrong checks, then all the crypto is a waste of time.

Some argue that 追加するing encryption, even without authentication, is a 妨げる／法廷，弁護士業-raising 演習 which defends against basic packet 匂いをかぐing. Nat Tuck says:

Snooping a 関係 (i.e. on a wireless link) is much easier than any of the impersonation attacks that SSL authentication 妨げるs.

However, that's 簡単に no longer true. The newly-raised 妨げる／法廷，弁護士業 is still at the point-and-click level - MITM attacks are that 平易な these days. For more 詳細（に述べる）s of just how 平易な, see johnath's blog 地位，任命する.

So some authentication is 要求するd. But how much? Let's look at three use 事例／患者s for 安全な・保証する関係s on the web. They are, in 減少（する）ing order of authentication strength:

You want to know what organization you are talking to.
You want to know that you are connected to the 権利 domain 指名する.
You want to know that you can repeatably connect to the same person or place.

1: Strong 組織の身元

シナリオ 1 適用するs in 状況／情勢s such as banking or e-商業. Rather than have to know and remember that http://www.bankofamerica.com/ is Bank of America, 反して http://www.bank-of-america.com/ is not, Joe Public would much rather that their web browser said "Bank of America, Inc. (US)" to 除去する all 疑問. Joe would like to know that someone had 現実に gone away and made sure that only the real Bank of America in the US can get a cert which says that, and if he gets scammed, that someone knows where to send the police.

This is, in a nutshell, the service that EV certs 供給する. Now, some have said that this is what the CAs should have been doing all along, and how come they get to 告発（する），告訴（する）／料金 more money for it now? Even after 公式文書，認めるing that DV isn't good enough, Robert Accettura still （人命などを）奪う，主張するs that:

Essentially EV SSL is nothing more than a 計画／陰謀 to 告発（する），告訴（する）／料金 more. EV SSL is supposed to do what a 調印するd 証明書 should have been doing all along.

That second 宣告，判決 may be true, although one can argue about who was 責任がある the pre-EV 状況／情勢 in the 証明書 market. For a long time, certs with almost no checking looked the same in browser UI as certs with good checking. So all the incentives were to do いっそう少なく checking. But then, no UI differentiation was possible, because there was no 独立した・無所属基準 for what "good checking" meant anyway. There were faults on both 味方するs.

Prices for 基準 domain-validation certs are now as low as 解放する／自由な - and for that money, you get no 身元 checking at all. EV certs cost EV prices because the CAs 現実に do all the checks defined in this 文書 (PDF), and are audited to make sure they do. If you think EV doesn't 追加する any extra 保護, tell us how fraudsters can fool those checks. We helped 令状 this 基準, and we will 直す／買収する，八百長をする anything that is broken.

We think that EV 供給するs us a way to put a human-readable 組織の identifier in the browser UI with high 信用／信任 that it's 訂正する. There is no other 存在するing technical way to 得る this sort of reliable identifier. And we think this is useful in helping people to know the 身元 of who they are talking to. That's the value EV 供給するs - authenticated 身元.

2. Domain 立証

シナリオ 2 適用するs in 状況／情勢s like webmail. Your email 演説（する）／住所 is fred@myispmail.com, so you want to know you are at myispmail.com, and you want encryption, but you don't 特に need to be told who runs myispmail.com - you know it's MyISP.

One important thing to 公式文書，認める is that DNS is not 安全な・保証する - it can be spoofed, as Dan Kaminsky has recently 論証するd. (Dan has some 利益／興味ing thoughts about the interaction of DNS 欠陥s and 証明書欠陥s. His one line 要約: "weak authentication leads to pwnage".) DNSSEC is still some way off and, until it arrives, you can't be sure that the IP 演説（する）／住所 DNS returns when you look up "myispmail.com" is 訂正する. You could be sent anywhere. SSL 証明書s from a 信用d third party are the only way of 確実にするing that you are 現実に connected to the 場所／位置 you asked for. That is the service you are getting with a DV cert. This does not have to cost you anything. The に引き続いて providers 供給（する）解放する／自由な証明書s¹:

StartCom (1 year 有効性，効力)
Comodo (90 day 有効性，効力)
Thawte (21-day 有効性，効力)

If 非，不，無 of the above 控訴 you, year-long all-browser 証明書s can be had for as little as $14.99 from some vendors.

In an ideal world, 存在 sure you are connected to the 訂正する場所／位置 would be something the Internet 供給するd for 解放する／自由な. DNS was designed in a time when people didn't think malicious people would try to subvert it, and the proper 直す／買収する，八百長をする has not yet been （軍隊を）展開する，配備するd. Until it is, IMO, the hassle of 得るing a 解放する／自由な証明書 is not an exorbitant price to 支払う／賃金 to 直す／買収する，八百長をする the 安全穴を開ける.

(Excursus: if domain 所有権 is 実証するd by sending email to a 接触する at the domain, then this sort of 証明書 could be fraudulently 得るd by an 攻撃者 who is able to 支配（する）／統制する the CA's DNS or 大勝するing by Kaminsky-like methods, BGP or 類似の attacks - because they can 迎撃する the email. So in fact, in some ways, the 安全 of such certs does depend on the 安全 of the DNS. Which is worrying.)

3. 関係 Repeatability

シナリオ 3 適用するs when you want to make sure you are connected to the same person you were connected to before.

This is where the 支持者s of self-調印するd certs say that they come in. Often, they say: "$14.95 is still too expensive - why can't I self-調印する my cert?" Frank 公式文書，認めるs that this form of the argument is a 非，不，無-sequitur. The 安全 or さもなければ of self-調印するd certs is not connected to the cost of CA certs. But we still should 演説（する）／住所 the 問題／発行する.

We've already 公式文書，認めるd that if you have 無 authentication, you have 無安全. Self-調印するd certs 供給する非，不，無-無 authentication if you do the に引き続いて:

確認する the 重要な指紋 out-of-禁止（する）d (i.e. by 非，不，無-web means) on first connect.
Make sure it's always the same thereafter (ソフトウェア普通は does this for you automatically).
Re-確認する the new 指紋 out-of-禁止（する）d if the 重要な changes.

If you do these three things, you get a repeatable 安全な・保証する関係 to whoever it was you 接触するd out-of-禁止（する）d in step 1).

Leaving aside the fact that many people who use this model for SSH don't bother to do 1) in practice but just say "承認する" and hope, it is our 主張 that no-one has yet come up with a UI that makes this model of crypto (known as 重要な連続管理／経営 - KCM - or "the SSH model") 理解できる to Joe Public. You can't 供給する him with a string of hex characters and 推定する／予想する it to read it over the phone to his bank. What he does instead is just click "承認する", which might 同様に be labelled "Yeah, Whatever", and hopes for the best. The same thing happens when he gets "重要な changed!" 警告s, even scary ones.

The first important thing to 公式文書，認める about this model is that 重要な changes are an 推定する／予想するd part of life. No-one does or should use the same 重要な for ever, and 重要な妥協 or discovered 証拠不十分 means that 重要なs change. So the 使用者 is going to get a 一連の警報s over time, some of which 示す an 承認する条件, and some of which 示す a dangerous 条件. It is our 主張 that no UI can navigate Joe through this 複雑さ in a 安全な way.

Usability 研究 tells us that repeated 安全 dialogs and 警告s habituate 使用者s into just clicking "承認する" - it's the "Yeah, Whatever" thing again. If that dialog mostly 示すs a benign 条件 but occasionally 示すs a serious one, then the problem is 構内／化合物d. This happens no 事柄 what the dialog says. UI designers can work on the 言い回し for a year, but whatever it is, it'll 結局 just get ignored.

Secondly, there's no 保護 against 妥協d 重要なs. If someone gets 持つ／拘留する of your 私的な重要な, they can impersonate you at will - and there's nothing you can do about it. The revocation story for SSL 証明書s has 歴史的に also been poor for 特許 and 業績／成果推論する／理由s, but that's changing with the advent of OCSP, which is 要求するd for EV 証明書s from 2010. 重要な妥協 is not just a theoretical problem - almost all SSL 重要なs 生成するd on Debian systems for the 18 months to May 2008 are 全く妥協d, 予定 to a 欠陥 in the 無作為の number 発生させる人（物）. 攻撃者s can work out the 私的な重要な if they know the public one.

There's also a privacy 問題／発行する - the browser has to keep a 名簿（に載せる）／表（にあげる） of SSL 場所／位置s you've visited and (unless you want yet more cert change 警告s) can't （疑いを）晴らす it when you （疑いを）晴らす your history etc.

"承認する," you may say. "This model is not for Joe. But why can't I use it? I understand the 危険s. I 約束 to 確認する my 重要な指紋s out-of-禁止（する）d for every new 関係 or 重要な change. Really. I 約束."

The 決定的な problem here, that cannot be 強調する／ストレスd enough, is that while this is a reasonable 願望（する） in a (very small) 選挙区／有権者 of geeks like us, we have not 設立する a way to make it any easier for geeks to use the KCM model without putting at 危険 all the people who only ever use the 基準 model. The 証明書 change 警告s which are a 正規の／正選手 part of life in KCM 示す an attack in normal SSL usage. We don't want to 最小限に減らす the 真面目さ of the 警告s that 保護する使用者s in normal use, or the difficulty of bypassing them.

But what about Intranets? Why should they have to 支払う／賃金? There are two possible answers. One 解答 is to 任命する／導入する the company's root in the browser. Everyone can do this manually or the IT department can use the （弁護士の）依頼人 Customizability 道具 (CCK) to make a custom Firefox.

However, running your own CA has its own hidden costs - and you 普通は discover them after a 重要な妥協 when you have to update all the 証明書s at once, and everyone has to learn a lot about crypto really quickly. A simpler 解答 is just to get in touch with StartCom, or 予算 for a few 支出s of $14.95 or whatever, and use the same public CA system everyone else does.

結論

This 問題／発行する is not as simple as it appears. We have done a lot of thinking about what's possible and 安全な, and what isn't. Like all that Mozilla does, this is driven by a 願望（する） to 保護する our 使用者s, not a 願望（する） to make people 支払う／賃金 for SSL 証明書s (why would that be a goal?). We are open to suggestions, but think the 現在の UI 攻撃する，衝突するs the 権利 balance.

特別手当 Section: Slashdot Myths Rebuttal

All of the below are 引用するs or ideas from Slashdot comments.

any cert can be 妥協d within seconds after it is 問題／発行するd, [...] therefore, certs 供給する NO 保証／確信 you're connected to who the URL 示すs you are.: A cert can be 妥協d "within seconds of 存在問題／発行するd" if e.g. your website has already been 切り開く／タクシー／不正アクセスd when you 任命する／導入する it - in which 事例／患者, you have bigger problems. Even taking this rare 可能性 into account, the second 声明 is only true if there is no revocation. In other words, it is true of self-調印するd certs but not of e.g. EV certs.
CAs who 告発（する），告訴（する）／料金 nothing cannot be 成し遂げるing any 身元保証／確信s at all: Many companies choose to give away particular services for 解放する／自由な, which have a 非，不，無-無 cost associated with them, for 商売／仕事推論する／理由s.
Verisign is a monopoly. The 100 CAs in FF are all monopolies: This is somewhat self-反駁するing. Depending on how you count, there are over 40 different CAs in the Firefox root 蓄える／店, of which many are also in the root 蓄える／店s of the other browsers. They 供給する証明書s and services at a wide 範囲 of price points.
…に反対するing self-調印するd certs 証明するs you're in 好意 of Verisign's monopoly: Verisign doesn't have a monopoly (see above). This argument is a 事例／患者 of 毒（薬）ing the 井戸／弁護士席.
self-調印するd certs 供給する better 身元確認，身分証明 than no SSL certs: A 誤った sense of 安全 is worse than no 安全.
certs cost at least USD$100 per year, 証明書s costs are horrendous: See the main text. In fact, for many people or organizations $100 is an upper 限界 because for about that much you can get a wildcard 証明書 for as many websites in the same domain as you like.
"chained certs" are inferior to those 問題／発行するd 直接／まっすぐに by a root CA.: Chained certs mean that the CA does not use their embedded root 証明書直接／まっすぐに for 調印, which means they can have it locked up somewhere 安全な and inaccessible. Therefore, certs which are chained are, if anything, safer.
CAs 賄賂 Mozilla to put their certs into Firefox: Mozilla does not solicit or 受託する支払い（額） for 傾向 in the root 蓄える／店.
No certs 供給する any real 保証／確信s at all because anyone can get a cert for any organization 指名する or any domain 指名する they wish.: No-one should be able to get a cert a domain 指名する they don't 支配（する）／統制する (unless they self-調印する it). If you have 証拠 they can, let's see it. DV certs do not vet the O (Organisation) field, but Firefox does not show that field in the UI for such certs, so that's 承認する.
Verisign is a 詐欺 because people have 調印するd malware with authenticode certs 問題／発行するd by Verisign.: 証明書s are about 身元, not virtue.
CACert is the only 解放する／自由な CA: See the main text.
CAs do nothing more than run OpenSSL, which you can do for yourself for 解放する／自由な.: Check out the WebTrust 原則s and 基準 to get some idea of the levels of 正直さ and 安全 CA systems have to 会合，会う.