Comment by contingencies | Hacker News Reader

Comment by contingencies | Hacker News Reader

Parent Full thread

I agree decentralization is desirable but haven't studied all of the proposals in depth. Over at http://www.certificate-transparency.org/comparison Google claims:

...that their CT approach is superior to TACK because (T1) Servers can instantly roll out a new key if the previous one is lost (T2) Global (ie. whole internet sees evil server instead of good server) and targeted attack detection is superior (T3) There are no trusted third parties (T4) Newly issued keys on totally new sites can also be validated (to a greater extent) (T5) No server modification (ie. to deliver pinning headers) is required.

... that their CT approach is superior to Convergence because (C1) It is not known to introduce side-channel attacks due to changes in the SSL connection negotiation phase (C2) Servers can instantly roll out a new key if the previous one is lost (C3) Global attacks (ie. whole internet sees evil server instead of good server) are negated (C4) There are no trusted third parties (C5) Newly issued keys on totally new sites can also be validated (C6) No server modification (ie. to deliver pinning headers) is required.

Can anyone refute these claims?

Alexandra C. Grant wrote a paper comparing different methods of improving the current CA system: http://www.cs.dartmouth.edu/reports/TR2012-716.pdf

But unfortunately she does not take TACK/pinning + Convergence in consideration.

I wrote an article discussing many CA alternatives which also includes Convergence, here:

https://medium.com/bitcoin-security-functionality/b64cf5912a...

Convergence IMHO does not work. The UI is poor and fundamentally it's just the CA model with very short lived constantly renewed certificates. There's no particular reason to believe it'd work better than the existing PKI for ordinary users.

> it's just the CA model with very short lived constantly renewed certificates

Very strange conclusion. Convergence have following properties CA model does not have:

* trust is optional (you don't have to trust Iranian CAs) * trust is revocable (you can safely remove trust from any notary) * trust is distributed (you trust only if all notaries are acting as one; as opposing to "you trust anything any of CAs will say")

Notaries are not signing anything, they are not CAs. Also, there is nothing like "short lived constantly renewed certificates" in this model. Hosts are using self-signed certs (or CA signed - does not matter). Notaries are functioning in "attacker will not MiTM whole Internet" model and only help you detecting if something went wrong.

If anything, convergence is a combination of TOFU and WoT models. Although an attempt to describe a security model by such comparisons does not help much.

> Convergence IMHO does not work. The UI is poor

There is no need for a UI in Convergence that I know of? What part are you talking about?

> and fundamentally it's just the CA model with very short lived constantly renewed certificates.

I don't understand what you are referring to. There are no "short lived constantly renewed certificates" in Convergence.

Maybe you mean something else

OK.

That's interesting coming from the Bitcoin angle as I've seen Trezor present before and personally opposed Gavin's stance on both SSL use and the general scope increase in Bitcoin's Payments/Receipts discussions. Deaf ears.

Reading the comparison table you linked, there is a misleading point, but I may understand it wrong: they claim that CT "does [...] avoid the need for the client to trust a third party", but in reality the client still needs to trust CAs, and have the CA keys in his trust store. Removing a CA key from the trust store of the browser basically invalidates all certs signed by that CA (just like it is now). It's just a framework for monitoring the released certificates. Trust on the CA still needs to be there. And as Moxie sad: "Whenever someone is proposing an other authenticity system, the question that we should all ask is: who do we have to trust, and for how long? And if the answer is: a prescribed set of people, forever, proceed with caution."

With CT we still have to trust CAs. Basically forever.

Reply on news.ycombinator.com