Schedule Critical Decentralisation Cluster

Certificate authorities suck, but the proposed replacements (e.g. DNSSEC/DANE) aren't so great either. That's why one year ago at the 34C3 Monero Assembly, I presented Namecoin's work on a decentralized alternative to certificate authorities for TLS. The attack surface was, in my opinion, substantially lower than any previously existing attempt. Compatibility and scalability weren't too bad either. But we're never satisfied, and wanted something even better. With significantly improved attack surface, compatibility, and scalability, our improved design bears little resemblance to what we had one year ago. In this talk, I'll cover the various shortcomings in our replacement for TLS certificate authorities from one year ago, and how we fixed them.

Certificate authorities (CA's) pose a serious threat to the TLS ecosystem. Prior proposed solutions (e.g. Convergence, DANE, HPKP, CAA, and CT) simply reshuffle the set of trusted third parties. In contrast, Namecoin solves the underlying problem: if you know a Namecoin domain name, you can find out which TLS certificates are valid for it, with a threat model and codebase nearly identical to the battle-hardened Bitcoin. One year ago at the 34C3 Monero Assembly, I presented a design (with implemented, working code) for accomplishing this in the real world of uncooperative web browsers, with best-in-class attack surface, good compatibility, and good scalability.

But there was still much that could be improved, ranging from ending our reliance on HPKP API's (which are being phased out), to preventing the browser's TLS implementation from leaving your browsing history on the disk, to sandboxing Namecoin's certificate override code so that it can't compromise non-Namecoin traffic even if exploited, to supporting Firefox and Tor Browser (both of which posed unique challenges), to name just a few. This talk will cover a wide variety of improvements we made to attack surface, compatibility, and scalability. Expect to learn lots of interesting little-known trivia about the innards of TLS implementations, which can be used for unexpected purposes in our mission to rid the world of the scourge that is certificate authorities.

Info

Day: 2018-12-30
Start time: 15:30
Duration: 00:40
Room: Main stage
Track: Talks & presentations
Language: en

Links:

• iCalendar
• Namecoin

Feedback

Click here to let us know how you liked this event.