[Servercert-wg] Compromised keys

[Ryan Sleevi]

On Tue, Apr 14, 2020 at 3:31 PM Tim Hollebeek via Servercert-wg <
servercert-wg at cabforum.org> wrote:

> Slightly more tricky is some sort of coordinated blacklist of keys, which
> would be a good idea.  It doesn’t help the internet if clueless users can
> simply shop around until they find a CA that doesn’t know that their key
> has been compromised, because it hasn’t been reported to them yet.
>

I think the question of whether this is a "good idea" depends on whether or
not (other) CAs are part of your threat model. Naturally, as a Root
Program, I'm most concerned about CAs that, intentionally or
unintentionally, are bad actors. This is significantly more tricky, not
slightly, because there's a question about whether or not the given key is
compromised.

DigiCert is broadly familiar with this concern, as captured in this thread
<https://groups.google.com/d/msg/mozilla.dev.security.policy/nU1bIZ9LgjU/8RxqN_zsAgAJ>,
in that revocation is not necessarily trustworthy. Imagine such a CA using
such a service to further prevent their customers from migrating. This
is one of the concerns with any form of CA-initiated revocation.


> One of the things that would make it easier to do this coordination would
> be if there were a few standardized forms of key compromise reports that
> CAs were required to accept.
>

I think this puts the solution first, and that's not as useful for
discussion.

I think it's more useful to discuss the problem statement first about the
problem we're trying to solve. Discussions of this specific topic seem to
lead towards different results, depending on how different participants
view the problem to be solved. Are you optimizing for reporters? For
holders of compromised keys? For CAs? Each of these leads to different
directions, and so a good starting point is to reach consensus about the
in-scope and out of scope problems.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/servercert-wg/attachments/20200414/9cf15508/attachment-0001.html>