The security echo chamber has gotten quite loud over the last few days over the Comodo sub-CA bogus certificate issuance. This is a good opportunity to look at what happened, why this isn’t as startling as some might think, and general problems in the SSL CA model.
A primer on certificates and authorities
Certificates are built on top of asymmetric cryptographic systems – systems where you have a keypair that is split into a private half (held closely by the owner) and a public half (distributed widely). Information encrypted with one half is only decryptable with the other half. If you encrypt with the public key, we call it encryption (the information is now secret and can only be read by the private key owner); if you encrypt with the private key, we call it signing (the information can be verified by anyone, but only you could have generated it). There are additional optimization nuances around hashes and message keys, but we’ll gloss over those for now.
Anyone can generate asymmetric keypairs; what makes them interesting is when you can tie them to specific owners. The SSL model is based on certificates. A certificate is just someone’s public key, some information about that public key, and a signature of the key and information. The signature is what’s interesting — it’s generated by another keyholder, whose private key & certificate we call a certificate authority (CA).<
“You’ve got me. Who’s got you?”
How do we trust a CA that has signed a certificate? It itself might be signed by another CA, but at some point, we have to have a root of trust. Those are the CAs that our web browsers and operating systems trust to sign other certificates. You should take a gander around the list (Mozilla ships about 50 organizations as root CAs, Internet Explorer far more). Those roots can directly sign any SSL certificate, or can sign an intermediate CA, which then signs certificates.
The most expensive part of issuing a certificate is verifying that the purchaser is authorized to hold one. Many CAs, including Comodo, have resellers who can instruct the CA to issue certificates; the reseller becomes what is known as the “Registration Authority (RA).” (Full disclosure: Akamai is a reseller of several CAs, including Comodo, although certificates we sign only work with the private keys that we hold on our platform.)
There are two major, fundamental flaws in this architecture.
First, the number of trusted CAs is immense. And each of those CAs can authoritatively sign certificates for any domain. This means that CA Disig (of the Slovak Republic) can issue authoritative certs for www.gc.ca, the Government of Canada’s website. (Full disclosure: my wife’s mother is from Slovakia, and my father’s side of the family is Canadian.) Fundamentally, the list of root CAs in everyone’s browser contains authorities based anywhere in the world, including governments known to be hostile to theirs. A related issue is that most enterprises have their own “private CA” which signs intranet certificates; that CA becomes valid for any domain when the user adds it to their trust chain.
Second, RAs are a very weak point. Not only are they in a race to the bottom (if you can buy an SSL cert for under $50, imagine how little verification of your identity the RA can afford to do), but any one of them, if compromised, can issue certificates good for any domain in the world. And that’s what happened in the case of the bogus Comodo certificates.
Kudos to Comodo for good incident response, and explaining clearly what happened. I suspect that’s the rarity, not the issuance of bogus certificates.