Efficient Gossip Protocols for Verifying the Consistency of Certificate Logs

Abstract

The level of trust accorded to certification authorities has been decreasing over the last few years as several cases of misbehavior and compromise have been observed. Log-based approaches, such as Certificate Transparency, ensure that fraudulent TLS certificates become publicly visible. However, a key element that log-based approaches still lack is a way for clients to verify that the log behaves in a consistent and honest manner. This task is challenging due to privacy, efficiency, and deployability reasons. In this paper, we propose the first (to the best of our knowledge) gossip protocols that enable the detection of log inconsistencies. We analyze these protocols and present the results of a simulation based on real Internet traffic traces. We also give a deployment plan, discuss technical issues, and present an implementation.

9 pages, 5 figures

Cited by in corpus (10)

• Systematizing Decentralization and Privacy: Lessons from 15 Years of Research and Deployments
• BlockPKI: An Automated, Resilient, and Transparent Public-Key Infrastructure
• PKI Safety Net (PKISN): Addressing the Too-Big-to-Be-Revoked Problem of the TLS Ecosystem
• RITM: Revocation in the Middle
• F-PKI: Enabling Innovation and Trust Flexibility in the HTTPS Public-Key Infrastructure
• Protocol for Asynchronous, Reliable, Secure and Efficient Consensus (PARSEC) Version 2.0
• AQUAREUM: Non-Equivocating Censorship-Evident Centralized Ledger with EVM-Based Verifiable Execution using Trusted Computing and Blockchain
• SmartCert: Redesigning Digital Certificates with Smart Contracts
• Aggregation-Based Certificate Transparency Gossip
• Permissionless Blockchains and Secure Logging