Decentralized Certificate Authorities
The security of TLS depends on trust in certificate authorities, and that trust stems from their ability to protect and control the use of a private signing key. The signing key is the key asset of a certificate authority (CA), and its value is based on trust in the corresponding public key which is primarily distributed by browser vendors. Compromise of a CA private key represents a single point-of-failure that could have disastrous consequences, so CAs go to great lengths to attempt to protect and control the use of their private keys. Nevertheless, keys are sometimes compromised and may be misused accidentally or intentionally by insiders.
We propose a new model where a CA’s private key is split among multiple parties, and signatures are produced using a secure multi-party computation protocol that never exposes the actual signing key. This could be used by a single CA to reduce the risk that its signing key would be compromised or misused. It could also enable new models for certificate generation, where multiple CAs would need to agree and cooperate before a new certificate can be generated, or even where certificate generation would require cooperation between a CA and the certificate recipient (subject). We demonstrate the practicality of this concept with an evaluation of a prototype implementation that uses secure two-party computation to generate certificates signed using ECDSA on curve secp192k1. We show that using Amazon AWS EC2 c4.2xlarge nodes to jointly sign a certificate costs as little as 28.2-32.6 cents without bandwidth cost and approximately 8.54 dollars with bandwidth cost.
Paper
Bargav Jayaraman†, Hannah Li†, David Evans. Decentralized Certificate
Authorities. arXiv:1706.03370. 11 June 2017 (updated 10 October 2017). (PDF, 12 pages)
(† The first two authors contributed as co-equal first authors.)
Code
https://github.com/hainali/decentralizedca