Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free...
by tialaramex on Monday June 14, 2021 @08:25PM
(#27510010)
Yes, it probably was me.
CAA assumes the Certificate Authorities are honest which I believe on the whole is a reasonable assumption - but it doesn't only protect you against accidents. Malevolence from third parties might be blocked by CAA too.
For example, suppose you conclude the some of the 3.2.2.4 Blessed Methods are unacceptably vulnerable to impersonation of your organisation. You identify that a particular CA specifies in their CPS that they never use any of these methods, you can use CAA to tell every other CA not to issue. As a result, these methods cannot be used to successfully obtain certificates that shouldn't exist. If an adversary tries to use another CA your CAA record tips off that CA that there's a problem, and if they try on your preferred CA then the vulnerable methods aren't offered.
I believe there is still work in progress to try to hook CAA together with ACME so that it would be practical to express "Only Let's Encrypt may issue, and only using dns-01" which rules out a lot of otherwise practical attacks for a resourceful adversary, but I don't track the status of that work.
CAA assumes the Certificate Authorities are honest which I believe on the whole is a reasonable assumption - but it doesn't only protect you against accidents. Malevolence from third parties might be blocked by CAA too.
For example, suppose you conclude the some of the 3.2.2.4 Blessed Methods are unacceptably vulnerable to impersonation of your organisation. You identify that a particular CA specifies in their CPS that they never use any of these methods, you can use CAA to tell every other CA not to issue. As a result, these methods cannot be used to successfully obtain certificates that shouldn't exist. If an adversary tries to use another CA your CAA record tips off that CA that there's a problem, and if they try on your preferred CA then the vulnerable methods aren't offered.
I believe there is still work in progress to try to hook CAA together with ACME so that it would be practical to express "Only Let's Encrypt may issue, and only using dns-01" which rules out a lot of otherwise practical attacks for a resourceful adversary, but I don't track the status of that work.