Home / News

Proposal on How SSL Certificate Industry Should Be Replaced Gains Some Momentum

SSL replacement proposal made by security expert Moxie Marlinspike, last August at the Black Hat Conference (called 'Convergence'), is gaining some momentum, particularly after the recent hacker attacks on DigiNotar, GlobalSign, Comodo and other SSL certificate authorities that have resulted in fake certificates coming into use on the web, including a fake Google certificate, since revoked. Marlinspike thinks this whole system — which props up the multi-million-dollar certificate authority business today — should be dumped in favor of the idea of the user more directly controlling how the browser trusts certificates based on so-called Convergence "notaries" proving online feedback about what to trust.

Read full story: Network World

By CircleID Reporter – CircleID's internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us. Visit Page

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Comments

Two things By David A. Ulevitch  –  Oct 12, 2011 11:48 am PDT

This has been in the works for a LONG time, and discussed for a while.  SSL has always been a sham.  Momentum had been quietly building for a while, and it just took a few CAs to bring it into the mainstream light.  The idea of embedding SSL fingerprints in DNS has been discussed for years, for instance.

So my two thoughts:
1) This is definitely going to happen.  Chrome will be pushing it the Google way, and Moxie (and many others) will push it the other ways.  Both will probably gain traction.
2) This makes Verisign look very smart for selling off the SSL business to Symantec.  And makes Symantec look like the goofballs they usually are.  Their absolute lack of real security vision is second to none.

IETF DANE By Paul Vixie  –  Oct 13, 2011 7:10 am PDT

The certificate authority system used by the web's e-commerce system is indeed weak.  What's less certain is that it ought to be replaced by multiple approaches, one from Moxie, one from Google, and so on.

The Internet Engineering Task Force (IETF) has a DNS-based Authentication of Named Entities (DANE) working group and is a dozen revisions into a DNSSEC profile for authenticating the certificates needed for e-commerce.

This protocol will work, it will be as secure as DNSSEC itself, and it will scale.  I urge the technical and business communities to get behind a single global standard to replace the X.509 certificate authority system.

Add Your Comments

 To post your comments, please login or create an account.

Related

Topics

Threat Intelligence

Sponsored byWhoisXML API

Domain Names

Sponsored byVerisign

Domain Management

Sponsored byMarkMonitor

Brand Protection

Sponsored byAppdetex

Cybersecurity

Sponsored byVerisign

IPv4 Markets

Sponsored byIPXO