Paper Info
Title
Trust me, I'm a Root CA! Analyzing SSL Root CAs in Modern Browsers and Operating Systems
Abstract
The security and privacy of our online communications heavily relies on the entity authentication mechanisms provided by SSL. Those mechanisms in turn heavily depend on the trustworthiness of a large number of companies and governmental institutions for attestation of the identity of SSL services providers. In order to offer a wide and unobstructed availability of SSL-enabled services and to remove the need to make a large amount of trust decisions from their users, operating systems and browser manufactures include lists of certification authorities which are trusted for SSL entity authentication by their products. This has the problematic effect that users of such browsers and operating systems implicitly trust those certification authorities with the privacy of their communications while they might not even realize it. The problem is further complicated by the fact that different software vendors trust different companies and governmental institutions, from a variety of countries, which leads to an obscure distribution of trust. To give insight into the trust model used by SSL this thesis explains the various entities and technical processes involved in establishing trust when using SSL communications. It furthermore analyzes the number and origin of companies and governmental institutions trusted by various operating systems and browser vendors and correlates the gathered information to a variety of indexes to illustrate that some of these trusted entities are far from trustworthy. Furthermore it points out the fact that the number of entities we trust with the security of our SSL communications keeps growing over time and displays the negative effects this might have as well as shows that the trust model of SSL is fundamentally broken.
Year
DOI
Venue
2015
10.1109/ARES.2015.93
International Conference on availability, reliability and security
Keywords
Field
DocType
PKI, trust, CA
Public key infrastructure,Internet privacy,Authentication,Trust anchor,Trustworthiness,Computer science,Computer security,Software,Computational trust,Certification,Operating system
Conference
Citations 
PageRank 
References 
0
0.34
4
Authors
4
Name
Order
Citations
PageRank
Tariq Fadai100.34
Sebastian Schrittwieser229135.16
Peter Kieseberg318729.39
Martin Mulazzani423320.01