Digital Certificates validation is an important topic in keeping information secure. In this article, I’ll show you a comparison of these methods.
Using public-key cryptography solves the key exchange problem that exists in symmetric cryptography. However, another problem shows up: trust. Does the public key that comes from the other end of the connection belong to the sender?
One way to promote this relationship of trust is through digital certificates. These contain the public key, information of the digital certificate owner and information of the certificate. You can read more about digital certificates in this post.
Currently, web applications use the HTTPS protocol to protect the connection. This protocol is the combination of the HTTP communication protocol and the SSL or TLS cryptographic protocols. These protocols can identify the identity of the server using digital certificates.
To validate the data, it is necessary to verify that the digital certificates that are used belong to the person who claims to be the owner of the certificate. In this way, attacks such as man in the middle are avoided.
This step is critical to the security of the connection because if a fake certificate is accepted, the data that is sent through that network connection can be exposed. The security of the protocol depends largely on being able to trust the public key that is received from the other end of the connection.
There are several systems to validate the identity of the owner of the digital certificate (s) used in the connection.
The selection of the method to use depends on the scenario where it will be used.
Table of Contents
- Public Key Infrastructure
- Local certificate repository
- Direct validation of certificates
- Differences between the trust relationships of the methods of digital certificates validation
- Recommendations for digital certificates validation approaches
Find below a brief description of the methods and a comparison.
Public Key Infrastructure
Public Key Infrastructure (PKI) is a combination of hardware, software, security policies and procedures that allow the safe execution of cryptographic operations such as encryption, digital signature, or non-repudiation of electronic transactions.
The PKI, among other uses, allow us to do digital certificates validation. There are Certification Authorities (CA) that sign the certificates and respond for their authenticity.
When a certificate is signed by a valid Certificate Authority and recognized by the client, the certificate is assumed to be trusted by the client and is automatically accepted. If not, it is rejected, and a warning is displayed to the user.
The deployment of a PKI can vary in complexity and structure. A widely used structure is the hierarchical tree structure. You can start from a root CA and form a tree in which each of its nodes is a CA for the lower branches.
CAs are generally government entities or large companies trusted by users, like Google, Microsoft, etc.
When the server uses the signed certificate in a connection, if the Root CA or one of the intermediate CAs is an internationally endorsed entity, the SSL/TLS clients should have it on their trust list. This commonly happens in web browsers.
The customer can add the entity in their trusted CAs manually and establish a secure connection. Even if it is not internationally recognized.
PKI advantages
Using a CA linked to a PKI is the most widely used system. Generally, software modifications are not required to use the software in the connection.
There are CAs with a high international reputation and they are integrated into the current browsers as a trusted authority. This system is scalable and allows adding new CAs if the user requires them.
As the certificate validation is carried out by a trusted CA for the user, for example, government entities, this system has a high degree of veracity.
Disadvantages of PKI
Digital certificates validation by a third party can make the existing security system in the network more complex.
If someone uses a digital certificate validated by that PKI to carry out a man-in-the-middle attack, the protocol might not detect it since the certificate to be used by the attacker is also trusted.
If you deploy the services on a network without internet access, digital certificates validation by an international CA may be more complex. In that case, it may be necessary to create a private PKI or coordinate with a trusted CA to be responsible for the network certificates.
Local certificate repository
Clients of secure protocols such as SSL/TLS also allow you to add certificates to your local trust list without having to be endorsed by a PKI.
When a secure connection is going to be established, it checks if the certificate sent by the server is in its trust list. If so, it connects and if not, it can add the certificate to the list or just cancel the connection.
This system is more complex for the user to maintain because it must have a list of all the trusted certificates. If you use a PKI, you only must verify that the certificate has been signed by a valid CA. This reduces the number of certificates that you must store. The responsibility of defining which certificates to accept is delegated to the CA.
Advantages of local certificate repository
The method only depends on the user’s decision to accept a certificate as valid.
This makes the validation system less complex. In addition, the user has full control of the certificates to be used.
Disadvantages of local certificate repository
The user does not have an entity to tell him that a certificate is valid and depending on his knowledge, this can be a problem for the protocol security.
This risk must be mitigated with organizational measures where it is clear which certificates are considered valid on the network.
Direct validation of certificates
Direct Validation of SSL/TLS Certificates (DVCert) is a mechanism that allows the validation of certificates directly between the client and the server without depending on third parties.
DVCert uses the existence of a shared secret between the user and the web application to directly validate the server’s certificates
Protocol description
Step 1
First, the browser establishes an SSL/TLS connection with the web application and executes a DVCert transaction based on the user’s password and a modification of the PAKE protocol.
In this transaction, the browser authenticates the web application and receives its most recent certificate information. The certificate information is shared using a Domain Certificate List “Domain Certificate List” (DLC), which is a data structure maintained by the web application that contains the “fingerprints” of all the certificates that can be used during the session.
Step 2
The browser temporarily stores the DCLs and uses them to validate the certificates for each SSL/TLS connection including the SSL/TLS channel established in step 1.
If the certificates are not in the DCL then the corresponding SSL/TLS connection is considered false and may be due to a Man In The Middle Attack.
When the DCL expires, a new DCL transaction is executed (like in step 1) to update the DCL.
Advantages of DVCert
Only the client and the server intervene in the certificate validation process.
The client should not trust the third entity to affirm that a certificate is valid since it is defined on the server itself.
The list of valid certificates is only temporarily stored on the client’s PC while the connection is being made. So, it is difficult for a third person with access to the PC to add another certificate to the list of trusted certificates of the browser.
Disadvantages of DVCert
It is not implemented in most browsers, so it is necessary to make modifications in most of the current clients and servers to use it.
The client must trust the server for the validation of the certificates. If the server is not trusted, this can be a problem since there is no third-party trusted entity to guarantee the validity of the digital certificate.
Differences between the trust relationships of the methods of digital certificates validation
The use of Certifying Authorities (CA) is the most widely used method nowadays.
Generally, the CAs are created and managed through a Public Key Infrastructure (PKI) that is responsible for accrediting the CAs at an international level. This breaks down the authorities, to the level of the CAs that respond directly to the users that are connected to a network. This system is based on the trust that exists between the user, their CA and the PKI system that is implemented.
When using the DVCert method, the validation is carried out directly between the two ends of the connection, without the intervention of a third party. This is a less used method than the described above. Therefore, there are fewer implementations of this system since it is necessary to make modifications in the key exchange process of the cryptographic protocol that is being used. This system is based on the trust between the user and the server.
The local certificate repository method leaves the responsibility of accepting a certificate or not to the user.
The user must have a list of valid certificates to decide if the digital certificate is trusted or not. This system is based on the trust that exists between the user and the certificate that is being presented to make the connection.
Recommendations for digital certificates validation approaches
After the description of the different methods and the comparisons among them, several recommendations can be made.
The easiest method to implement is the local repository validation method. But it is the riskiest, so it should only be used if the user is fully aware of what certificates to accept.
This method is recommended in the case of a small network with few own services and users. In this case, it would only be necessary to add the digital certificate of the service to the browsers of the internal network users.
The validation method through a PKI is the most complex to implement and deploy, as it requires establishing authorities that validate the certificates.
Commonly, international certification authorities fulfil this function and provide the service. So, the complexity of the deployment is passed down to that authority.
This method is recommended in large networks with several services. Especially, if it is connected to the internet. For the validation of the certificates, you can use a free or paid CA.
The DVCert method is not widely used. Therefore, it may be difficult to find compatible software. To use it, you must have full trust in the server.
As valid certificates are stored on the server, this method is recommended in cases where an attacker can tamper the PC used for the connection without the user authorization. Also, if the network is disconnected from the internet and you do not want to leave the validation of the certificates in the hands of a third-party entity.
Related Posts:
What is a digital certificate?
General concepts to study Cryptography
Information security system: a resemblance with other security systems
