This research was originally performed by researchers from iSec Partners (now NCC Group), and has been migrated to research.nccgroup.com for posterity, and can be downloaded below.
CA Alternative Whitepapers
11 Feb 2015 – Braden Hollembaek
Academic co-authors Adam Bates, Joe Pletcher, Tyler Nichols, Dave Tian and iSEC engineer Braden Hollembaek had a pair of interesting papers published at the 2014 Conference on Computer and Communications Security and the 2014 Internet Measurement Conference, respectively.
In “Securing SSL Certificate Verification through Dynamic Linking”, the paper introduces CertShim, a lightweight retrofit to existing SSL/TLS implementations that provides new mechanisms to address: vulnerabilities in legacy software, improper usage of existing libraries, and the swift bootstrapping of new enhancements. This is accomplished by dynamically hooking calls to the certificate validation entry points in the OpenSSL, PolarSSL, and GnuTLS libraries via an LD_PRELOAD shim. The paper also demonstrates CertShim’s extensibility by adapting it to work with Convergence, DANE, and Client-Based Key Pinning. CertShim imposes only a modest 20ms overhead for an SSL verification call and, by coarse estimate, hooks the SSL dependencies of 94% of Ubuntu’s most popular packages with no changes necessary to existing applications. This work creates a framework to help increase the system-wide security of SSL communications in non-browser software, while simultaneously reducing the barriers to evaluating and adopting alternative proposals to the certificate authority system.
For context leading into the second paper, it should be pointed out that in 2011 Moxie Marlinspike proposed a CA alternative, Convergence, that extends the Network Perspectives system of multi-path probing to perform certificate verification. Unfortunately, adoption of Convergence and other SSL/TLS trust enhancements has been slow.
Some adoption concerns are addressed in “Forced Perspectives: Evaluating an SSL Trust Enhancement at Scale”, where the question is asked “What if all certificates were validated with Convergence?” In this paper, a case study of deploying Convergence under realistic workloads with a university-wide trace of real-world HTTPS activity is performed. By synthesizing Convergence requests, it is possible to effectively simulate perspectives-based verification on an entire university. The paper demonstrates that, through local and server caching, a single Convergence deployment can meet the requirements of millions of SSL flows while imposing under 0.1% network overhead and requiring as little as 108ms to validate a certificate, making Convergence a worthwhile candidate for further deployment and adoption.
Links to the papers and source code can be found here:
CertShim Paper: certshim_ccs14.pdf
Source code for CertShim: https://bitbucket.org/uf_sensei/cert-shim
Please keep in mind that CertShim is part of an ongoing research project that relies on unstable function hooks into version-dependent libraries, and as such, should not be used as a production security resource.
Forced Perspectives Paper: forced_perspectives_imc14.pdf
