Subject: [Trans] pretty URIs whose integrity is associated to transparent certificates

From: Eduardo Robles Elvira <[email-masked]>
Date: Sun, 21 Sep 2014 13:36:29 +0200

Hi everyone,

I will start right away recognizing that I'm not an expert in this
field, and that I might be proposing something dumb because it's
already being taken care of in some new promising standard I don't
know of, that resolves the issue in a much better way. Or it might
well happen that this is not the correct mailing list (maybe it's more
related to X509 extensions, or maybe public-webappsec mailing-list? I
just thought that it might be of interest to discuss it here). Please,
forgive me if that's case, as I'm new here.

Investigating, I recently found out that rfc6920 [1] ("Naming Things
with Hashes") defines a scheme for naming URIs with hashes too, by
creating the ni URI scheme name for .well-known URIs (rfc5785) [2].
That allows to have URIs that define incontestably the data they point
to. In my opinion, that's a very powerful and important concept,
security-wise.

A problem with ni .well-known URIs is that they look like this:

   https://agoravoting.org/.well-known/ni/sha256/UyaQV-Ev4rdLoHyJJWCi11OHfrYv9E1aGQAlMO2X_-Q

That's not very user friendly, and reduces the scope of where this
kind of secure URIs can be used. Hopefully, we can find a reasonable
and secure way to solve that problem. That's the aim of this thread.
The idea is to convert that link into something like the following,
without loosing much security:

    https://agoravoting.org/user-friendly

Thinking about it, I thought about Certificate Transparency. As you
know, CT logs publicly and transparently the X509 certificates
associated to web domains. And X509 has an "Extensions" field, so this
gets interesting. A first approach proposal, which might well end up
not being the best one, is the possibility of creating a new X509
extension that refers to the hash of a file that contains the list
URIs and their integrity meta-data. For example, the file might
contain a line like this:

<alias uri="https://agoravoting.org/user-friendly"
integrity-metadata="ni:///sha-256;UyaQV-Ev4rdLoHyJJWCi11OHfrYv9E1aGQAlMO2X_-Q"
/>

And the X509 certificate could contain something like [3]:

  Extensions:
    Identifier: Named Information URIs aliases x.x.x.x
      Critical: No
      Aliases integrity:
ni:///sha-256;f4OxZX_x_FO5LcGBSKHWXfwtSx-j1ncoSt3SABJtkGk

Some thoughts about this solution:
* This proposal is actually not directly related to CT, but using CT
together the proposal would give it a reasonable level of security,
that's why I comment it here. Also, I comment it here because others
might also try to use certificates extensions/meta-data to take
advantage of the security features of CT. Maybe this has been
discussed already before?
* It's obviously not as secure as inserting the resource's hash in the
URI, but it provides an interesting mix of security and usability.
* Provides graceful degradation: if your web browser (or any software
accessing an URI) does not support this X509 extension, it will just
not check the integrity of the resource, but otherwise the URI will
work just fine.
* Integrate well with current Internet security architecture (CAs and such).

It has some drawbacks too, though:
* when registering the certificate you need to have the pre-generated
all the aliased URIs. And if you want to modify the aliases file, you
need a new certificate. Well, if you want this level of security and
usability with current Internet infrastructure, this could be the
price of it.
* Both browser vendors and CAs would have to add some kind of support
for this X509 extension for this to work well.

All in all, as I said I just wanted to open the debate with a
proposal. Any thoughts?

Regards,
--
[1] http://tools.ietf.org/html/rfc6920
[2] http://tools.ietf.org/html/rfc5785
[3] I haven't added information as to where to find the integrity file
and only its integrity metadata because I think that a good way to
solve this is to find the file with its well-known ni URI, but anyway
that's an implementation detail.
-- 
Eduardo Robles Elvira     @edulix             skype: edulix2
http://agoravoting.org       @agoravoting     +34 634 571 634