Certificate Validation Process Research Articles

On the Validation of Web X.509 Certificates by TLS Interception Products

The Transport Layer Security (TLS) protocol aims to provide confidentiality and integrity of data. It is based on X.509 Certificates. Our previous research showed that popular Web Browsers exhibit non-standardized behaviour with respect to the certificate validation process <xref ref-type="bibr" rid="ref1">[1]</xref> . This article extends that work by examining their handling of OCSP Stapling. We also examine several popular HTTPS interception products, including proxies and anti-virus tools, regarding their certificate validation processes. We analyse and compare their behaviour to that described in the relative standards.

CertLedger: A new PKI model with Certificate Transparency based on blockchain

In conventional PKI, CAs are assumed to be fully trusted. However, in practice, CAs’ absolute responsibility for providing trustworthiness caused major security and privacy issues. To prevent such issues, Google introduced the concept of Certificate Transparency (CT) in 2013. Later, several new PKI models are proposed to reduce the level of trust to the CAs. However, all of these proposals are still vulnerable to split-world attacks if the adversary is capable of showing different views of the log to the targeted victims. In this paper, we propose a new PKI architecture with certificate transparency based on blockchain, what we called CertLedger, to eliminate the split-world attacks and to provide certificate/revocation transparency. All TLS certificates’ validation, storage, and entire revocation process is conducted in CertLedger as well as Trusted CA certificate management. During a TLS connection, TLS clients get an efficient proof of existence of the certificate directly from its domain owners. Hence, privacy is now perfectly preserved by eliminating the traceability issue via OCSP servers. It also provides a unique, efficient, and trustworthy certificate validation process eliminating the conventional inadequate and incompatible certificate validation processes implemented by different software vendors. TLS clients in CertLedger also do not require to make certificate validation and store the trusted CA certificates anymore. We analyze the security and performance of CertLedger and provide a comparison with the previous proposals. Finally, we implement its protoype on Ethereum to demonstrate experimental results. The results show that the performance of the TLS handshake and certificate validation through CertLedger is significantly improved compared to the current TLS protocol.

RiskLaine: A Probabilistic Approach for Assessing Risk in Certificate-Based Security

Digital certificates, based on X.509 PKI standard, are located at the core of many security mechanisms implemented in services and applications. However, the usage of certificates has revealed flaws in the certificate validation process (e.g., possibility of unavailable or non-updated data). This fact implies security risks that are not assessed. In order to address these issues that such flaws entail, we propose a novel probabilistic approach for quantitative risk assessment in X.509 PKI, together with trust management when there is uncertainty. We have evaluated our risk assessment approach and demonstrated its usage, considering as a use case the secure installation of mobile applications. The results show that our approach provides more granularity, appropriate values according to the impact, and relevant information in the risk calculation than other approaches.

Enhanced ID-Based Ring Signature by Validating Time Slots in Cloud Environment

Sharing of Information has a number of problems, comprising integrity, information efficiency and safekeeping of data owner in cloud computing. Ring Signature methods are favorable choice to build an unidentified and authentic information sharing system. Ring have no managers, no setup systems, no denial systems, and no coordination: some person can pick any set of members that take account of himself, and sign message by making use of his secret key and the others' public keys, without getting their approval. By using Ring signatures we can leak top-secret information in an anonymous way. In the proposed Id-based ring signature the certificate validation process has been removed which is more cost effective. In this project we improved security in ring by implementing time slots i.e. if a super key of any user has lost then there is no need to change all the users’ keys including the lost key user. Security re-confirmation is avoided in ring Signature by using SHA Algorithm .We have also expanded the level of security in diminished time, easy and effective manner.

Markov chain-based evaluation of the certificate status validations in hybrid MANETs

Mobile ad hoc networks (MANETs) are vulnerable to various security attacks conducted by the malicious nodes and attackers. To defend against the attackers, their public key certificates should be revoked by certificate authority. Thus, each MANET node before conducting any secure communications, should check the status of communicating parties’ certificates. Inconsistency of the certificate status information is one of the critical problems which reduce the correctness and effectiveness of the whole certificate validation process. In this paper, we conduct a Markov-chain based analysis and evaluation of the OCSP-based certificate validations in the hybrid MANETs. In particular, we focus on the ADOPT and PS-ADOPT protocols and present four absorbing Markov-chain models, three for online states whose OCSP responder is available to the MANET and the other to support offline cases where MANET may be disconnected from the OCSP responder occasionally. Finally, the results of absorbing Markov models are verified by the extensive simulations of the ADOPT and PS-ADOPT protocols in the OMNeT++ simulator.

온라인게임을 위한 무 정지 업데이트 기법의 연구

Online games are virtual space where it connects individual users through network connection to offer enjoyment of play games and game developer who service online games have to develop new contents and provide them to users to extend life of their service. Typically, in order to update new contents, all service companies have maintenance schedule to stop the game service for a while to update both server and client applications. Usually this process takes quite amount of time and users do not have any other choice but disconnected from server and wait until it is over. The purpose of this thesis is to describe the advantages of new design system which will allows users to continue to play the game even during the update. The main focus of this design is to make users feel more convenience in online gaming experience by move client from previous server to new server while users are still playing. If they can to connect current client with new server without any certificate validation process while users information from the client can automatically pass through to the new server, users may not need to experience maintenance for new contents update.

Analysis of the current state in website certificate validation

ABSTRACTThis paper presents an in‐depth analysis of the certificate validation process employed in current web browsers. It discusses the shortcomings especially arising from the inappropriate management of the certificate status. Various improvements proposed so far are presented and analyzed with the aid of a threat model. The results are further enriched by some empirical studies. Finally, the outcomes of the aforementioned analysis are used to sketch an extended website certificate validation process with the aim of allowing for a better protection. Copyright © 2013 John Wiley &amp; Sons, Ltd.

Gaining competent authority validation for design certificate: can both working arrangements and processes be improved to reduce regulatory burden and facilitate ongoing transports?

AbstractCompetent authorities worldwide have the power to issue an extension to an existing package design certificate with the process appropriately termed timely renewal in the USA. An extension or timely renewal allows competent authorities sufficient time to challenge and review the safety of the package design, applicants to respond to questions raised and user’s to continue to use the package. However, when requests are made to validate a design certificate of foreign origin, no similar processes or conventions exist, giving little flexibility to competent authorities. Several issues arose during recent European validation applications that had the potential to delay validation issue. If any significant delay had occurred, it had the potential to adversely impact transports. The present paper aims to encourage discussion surrounding the certificate validation process legal framework and promote the development of working practices and processes that readily support the safe, efficient and effective ...

Cryptanalysis of LHL-key authentication scheme

It is proved that the LHL-key authentication scheme, proposed by Lee, Hwang and Li [Appl. Math. Comput. 139 (2003) 343], is insecure. The user's private key can be obtained easily from the user's public key certificate, hence compromising all the enciphered communications. In addition, the certificate validation process proposed in the same work is not a suitable one, as any certificate (valid or not) satisfies the verification equation. A slight modification is pointed out to overcome this severe weakness.