Private Diffie/Helman Tokens [LWN.net]

Private Diffie/Helman Tokens

Posted Dec 5, 2024 22:34 UTC (Thu) by pitb0ss (subscriber, #137324)
In reply to: Private Diffie/Helman Tokens by eharris
Parent article: Let's Encrypt sets date for ending OCSP support

It has more to do with knowing that the DH token you are negotiating a short lived key with is at least somewhat "authentic". On the web through let's encrypt this is done through proving ownership (or at least control) over the domain, or server that the host name points to. Without that assurance you could just as easily use my DH token for Google's or your bank's. You should verify it's correctness at some level. The domain model isn't perfect but it's good enough.

to post comments

Private Diffie/Helman Tokens

Posted Dec 6, 2024 13:10 UTC (Fri) by epa (subscriber, #39769) [Link] (3 responses)

It does seem a bit circular. If my browser connects to foo.com then whoever is at the other end does control the foo.com domain in some sense (at least from my view of the network). So if the only thing proven by the certificate is "they control the domain", that's redundant. In practice Let's Encrypt requires that they controlled the domain at some point in the past, and so you can be reasonably sure the same person still controls it today. Indeed, you could argue for a *minimum* age of certificates, so that if an attacker took control of a domain and managed to get certificates, enough time would have passed for somebody (hopefully) to notice the attack.

Private Diffie/Helman Tokens

Posted Dec 6, 2024 13:16 UTC (Fri) by daroc (editor, #160859) [Link]

Let's Encrypt also checks that whoever requests a certificate appears to control the domain from multiple endpoints in different countries. So it is at least harder for an attacker to intercept all of Let's Encrypt's viewpoints than it is to intercept your single viewpoint.

Private Diffie/Helman Tokens

Posted Dec 6, 2024 13:18 UTC (Fri) by dskoll (subscriber, #1630) [Link]

... at least from my view of the network

I think that's the key attack that SSL certificates are supposed to prevent. LetsEncrypt goes to some lengths to avoid being misled when it verifies domain ownership. While not perfect, the measures make it a bit harder for attackers to use DNS or BGP spoofing attacks against LetsEncrypt.

Private Diffie/Helman Tokens

Posted Dec 9, 2024 2:18 UTC (Mon) by azumanga (subscriber, #90158) [Link]

It's a lot easier for me to "take control" of the wifi hotspot in a coffee shop you are sat in, and pretend to be foo.com, than it is to trick Let's Encrypt, which tries connecting from multiple networks across the internet.