Douglas Stebila
Associative blockchain for decentralized PKI transparency
Abstract
The conventional public key infrastructure (PKI) model, which powers most of the Internet, suffers from an excess of trust into certificate authorities (CAs), compounded by a lack of transparency which makes it vulnerable to hard-to-detect targeted stealth impersonation attacks. Existing approaches to make certificate issuance more transparent, including ones based on blockchains, are still somewhat centralized. We present decentralized PKI transparency (DPKIT): a decentralized client-based approach to enforcing transparency in certificate issuance and revocation while eliminating single points of failure. DPKIT efficiently leverages an existing blockchain to realize an append-only, distributed associative array, which allows anyone (or their browser) to audit and update the history of all publicly issued certificates and revocations for any domain. Our technical contributions include definitions for append-only associative ledgers, a security model for certificate transparency, and a formal analysis of our DPKIT construction with respect to the same. Intended as a client-side browser extension, DPKIT will be effective at fraud detection and prosecution, even under fledgling user adoption, and with better coverage and privacy than federated observatories, such as Google’s or the Electronic Frontier Foundation’s.
Keywords: certificate transparency, blockchain, digital certificates
Reference
Xavier Boyen, Udyani Herath, Matthew McKague, Douglas Stebila. Associative blockchain for decentralized PKI transparency. Cryptography, 5(2):14. MDPI, May 2021. © The authors.
Download
BibTeX
Funding
This research was supported by:- X.B. acknowledges support as a Future Fellow from the Australian Research Council, grant number FT140101145. The APC was funded by X.B.’s ARC Future Fellowship grant FT140101145