描述证书透明性的根景观
Characterizing the Root Landscape of Certificate Transparency Logs
摘要：
Internet安全和隐私依赖于证书颁发机构（CA）签署的公共证书的可信性。然而，软件产品不信任相同的CA，因此维护不同的根存储，每个根存储通常包含数百个能够为任何域颁发“可信”证书的可信根。证书被误发的事件促使Google实施和执行证书透明（CT）。CT日志以公开、可审计和仅附加的方式归档证书。CT的采用改变了信任格局。作为此更改的一部分，CT日志开始维护自己的根列表和链接到受信任根之一的日志证书。在本文中，我们提出了这个新兴的CT根存储景观的第一个特征，以及我们开发的数据汇集，可视化和分析的根存储的工具。我们比较了日志的根存储和量化他们的变化相对于彼此和主要软件供应商的根存储，看看不断变化的供应商CT政策，并表明根存储管理不善可能与日志不当行为。最后，我们提出并讨论了一项调查的结果，我们已经发送到日志运营商参与苹果公司和谷歌的CT日志程序。
英文摘要：
Internet security and privacy stand on the trustworthiness of public certificates signed by Certificate Authorities (CAs). However, software products do not trust the same CAs and therefore maintain different root stores, each typically containing hundreds of trusted roots capable of issuing "trusted" certificates for any domain. Incidents with misissued certificates motivated Google to implement and enforce Certificate Transparency (CT). CT logs archive certificates in a public, auditable and append-only manner. The adoption of CT changed the trust landscape. As a part of this change, CT logs started to maintain their own root lists and log certificates that chain back to one of the trusted roots. In this paper, we present the first characterization of this emerging CT root store landscape, as well as the tool that we developed for data collection, visualization, and analysis of the root stores. We compare the logs' root stores and quantify their changes with respect to both each other and the root stores of major software vendors, look at evolving vendor CT policies, and show that root store mismanagement may be linked to log misbehavior. Finally, we present and discuss the results of a survey that we have sent to the log operators participating in Apple's and Google's CT log programs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
