We present F-PKI, an enhancement to the HTTPS public-key infrastructure (or web PKI) that gives trust flexibility to both clients and domain owners, and enables certification authorities (CAs) to enforce stronger security measures. In today's web PKI, all CAs are equally trusted, and security is defined by the weakest link. We address this problem by introducing trust flexibility in two dimensions: with F-PKI, each domain owner can define a domain policy (specifying, for example, which CAs are authorized to issue certificates for their domain name) and each client can set or choose a validation policy based on trust levels. F-PKI thus supports a property that is sorely needed in today's Internet: trust heterogeneity. Different parties can express different trust preferences while still being able to verify all certificates. In contrast, today's web PKI only allows clients to fully distrust suspicious/misbehaving CAs, which is likely to cause collateral damage in the form of legitimate certificates being rejected. Our contribution is to present a system that is backward compatible, provides sensible security properties to both clients and domain owners, ensures the verifiability of all certificates, and prevents downgrade attacks. Furthermore, F-PKI provides a ground for innovation, as it gives CAs an incentive to deploy new security measures to attract more customers, without having these measures undercut by vulnerable CAs.
Evaluating Certificate Policy - Certification Practice Statement of Unique Government Certification Authority using Public Key Infrastructure Assessment Guidelines: Research in Progress
OSD PSE是印度尼西亚政府认证机构（CA），用于国家电子采购系统，后来被命名为OSD PSE G2。它在OSD Lemsaneg下具有独特的层次结构。OSD PSE G2作为颁发CA，发布并保证证书政策和认证实践声明（CP-CPS）的质量，以获得PKI用户的信任。本文分析了OSD PSE G2发布的CP-CPS 1.0版本。为此，我们采用PKI评估指南（PAG）的方法。本CP-CPS的质量评估，包括其对相关参考/标准的符合性，即：CP OSD Lemsaneg v.1.1; RFC 3647;以及CA关于信任服务原则和认证机构标准的商业惯例披露原则（BPDP-TSPCCA）版本2.0。我们最终发现CP-CPS 1.0版不符合相关标准和参考。因此，CP-CPS需要根据OSD PSE G2的当前条件进行更新。
Beyond the Hype: On Using Blockchains in Trust Management for Authentication
用于身份验证的信任管理（TM）系统对于在线交互的安全性至关重要，在线交互在我们的日常生活中无处不在。各种系统，如Web PKI（X.509）和PGP的Web of Trust用于管理此设置中的信任。近年来，区块链技术已被引入作为我们的安全问题的灵丹妙药，包括身份验证，没有足够的理由，至于其优点。在这项工作中，我们调查使用开放分布式账本（ODL）的优点，如区块链技术实现的，用于保护TM系统的身份验证。我们正式建模这样的系统，并探索区块链如何帮助减轻对它们的攻击。经过正式的论证，我们得出结论，在身份验证的信任管理背景下，区块链技术和一般的ODL与以前的方法相比可以提供相当大的优势。据我们所知，我们的分析是第一个基于区块链技术正式建模和讨论TM认证系统安全性的分析。为了实现这一结果，我们首先提供了一个抽象的模型TM系统的身份验证。然后，我们展示了如何将这个模型在概念上编码到区块链中，将其表达为一系列状态转换。作为下一步，我们研究了对TM系统的五种常见攻击，并提供证据证明基于区块链的解决方案可以通过减轻或完全否定此类攻击来有益于此类系统的安全性。
