the road to encrypting all the things...jul 05, 2016 · then let’s encrypt is no longer trusted....
TRANSCRIPT
![Page 1: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/1.jpg)
The Road to Encrypting All The Things
J.C. Jones, Mozilla @JamesPugJones
![Page 2: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/2.jpg)
1995, Netscape released HTTPS
Historic Reflection
![Page 3: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/3.jpg)
20 Years Later Firefox 42 (Nov 2015)
HTTP 59.99%
HTTPS 40.01%
Protocol for initial page load
Not enough HTTPS on the Internet • ~40% of initial page loads • ~65% of all subsequent requests
Data: telemetry.mozilla.org
![Page 4: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/4.jpg)
Then Let’s Encrypt launched…
![Page 5: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/5.jpg)
8 Months Later… Firefox 47 (June 2016)
HTTP 51.66%
HTTPS 48.34%
Protocol for initial page load
On a path to HTTPS EverywhereData: telemetry.mozilla.org
+8% in 7 Months
![Page 6: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/6.jpg)
Creating a New Certificate Authority
![Page 7: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/7.jpg)
Threat Model
Risk: If someone issues a bad certificate, then Let’s Encrypt is no longer trusted. Close the doors, it’s over.
![Page 8: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/8.jpg)
Trust from the Web PKI is binary
Becoming Trusted
Before Cross-Signature
0%
25%
50%
75%
100%
Trust
0
Trust
![Page 9: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/9.jpg)
Trust from the Web PKI is binary
Becoming Trusted
After Cross-Signature
0%
25%
50%
75%
100%
Trust
1
Trust
![Page 10: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/10.jpg)
Threat Model
Risk: If someone issues a bad certificate, then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Threats: Insiders. Datacenter staff. Hardware couriers. Network and Protocol. Laptops.
![Page 11: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/11.jpg)
Unexpected Challenges
![Page 12: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/12.jpg)
Datacenter: IPv6, power, space…
![Page 13: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/13.jpg)
Physical security critical
Picking a Datacenter
![Page 14: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/14.jpg)
“Perpetual storage,”
![Page 15: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/15.jpg)
“Perpetual storage,”
by which we meanmagnetic tape.
![Page 16: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/16.jpg)
Resolving DNS is really difficult.
![Page 17: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/17.jpg)
Resolving DNS is really difficult.like, for real.
![Page 18: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/18.jpg)
Security tape. Security bags.
![Page 19: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/19.jpg)
Security tape. Security bags.
![Page 20: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/20.jpg)
Moving a keyed hardware security module (HSM).
![Page 21: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/21.jpg)
Last Resort:
![Page 22: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/22.jpg)
#1 Lesson
![Page 23: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/23.jpg)
Remember your threat model.
![Page 24: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/24.jpg)
Timeline
May 2013 Formed ISRG
June 2013 First Snowden disclosures
November 2014 Announced
November 2015 Public Beta
2012 Fundraising starts
![Page 25: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/25.jpg)
Questions?• Datacenters? • Server Architecture? • Traffic Model / Modeling? • Threat Models • Governance / Policy
… and others!
J.C. Jones @JamesPugJones [email protected]
![Page 26: The Road to Encrypting All The Things...Jul 05, 2016 · then Let’s Encrypt is no longer trusted. Close the doors, it’s over. Trust from the Web PKI is binary Becoming Trusted](https://reader033.vdocuments.mx/reader033/viewer/2022060306/5f09af747e708231d4280627/html5/thumbnails/26.jpg)