Blind certificate authorities

Liang Wang; Gilad Asharov; Rafael Pass; Thomas Ristenpart; Abhi Shelat

doi:https://doi.org/10.1109/sp.2019.00007

Blind certificate authorities

Liang Wang, Gilad Asharov, Rafael Pass, Thomas Ristenpart, Abhi Shelat

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

We explore how to build a blind certificate authority (CA). Unlike conventional CAs, which learn the exact identity of those registering a public key, a blind CA can simultaneously validate an identity and provide a certificate binding a public key to it, without ever learning the identity. Blind CAs would therefore allow bootstrapping truly anonymous systems in which no party ever learns who participates. In this work we focus on constructing blind CAs that can bind an email address to a public key. To do so, we first introduce secure channel injection (SCI) protocols. These allow one party (in our setting, the blind CA) to insert a private message into another party's encrypted communications. We construct an efficient SCI protocol for communications delivered over TLS, and use it to realize anonymous proofs of account ownership for SMTP servers. Combined with a zero-knowledge certificate signing protocol, we build the first blind CA that allows Alice to obtain a X.509 certificate binding her email address [email protected] to a public key of her choosing without ever revealing ''alice'' to the CA. We show experimentally that our system works with standard email server implementations as well as Gmail.

Original language	English
Title of host publication	Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1015-1032
Number of pages	18
ISBN (Electronic)	9781538666609
DOIs	https://doi.org/10.1109/sp.2019.00007
State	Published - May 2019
Externally published	Yes
Event	40th IEEE Symposium on Security and Privacy, SP 2019 - San Francisco, United States Duration: 19 May 2019 → 23 May 2019

Publication series

Name	Proceedings - IEEE Symposium on Security and Privacy
Volume	2019-May

Conference

Conference	40th IEEE Symposium on Security and Privacy, SP 2019
Country/Territory	United States
City	San Francisco
Period	19/05/19 → 23/05/19

Keywords

Anonymity
MPC
Privacy
Secure-Multiparty-Computation
TLS
Zero-knowledge-Proof

All Science Journal Classification (ASJC) codes

Safety, Risk, Reliability and Quality
Software
Computer Networks and Communications

Access to Document

https://doi.org/10.1109/sp.2019.00007

Cite this

@inproceedings{dabc933d422d4ee69a580f519c6ffdaf,

title = "Blind certificate authorities",

abstract = "We explore how to build a blind certificate authority (CA). Unlike conventional CAs, which learn the exact identity of those registering a public key, a blind CA can simultaneously validate an identity and provide a certificate binding a public key to it, without ever learning the identity. Blind CAs would therefore allow bootstrapping truly anonymous systems in which no party ever learns who participates. In this work we focus on constructing blind CAs that can bind an email address to a public key. To do so, we first introduce secure channel injection (SCI) protocols. These allow one party (in our setting, the blind CA) to insert a private message into another party's encrypted communications. We construct an efficient SCI protocol for communications delivered over TLS, and use it to realize anonymous proofs of account ownership for SMTP servers. Combined with a zero-knowledge certificate signing protocol, we build the first blind CA that allows Alice to obtain a X.509 certificate binding her email address [email protected] to a public key of her choosing without ever revealing ''alice'' to the CA. We show experimentally that our system works with standard email server implementations as well as Gmail.",

keywords = "Anonymity, MPC, Privacy, Secure-Multiparty-Computation, TLS, Zero-knowledge-Proof",

author = "Liang Wang and Gilad Asharov and Rafael Pass and Thomas Ristenpart and Abhi Shelat",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 40th IEEE Symposium on Security and Privacy, SP 2019 ; Conference date: 19-05-2019 Through 23-05-2019",

year = "2019",

month = may,

doi = "https://doi.org/10.1109/sp.2019.00007",

language = "الإنجليزيّة",

series = "Proceedings - IEEE Symposium on Security and Privacy",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1015--1032",

booktitle = "Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019",

address = "الولايات المتّحدة",

}

Wang, L, Asharov, G , Pass, R, Ristenpart, T & Shelat, A 2019, Blind certificate authorities. in Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019., 8835242, Proceedings - IEEE Symposium on Security and Privacy, vol. 2019-May, Institute of Electrical and Electronics Engineers Inc., pp. 1015-1032, 40th IEEE Symposium on Security and Privacy, SP 2019, San Francisco, United States, 19/05/19. https://doi.org/10.1109/sp.2019.00007

Blind certificate authorities. / Wang, Liang; Asharov, Gilad ; Pass, Rafael et al.
Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019. Institute of Electrical and Electronics Engineers Inc., 2019. p. 1015-1032 8835242 (Proceedings - IEEE Symposium on Security and Privacy; Vol. 2019-May).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Blind certificate authorities

AU - Wang, Liang

AU - Asharov, Gilad

AU - Pass, Rafael

AU - Ristenpart, Thomas

AU - Shelat, Abhi

PY - 2019/5

Y1 - 2019/5

N2 - We explore how to build a blind certificate authority (CA). Unlike conventional CAs, which learn the exact identity of those registering a public key, a blind CA can simultaneously validate an identity and provide a certificate binding a public key to it, without ever learning the identity. Blind CAs would therefore allow bootstrapping truly anonymous systems in which no party ever learns who participates. In this work we focus on constructing blind CAs that can bind an email address to a public key. To do so, we first introduce secure channel injection (SCI) protocols. These allow one party (in our setting, the blind CA) to insert a private message into another party's encrypted communications. We construct an efficient SCI protocol for communications delivered over TLS, and use it to realize anonymous proofs of account ownership for SMTP servers. Combined with a zero-knowledge certificate signing protocol, we build the first blind CA that allows Alice to obtain a X.509 certificate binding her email address [email protected] to a public key of her choosing without ever revealing ''alice'' to the CA. We show experimentally that our system works with standard email server implementations as well as Gmail.

AB - We explore how to build a blind certificate authority (CA). Unlike conventional CAs, which learn the exact identity of those registering a public key, a blind CA can simultaneously validate an identity and provide a certificate binding a public key to it, without ever learning the identity. Blind CAs would therefore allow bootstrapping truly anonymous systems in which no party ever learns who participates. In this work we focus on constructing blind CAs that can bind an email address to a public key. To do so, we first introduce secure channel injection (SCI) protocols. These allow one party (in our setting, the blind CA) to insert a private message into another party's encrypted communications. We construct an efficient SCI protocol for communications delivered over TLS, and use it to realize anonymous proofs of account ownership for SMTP servers. Combined with a zero-knowledge certificate signing protocol, we build the first blind CA that allows Alice to obtain a X.509 certificate binding her email address [email protected] to a public key of her choosing without ever revealing ''alice'' to the CA. We show experimentally that our system works with standard email server implementations as well as Gmail.

KW - Anonymity

KW - MPC

KW - Privacy

KW - Secure-Multiparty-Computation

KW - TLS

KW - Zero-knowledge-Proof

UR - http://www.scopus.com/inward/record.url?scp=85068989167&partnerID=8YFLogxK

U2 - https://doi.org/10.1109/sp.2019.00007

DO - https://doi.org/10.1109/sp.2019.00007

M3 - منشور من مؤتمر

T3 - Proceedings - IEEE Symposium on Security and Privacy

SP - 1015

EP - 1032

BT - Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 40th IEEE Symposium on Security and Privacy, SP 2019

Y2 - 19 May 2019 through 23 May 2019

ER -

Blind certificate authorities

Abstract

Publication series

Conference

Keywords

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this