A Zero Trust Data-Driven Perspective on PKI Root Stores

Presentazione per la prelaurea del Corso di Laurea Magistrale in Ingegneria Elettronica e Informatica dell'Università degli Studi di Trieste

1. A Zero Trust Data-Driven
Perspective on PKI Root Stores
Supervisor
Prof. Alberto Bartoli

Co-supervisor
Prof. Martino Trevisan
Candidate
Mauro Farina

2. Introduction

3. PKI | Public Key Infrastructure
Cryptographic system supporting most private and secure
communications on the Internet
Allows clients to authenticate servers using digital certificates
The organizations that issue server certificates are known as
certification authorities (CAs)
Subject
Public Key
Issuer (CA)
Signature

4. Root Stores
Set of self-signed CA certificates (root certificates)
A device only accepts server certificates signed by a root certificate
Operating systems are shipped with predefined root stores
Most browsers use their own root stores

5. Zero Trust
Cybersecurity paradigm for driving authentication and authorization in
environments viewed as compromised
Inherent network-based trust is removed
Trust is never granted implicitly but must be continually evaluated
Increasing adoption by industry and regulators

6. Motivation
PKI principles collide with Zero Trust paradigm
●Tens of CAs fully trusted a priori for authentication decisions
Proposed changes to EU regulations (eIDAS 2.0)
●Force browsers to add any CA selected by EU governments to their root
store

7. Current Root Store Landscape

8. Trust Perimeter Parameters
Trust perimeter of five popular root stores in terms of:
●Included root certificates
●Organizations that manage root certificates
○Government-affiliated organizations
●Countries of origin of such organizations

9. Current Root Stores Landscape
Main root store characteristics.

10. Dataset

11. HTTP Traffic
Data-driven research relies on a dataset of:
●≈292 million HTTP transactions
●232 users over 4 months

Previous works relied on:
●Browser chronologies (only 22 users)
●IP scans → complementary to real-traffic, but lack intrinsic order among
addresses

12. Observed Portion of Mozilla’s Store
Distribution of the number of observed root
certificates and organizations across users.
Mozilla root store:
●147 root certificates
●52 organizations
Median observed values:
●26 root certificates
●11 organizations

13. Root Store Construction Policies

14. Proposed Framework
IT staff manages employees’ root stores from a zero trust perspective
We define and analyze several Root Store Construction Policies based on users
traffic
We assess the discrepancy between the users’ actual needs and the perimeter
of trust established by the Mozilla root store

15. Policy Design
Specificity (how the root store differs among users)
●Uniform → All users share the same root store
Composition (which root certificates to include)
●All → All the observed root certificates
●Most(k) → The k root certificates useful to most websites

16. All Policy
Observed by our users:
●59 root certificates
●30 organizations
○2 governments
●18 countries
Mozilla root store:
●147 root certificates
●52 organizations
○5 governments
●23 countries
Includes only the root certificates observed by the users

17. Most(k) Policy
The k root certificates that are issuers for the most websites
Analysis of coverage vs. trust perimeter trade-off across users
●Coverage → Percentage of visited domains whose certificate is valid

18. Most(k) Policy
Distribution over users of the coverage.

19. Most(k) | Organizations and countries
Root certificates belonging to the same organization will likely follow similar
operational practices
Organizations are tied to the legislature of the country they operate from
Two variants based on organization- and country-wise trust:
●Most
ORG
(k)
●Most
COUNTRY
(k)

20. Most(k) | Organizations and countries
Distribution over users of the
coverage granted by Most
ORG
(k)
Distribution over users of the
coverage granted by Most
COUNTRY
(k)

21. Zero Trust Root Store Management
Simulated scenario where the IT department of a company manages a root
store with a zero trust perspective
1.All users start with an empty root store
2.IT staff takes trust decisions upon users observing a new root certificate

22. Zero Trust Root Store Management
Root store size and number of trust decisions with the
UniformAll policy.

23. Conclusions

24. Trust Perimeters Comparison
Comparison of commercial root stores (black dots) with proposed policies

25. Conclusions
Currently employed root stores are widely oversized
Real user-generated traffic demonstrates that the trust perimeter of root
stores can be reduced by ≈65%
A zero trust approach to root store management is feasible with little effort

26. Thank you for the attention!