Papers for

browser developers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Certificate transparency improves trust by enabling accountability

Accountability in Certificate Transparency and Variants

Abstract: Certificate Transparency (CT) aims to reduce the trust required in Certificate Authorities (CAs) within the TLS certificate ecosystem. It is supported by all major browsers. The protocol obliges all CAs to record the certificates they issue in a public log, which itself is monitored for compliance and consistency by third parties. Given this complex set of checks between the four roles-CA, loggers, monitor but also the end user's client-it is very hard to provide a precise account of how CT eliminates trust assumptions in exchange for complex infrastructure. Analyses both in the Dolev-Yao paradigm and the computational paradigm only regard a very simplified model and feature definitions adapted specifically to CAs, essentially capturing design features rather than the target property. The present paper posits accountability as the main goal of CT and presents a thorough analysis in the Dolev-Yao model. We start with the vanilla PKI and, step by step, move to CT, finally analyzing proposed extensions for SCT Auditing and Gossiping. We show that plain CT relies on an honest log, but provides accountability under this assumption. Furthermore, we show that the SCT Auditing extension can eliminate this assumption, while the Gossiping extension cannot.

Thu 10 SeptCryptography and Security
The gist
The problem is that many people have to trust certificate authorities (CAs) to keep internet communication secure, but this trust can be risky. The authors explain how Certificate Transparency (CT) sets up public logs of certificates to catch bad behavior and enforce accountability. They analyze how different CT designs depend on trusting honest logs and show that adding SCT Auditing can remove that need. However, other methods like Gossiping don't fully solve the trust issue.
Open 2609.11552v1