How Can I Trust an X.509 Certificate? an Analysis of the Existing Trust Approaches

Ahmad Samer Wazan (1) , Romain Laborde (1) , David W. Chadwick (2) , François Barrère (1) , Abdelmalek Benzekri (1, 3)

1 IRIT-SIERA - Service IntEgration and netwoRk Administration
2 University of Kent [Canterbury]
3 UT3 - Université Toulouse III - Paul Sabatier

A Public Key Infrastructure (PKI) is based on a trust model defined by the original X.509 standard and is composed of three entities: the Certification Authority, the certificate holder (subject) and the Relying Party. The CA plays the role of a trusted third party between the subject and the RP. A trust evaluation problem is raised when an RP receives a certificate from an unknown subject that is signed by an unknown CA. Different approaches have been proposed to handle this trust problem. We argue that these approaches work only in the closed deployment model where RPs are also subjects, but cannot work in the open deployment model where they are not. Our objective is to identify the deficiencies in the existing trust approaches that try to help RPs to make trust decisions about certificates in the Internet, and to introduce the new X.509 approach based on a trust broker.

Mots clés: Trust broker; Trust management; Certification authority; Public key infrastructure; X.509

Domaines: Réseaux et télécommunications [cs.NI]; Système d'exploitation [cs.OS]; Architectures Matérielles [cs.AR]; Systèmes embarqués

Ahmad Samer Wazan, Romain Laborde, David W. Chadwick, François Barrère, Abdelmalek Benzekri. How Can I Trust an X.509 Certificate? an Analysis of the Existing Trust Approaches. 41st IEEE Conference on Local Computer Networks (LCN 2016), Nov 2016, Dubai, United Arab Emirates. pp. 531-534. ⟨hal-01690136⟩