Embed Size (px)
Citation preview
The ICSI SSL Notary Lessons and Insights from a Large-Scale Study of the SSLTLS Ecosystem
Bernhard Amann1 Matthias Vallentin2 Robin Sommer13
International Computer Science Institute1
UC Berkeley2
Lawrence Berkeley National Laboratory3
ICSI SSL Notary
Monitor certificates in real-time
Strong research interest in SSL
Problem lack of data few measurements most of them active spanning a short time
Provide access to the community
Collection Setup
Sites running Bro network monitor add SSL data collection script SSL traffic identified using DPD
Result 2 log files uploaded to ICSI on rotation not kept on local machine
collection script distributed via Git
ICSI has no access to raw data
Internet Link
SSL Collection Script
Bro Server
Logfiles
Bro triggeredsftp upload
ICSI
running Bro network monitordd SSL data collection script
traffic identified using DPD
ult 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Collection Setup
Sites a SSL
Res upl no
coll
ICSI
ction
t Link
SI
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
Content length Server certificates
Connection history Server IP
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
running Bro network monitordd SSL data collection script
traffic identified using DPD
Result 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Co eng
on histor Server IP
Transpar
Collection Setup
Sites a SSL
upl no
coll
ICSI
ction
t Link
SI
w conceptually si tificatemilar to Cer
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
ntent l th Server certificates
Connecti y
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
Vieency
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
ICSI SSL Notary
Monitor certificates in real-time
Strong research interest in SSL
Problem lack of data few measurements most of them active spanning a short time
Provide access to the community
Collection Setup
Sites running Bro network monitor add SSL data collection script SSL traffic identified using DPD
Result 2 log files uploaded to ICSI on rotation not kept on local machine
collection script distributed via Git
ICSI has no access to raw data
Internet Link
SSL Collection Script
Bro Server
Logfiles
Bro triggeredsftp upload
ICSI
running Bro network monitordd SSL data collection script
traffic identified using DPD
ult 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Collection Setup
Sites a SSL
Res upl no
coll
ICSI
ction
t Link
SI
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
Content length Server certificates
Connection history Server IP
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
running Bro network monitordd SSL data collection script
traffic identified using DPD
Result 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Co eng
on histor Server IP
Transpar
Collection Setup
Sites a SSL
upl no
coll
ICSI
ction
t Link
SI
w conceptually si tificatemilar to Cer
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
ntent l th Server certificates
Connecti y
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
Vieency
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Collection Setup
Sites running Bro network monitor add SSL data collection script SSL traffic identified using DPD
Result 2 log files uploaded to ICSI on rotation not kept on local machine
collection script distributed via Git
ICSI has no access to raw data
Internet Link
SSL Collection Script
Bro Server
Logfiles
Bro triggeredsftp upload
ICSI
running Bro network monitordd SSL data collection script
traffic identified using DPD
ult 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Collection Setup
Sites a SSL
Res upl no
coll
ICSI
ction
t Link
SI
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
Content length Server certificates
Connection history Server IP
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
running Bro network monitordd SSL data collection script
traffic identified using DPD
Result 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Co eng
on histor Server IP
Transpar
Collection Setup
Sites a SSL
upl no
coll
ICSI
ction
t Link
SI
w conceptually si tificatemilar to Cer
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
ntent l th Server certificates
Connecti y
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
Vieency
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
running Bro network monitordd SSL data collection script
traffic identified using DPD
ult 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Collection Setup
Sites a SSL
Res upl no
coll
ICSI
ction
t Link
SI
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
Content length Server certificates
Connection history Server IP
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
running Bro network monitordd SSL data collection script
traffic identified using DPD
Result 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Co eng
on histor Server IP
Transpar
Collection Setup
Sites a SSL
upl no
coll
ICSI
ction
t Link
SI
w conceptually si tificatemilar to Cer
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
ntent l th Server certificates
Connecti y
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
Vieency
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
running Bro network monitordd SSL data collection script
traffic identified using DPD
Result 2 log filesoaded to ICSI on rotationt kept on local machine
ection script distributed via Git
has no access to raw data
SSL Colle Script
Logfiles
Interne
Bro Server
Bro triggered sftp upload
IC
Co eng
on histor Server IP
Transpar
Collection Setup
Sites a SSL
upl no
coll
ICSI
ction
t Link
SI
w conceptually si tificatemilar to Cer
Collected Features
Available ciphers Hash(server session ID)
Analyzer Error Packet loss
Client TLS extensions Selected cipher
ntent l th Server certificates
Connecti y
Duration Server Name Indication
Hash(client IP server IP) Ticket lifetime hint
Hash(client IP SNI) Timestamp
Hash(client session ID) Version
Vieency
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Notary Data Providers Certs Certs Duration Site Users Sessions Total Filtered (days)
University 1 90000 36M 631K 62G 339
University 2 50000 569K 292K 47G 280
University 3 3000 14K 88K 10M 142
University 4 30000 193K 121K 517M 126
University 5 100000 355K 195K 33G 118
University 6 10000 55K 40K 468M 99
Research Lab 1 250 443K 35K 72M 350
Research Lab 2 4000 171K 98K 747M 304
Gov Network 50000 137K 127K 228M 317
Backbone Net 30000 18K 18K 65M 107
Total (Unique) 314250 375M 842K 163G -
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Number of certificates
httpnotaryicsiberkelyedu
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Number of certificates
Active scan at contributing site
httpnotaryicsiberkelyedu
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Connections per Hour
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Server distribution
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Top connection Ciphers TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
0 10 20 Percent of connections
Top
ciph
ers Google TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Owner
Symantec
GoDaddy
Comodo
Symantec
GlobalSign
Comodo
DigiCert
Symantec
Symantec
Symantec
Certificate Issuers Root
19 GeoTrust
18 Go Daddy
12 AddTrust
10 VeriSign (1)
61 GlobalSign
50 USERTRUST
46 DigiCert
40 Thawte (1)
38 Thawte (2)
34 VeriSign (2)
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Certificate Issuers Root Owner
19 GeoTrust Symantec
18 Go Daddy GoDaddy
12 AddTrust Comodo
10 VeriSign (1) Symantec
61 GlobalSign GlobalSign
50 USERTRUST Comodo
46 DigiCert DigiCert
40 Thawte (1) Symantec
38 Thawte (2) Symantec
34 VeriSign (2) Symantec
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Certificate Issuers Root Owner Used Roots Owner
19 GeoTrust Symantec 42 13 Symantec
18 Go Daddy GoDaddy 20 3 GoDaddy
12 AddTrust Comodo 19 5 Comodo
10 VeriSign (1) Symantec 63 2 GlobalSign
61 GlobalSign GlobalSign 46 3 DigiCert
50 USERTRUST Comodo 31 3 Entrust
46 DigiCert DigiCert 15 1 StartCom
40 Thawte (1) Symantec 12 3 Verizon
38 Thawte (2) Symantec 087 2 Trustwave
34 VeriSign (2) Symantec 047 1 Telekom
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
6HUYHUamp$
amp$
OHUL
7amp666HUYHUamp$ 0LFURVHFH6]LJQR5RRWamp$
(QWUXVWampHUWLILFDWLRQ$XWKRULW( 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$7 LJLampHUWOREDOamp$
7ampQWHUQHW5RRWamp$ HOOV6HFXUH3XEOLF5RRWampHUWLILFDWH$XWKRULW HOOV6HFXUHampHUWLILFDWH$XWKRULW $GYDQFHGampODVVH6]LJQRamp$
ampRUSRUDWHamp$
XSDVVampODVVamp$ 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ6ampamp$7 LJLampHUWOREDO5RRWamp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9LUJLQLD7HFKOREDO6HUYHUamp$ (QWUXVW5RRWampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV([WHQGHG9DOLGDWLRQ666ampamp$ 7UXVWZDYH([WHQGHG9DOLGDWLRQamp$HYHO 6RXWKHUQampRPSDQ([WHUQDOVVXLQJamp$ OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ LJLampHUW+LJK$VVXUDQFH(9amp$ 7UXVWZDYH2UJDQL]DWLRQ9DOLGDWLRQamp$HYHO 9HUL6LJQampODVV([WHQGHG9DOLGDWLRQamp$7 6RXWKHUQampRPSDQ([WHUQDO3ROLFamp$ 1HWRFN8]OHWLampODVV7DQXVLWYDQNLDGR 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$7 R6LJQampODVV296HUYHUamp$
$OSKD66amp$ 7UXVWZDYHRPDLQ9DOLGDWLRQamp$HYHO
$77L)L6HUYLFHV5RRWampHUWLILFDWH$XWKRULW
(7XJUD(HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde LJLampHUW+LJK$VVXUDQFHamp$ 6HFXUH7UXVWamp$ $XVamp(576amp6HUYHUamp$ 7eth7$8($(paraN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 7UXVWZDYH2UJDQL]DWLRQVVXLQJamp$HYHO OREDO6LJQRPDLQ9DOLGDWLRQamp$ LHVHFNHDQGHYULHQWampRUSRUDWHamp$
OREDO6LJQ5RRW6LJQ3DUWQHUVamp$ (HE6XQXFX6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 67$amp(6amp$ )RUG0RWRUampRPSDQ(QWHUSULVHamp$ 0LFURVQWHUQDOamp$ R6LJQ6amp6HUYHU$XWKRULW LJLampHUW+LJK$VVXUDQFH(95RRWamp$ ((OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde 9LUJLQLD7HFKOREDO5RRWamp$ ampHUWLILFDWLRQ$XWKRULWRIR6LJQ
RR]$OOHQ+DPLOWRQamp$ DQGL6amp66amp$ HOJLXP5RRWamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ ampLKD]6HUWLILNDVntilde+L]PHW6DszligODntildeFntildeVntilde6frac14Ufrac14P 67$amp(6HYLFHamp$$ RYHUQPHQWamp$
)RUG0RWRUampRPSDQ(QWHUSULVHVVXLQJamp$ OREDO6LJQ5RRWamp$ 0LFURVamp$ ampHUWLJQD66356 OREDO6LJQ2UJDQL]DWLRQ9DOLGDWLRQamp$ $OSKDamp$ OREDO6LJQRPDLQ9DOLGDWLRQamp$ RYHUQPHQWamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 5DPSOREDOampHUWLILFDWLRQ$XWKRULW
$amp)LUPDSURIHVLRQDOamp$ OREDO6LJQ([WHQGHG9DOLGDWLRQamp$ R6LJQampODVV96HUYHUamp$ OREDO6LJQ 6758676ampamp(57)amp$721$87+257lt 6WDDWGHU1HGHUODQGHQ5RRWamp$ 7KDZWH6ampamp$ 6WDUWampRPampHUWLILFDWLRQ$XWKRULW
5($0+26766amp$ OREDO66RPDLQ9DOLGDWLRQ66amp$ 6WDUWampRPampODVVQWHUPHGLDWHamp$-DQ5DLQQF 5HJLVWHUFRPamp$666HUYLFHV9 9HUL6LJQampODVV6HFXUH6HUYHUamp$ HL]1HWZRUNVampHUWLILFDWH6HUYLFHV
$XWRULGDGGHampHUWLILFDFLRQ)LUPDSURIHVLRQDOamp)$ 6WDUWampRP([WHQGHG9DOLGDWLRQ6HUYHUamp$ HWURQLFV3LQN5RFFDGH3RYHUKHLGamp$2YHUKHLGHQHGULMYHQ ampHUWLJQD 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ 871$7$ampRUS6amp 3RVLWLYH66amp$ amp63666HUYLFHamp$ 78UHVGHQamp$ )+)amp$
+5HUOLQamp$ 6WDUWampRPampODVV3ULPDUQWHUPHGLDWH6HUYHUamp$ +HOPKROW]=HQWUXPIXHUQIHNWLRQVIRUVFKXQJ 6WDDWGHU1HGHUODQGHQ2YHUKHLGamp$
FHUW61(QWHUSULVHamp$ampODVV )+6)amp$ HE6SDFH)RUXP6HUYHUamp$ 5amp+amp+LJK$VVXUDQFH6HUYLFHVamp$
7(5(1$H6FLHQFH66amp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 9HUL6LJQampODVVQWHUQDWLRQDO6HUYHUamp$ ampDPHUILUPDampRUSRUDWH6HUYHU )DFKKRFKVFKXOH$DFKHQamp$ 9HUL6LJQQWHUQDWLRQDO6HUYHUamp$ampODVV 7KHampRGH3URMHFW3UHPLXP666HFXULWamp$ +==ZLFNDXamp$ 29+6HFXUHampHUWLILFDWLRQ$XWKRULW 5=amp$ 125$$(0(amp$
ampHUWLJQD66 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW
DQGL6WDQGDUG66amp$ 3UHPLXP66HQLH 8QLYHUVLWDHWLHVVHQ6amp$ 78RUWPXQGamp$ 5amp$ +RFKVFKXOHUHPHQamp$ ampKDPEHUVRIampRPPHUFH5RRW
)ODVK66HQLH 675867amp(57)amp$721$87+257lt 6HFXUHXVLQHVV6HUYLFHVamp$
FHUW615227amp$ 6amp$ +6=5amp$ 8QLXSSHUWDOamp$ 8QLYHUVLWDHW2OGHQEXUJ3 87186(5)LUVW+DUGZDUH 2UDFOH66amp$
+RFKVFKXOH0XHQFKHQamp$ 3DWHUVOHEHQamp$ 2SWLPXP66amp$ 580amp$=HUWLIL]LHUXQJVLQVWDQ] 5RRWamp$HQHUDOLWDW9DOHQFLDQD 78ampODXVWKDOamp$ 7KDZWH6HUYHUamp$ $XVamp(576HUYHUamp$ R6LJQ3UHPLXP6HUYHU$XWKRULW +60DJGHEXUJ6WHQGDO)+amp$ 3+)5amp$ HE6SDFH)RUXP(VVHQWLDOamp$ (XURSHDQ666HUYHUamp$ 6amp$ 5+5amp$
5HJLVWHUFRPamp$666HUYLFHV29 8QLYHUVLWDHW-HQDamp$ 6HHampHUWLI$GYDQFHG6HUYLFHVamp$ 76VWHPV6I5amp$ R6LJQ6HUYHU$XWKRULW 7X7HFKQQRYDWLRQPE+ $ampamp9amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ -8amp$ OREDO8178(amp$ 81))0amp$ amp11amp466
LJL6LJQamp$LJL66V +7HLS]LJamp$ )19HUHLQamp$6HUYLFHV DQGL3UR66amp$ 8QLYHUVLWDHW+DOOHamp$ )+0XHQVWHUamp$ 1HWRFN([SUHVV]ampODVVamp7DQordmVshyWYiexclQNLDGsup3 57+$DFKHQamp$ 6HHampHUWLI$GYDQFHGamp$
+HOPKROW]=HQWUXP0XHQFKHQamp$ 5($0+2676620$19$$7(amp$ LJL6LJQamp$LJL66S 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW (6ltamp$ amp11amp66
3+XGZLJVEXUJamp$ 56amp$ HUOLQamp$ 1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW 67)78135(8666amp+(58785(67=amp$
=97amp$ amp11amp5227 267(6HHOREDO5RRW$amp$ +6)XOGDamp$ )+5HJHQVEXUJamp$
QWHVD6DQSDROR6S$amp$6HUYL]L(VWHUQL +68amp$ 7575867(OHNWURQLN6HUWLILND+L]PHW6DszligODntildeFntildeVntilde amp$ amp$GHU8QLYHUVLWDHWLHOHIHOG
1HWRFN]OHWLampODVV7DQordmVshyWYiexclQNLDGsup3 7L+R+DQQRYHUamp$ 7575867(OHNWURQLN6XQXFX6HUWLILNDVntilde+L]PHW 9amp$ 76VWHPV6I5amp$ $20HPEHUamp$ 7(5(1$66amp$ 1HWRFN$UDQampODVVROG)đWDQordmVshyWYiexclQ
(XURSHDQ66+LJK$VVXUDQFH6HUYHUamp$ +62(amp$ +I8 amp63666HUYLFHamp$ +60DQQKHLPamp$ 8$8amp$ )DFKKRFKVFKXOH+DQQRYHUamp$ 78amp$ 8QL2VQDEUXHFN5=amp$ 8QLRHOQamp$ 7amp7UXVWampHQWHU66amp$
(623 5=amp$ ampHUWXP([WHQGHG9DOLGDWLRQamp$ DGLGDV(0($VVXLQJamp$ 0DVWHUampDUG3XEOLF6XEamp$HQ (XURSD8QLYHUVLWDHW9LDGULQDamp$ )19HUHLQ6amp$
amp$GHU8+8+amp$ )1L16KXWWOHamp$ )9HUOLQ3amp$ )+(amp$ (TXLID[6HFXUHampHUWLILFDWH$XWKRULW ampHUWXP7UXVWHG1HWZRUNamp$ HR7UXVW3ULPDUampHUWLILFDWLRQ$XWKRULW $PHULFD2QOLQH5RRWampHUWLILFDWLRQ$XWKRULW 0DVWHUampDUG3XEOLF5RRWamp$HQ QWHVD6DQSDROR6S$amp$5RRWQWHUQD
56amp$ RRJOHQWHUQHW$XWKRULW
HHDGHUOREDOampODVVamp$Y 08amp$ 8QLLHOamp$ 8QLYHUVLWDHWRHWWLQJHQamp$ ampEHUWUXVW3XEOLFVVXLQJamp$
+6$QKDOWamp$ (UQVW0RULW]$UQGW8QLYHUVLWDHWUHLIVZDOG )+amp$
8QLDVVHOampHUWLILFDWLRQ$XWKRULW8QLDVVHOamp$ 818(amp$ 78ampKHPQLW]ampHUWLILFDWLRQ$XWKRULW78amp85=amp$ )DFKKRFKVFKXOHXHEHFNamp$
+RFKVFKXOHDXVLW]amp$ 03HPHLQVFKDIWVJXHWHUamp$ 78HUJDNDGHPLH)UHLEHUJamp$78$)amp$ QWHO([WHUQDODVLFVVXLQJamp$ +$+DPEXUJamp$ OREDO8QL8OPamp$ 56$6HFXULW9 QWHO([WHUQDODVLF3ROLFamp$ ampLVFR66amp$ 7DLamp$6HFXUHamp$ $QWKHPQFampHUWLILFDWH$XWKRULW )ULW]+DEHUQVWLWXWamp$ 65++RFKVFKXOH+HLGHOEHUJamp$ HR7UXVW([WHQGHG9DOLGDWLRQ66amp$ +$amp$ =amp$
0LFURVRIWQWHUQHW$XWKRULW H6]LJQR66amp$ )+52amp$ +HOPKROW]=HQWUXPIXHU8PZHOWIRUVFKXQJPE+8)=amp$ (QWUXVWampHUWLILFDWLRQ$XWKRULW (66amp$ QWHO([WHUQDODVLFVVXLQJamp$$ 5XKU8QLYHUVLWDHWRFKXPamp$ )+22amp$ +)8amp$
6HPSUD(QHUJ6HFXUH6HUYHUamp$ 8HLPDUamp$ 2QOLQH66+LWHOHVshyWđ$OHJVcopyJ2QOLQH66amp$ 7HOVWUD5663ROLFamp$ =HUWLIL]LHUXQJVVWHOOHGHU780 amp$8QLYHUVLWDHWGHV6DDUODQGHV +I07+DPEXUJamp$ =HUWLIL]LHUXQJVVWHOOH8QLYHUVLWDHW0XHQVWHU 7HFKQLVFKH)DFKKRFKVFKXOHHRUJ$JULFROD]XRFKXPamp$ HHDGHUOREDOamp$Y
LJL1RWDU6HUYLFHVamp$ =amp$ $amp$ )$8amp$ QIRampHUWampHUWLILFDWLRQ$XWKRULW 0LFURVRIW6HFXUH6HUYHU$XWKRULW $663RWVGDPamp$ 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW )=-ampHUWLILFDWLRQ$XWKRULW +RFKVFKXOH2IIHQEXUJamp$
675RRWamp$ EJUFD 6HPSUD(QHUJQWHUQHW$XWKRULW +0amp$ 8QLRUWPXQGamp$ 1HWRFN([SUHVV]ampODVVamp7DQXVLWYDQNLDGR 86(57UXVWHJDF6HFXUH6HUYHUamp$ )=amp$ DGLGDVOREDOQWHUPHGLDWHamp$ ampKDULWHamp$ KE]15amp$ $$$ampHUWLILFDWH6HUYLFHV
7HOVWUD566VVXLQJamp$ $OIUHGHJHQHUQVWLWXWamp$ )HUQ8QLYHUVLWDHWLQ+DJHQOREDOamp$ )19HUHLQ3amp$OREDO +HLS]LJamp$ QVWLWXWIXHUHOWZLUWVFKDIWDQGHU8QLYHUVLWDHWLHOamp$ +RFKVFKXOHHJJHQGRUIamp$ amp20223UR6HULHV6HFXUH6HUYHUamp$
HWURQLFVamp63-XVWLWLHamp$ ltDQGH[([WHUQDOamp$ 3)amp$ 8QL0DUEXUJamp$ HOOV)DUJRampHUWLILFDWH$XWKRULW )1amp(576HUYLFHVPE+amp$ (1633XEOLFampHUWLILFDWLRQ$XWKRULW
0LFURVHFH6]LJQR5RRWamp$ 8GHUOLQamp$ 6=amp$ )DFKKRFKVFKXOHXHU]EXUJ6FKZHLQIXUWamp$)+6amp$
087amp(57amp$ 78OPHQDXamp$ )DFKKRFKVFKXOHLHO 8QLYHUVLWDHW3DGHUERUQamp$ 7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW(9 +6$amp$ )+amp$ 7KHDOWLVQHampRPSDQamp$ (QWUXVWQHW6HFXUH6HUYHUampHUWLILFDWLRQ$XWKRULW +$++amp$ 7HFKQLVFKH8QLYHUVLWDHWUDXQVFKZHLJamp$
2KPamp$ 8++amp$ 0DWKHPDWLVFKHV)RUVFKXQJVLQVWLWXW2EHUZROIDFKJPE+amp$ HWURQLFVamp632UJDQLVDWLHamp$ 7(ampEHU7UXVWOREDO5RRW 1amp$ 7)+HUOLQamp$ WKDZWH([WHQGHG9DOLGDWLRQ66
ampEHUWUXVW-DSDQ3XEOLFamp$ )DFKKRFKVFKXOH1RUGKDXVHQamp$ HR)RUVFKXQJV=HQWUXP3RWVGDPamp$ DHUURXS([WHUQDO6HUYHUamp$ +6$DOHQamp$ $GYDQFHGH6]LJQRamp$ +7UHVGHQamp$ OREH66amp$
77HOHFRPOREDOamp$ )+amp$ DUOVUXKHamp$
7KHDOWLVQHampRPSDQ(QWHUSULVHamp$ amp$GHampHUWLILFDGRV66(9 8QLRQVWDQ]amp$6 HXWVFKHLQHPDWKHNamp$ 7)+LOGDXamp$
78amp$ )DFKKRFKVFKXOHDQGVKXWamp$ WKDZWH3ULPDU5RRWamp$ =RUJamp63amp$ ]HQSHFRP ampDGHQFHQWHUQHW$XWKRULW 819(567$(7(3=amp$ 8QL5HJHQVEXUJamp$ 61amp$ 8QL)OHQVEXUJamp$ +=amp$
([SHULDQ3ULPDUamp$ 76XEamp$3XEOLF 13UHLIVZDOGamp$ 66FRP3UHPLXP(9amp$
37amp$ )UDXQKRIHU6HUYLFHamp$ +DIHQampLW8QLYHUVLWDHW+DPEXUJamp$ HXWVFKH7HOHNRP$DERUDWRULHVamp$ 78amp$ 8QL)5amp$
)$XGZLJVEXUJamp$ =29$56HUYHUamp$ $FWDOLV6HUYHU$XWKHQWLFDWLRQamp$ 0DUNVDQG6SHQFHUURXSSOF([WHUQDOVXEamp$
6WDDWGHU1HGHUODQGHQ2UJDQLVDWLHamp$ $HWQDQFampHUWLILFDWH$XWKRULW )UHVGHQamp$ 8QLYHUVLWDHWXLVEXUJ(VVHQamp$ 8QLYHUVLWDHW(UIXUWamp$ (20$5amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH 7(QW6XEamp$3XEOLF 03=amp$ amp2022ampHUWLILFDWLRQ$XWKRULW
6DFKVHQOREDOamp$ 8QLYHUVLWDHW3DVVDXamp$ +65amp$ 66OLQGDGR(9 DVLJQ66 4XR9DGLVamp6332YHUKHLGamp$ ampDPSXVHUOLQXFKamp$ )+$XJVEXUJamp$
31ampRUSRUDWH0DUNHWamp632UJDQLVDWLHamp$ +71amp$ 0++amp$ +RFKVFKXOHRQQ5KHLQ6LHJamp$ 78++amp$LQ)13OREDO
8=UHJLVWHU6HUYHUamp$ +RFKVFKXOH+HLOEURQQamp$ ampEHUWUXVW6XUH6HUYHU6WDQGDUG9DOLGDWLRQamp$ amp$GHU8QLYHUVLWDHW]XXHEHFN +60HUVHEXUJamp$ amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$ ([SHULDQ3UG6XEamp$ 05amp$ +67amp$
ampRPWUXVW6HUYHUampHUWLILFDWLRQ$XWKRULW 6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU9 )+)UDQNIXUWD0amp$ )amp+amp$ 9ROXVLRQQF966amp$ 03amp$
6WDDWGHU1HGHUODQGHQ5RRWamp$ ampDGHQFH6HFXUH6HUYHU$XWKRULW ampRP6LJQ6HFXUHGamp$
HXWVFKHUXQGHVWDJamp$ )DFKKRFKVFKXOHLHOHIHOG
+RFKVFKXOHIXHU7HFKQLNXQGLUWVFKDIWHUOLQ )=amp$ )+ampREXUJamp$ )+2amp$OREDO +6PE+amp$ ampRP6LJQ6HUYHUamp$ 05VVXLQJamp$ +RFKVFKXOHIXHUDQJHZDQGWHLVVHQVFKDIWHQ)++RIamp$ ampRPWUXVW8VHUampHUWLILFDWLRQ$XWKRULW ampRPWUXVW5RRWampHUWLILFDWLRQ$XWKRULW )+1HX8OPamp$ 8QL0DJGHEXUJamp$
ampEHUWUXVW3XEOLF6XUH6HUYHU(9amp$ HR7UXVWOREDOamp$ )DFKKRFKVFKXOHLHVVHQ)ULHGEHUJamp$ 7amp$ (VVHQWLDO66amp$ $7UXVWQ4XDO ampEHUWUXVW-DSDQ(9amp$ 8QLDPEHUJamp$
0XVLNKRFKVFKXOHXHEHFNamp$ HXWVFKHUHWWHUGLHQVWamp$
X[7UXVWURRWamp$ $7amp$ 03Iamp$ HR7UXVW66amp$ 5DSLG66(QWHUSULVHamp$
+amp$ 8QLZ0amp$ 8QLYHUVLWDHWRQQamp$
05QWHUPHGLDWHamp$ QWHUPHGLDWHampHUWLILFDWH966amp$ +70amp$ amp2022([WHQGHG9DOLGDWLRQ6HFXUH6HUYHUamp$ ampEHUWUXVWOREDO5RRW 20(1lt3(9ampHUWLILFDWLRQ$XWKRULW
8QL+RKHQKHLPamp$ ampHUWLQRPLV$XWRULWcopy5DFLQH HXSKDQD8QLYHUVLWDHWXHQHEXUJamp$ 8QL5RVWRFNamp$ +62amp$ (TXLID[6HFXUHOREDOHXVLQHVVamp$ +(amp$ 8QLYHUVLWDHW3RWVGDPamp$ HR7UXVW966amp$ 3RVWHFRPamp6 5DSLG66amp$ ampEHUWUXVW6XUH6HUYHU(9amp$ RRJOHQFamp$ -DFREV8QLYHUVLWamp$
+RFKVFKXOH2VQDEUXHFNamp$ +8amp$ 7amp7UXVWampHQWHUampODVVamp$ ampHUWLQRPLV$ampcopyWRLOH $FWDOLV$XWKHQWLFDWLRQamp$ 7amp7UXVWampHQWHUampODVV([WHQGHG9DOLGDWLRQamp$ 6FKORVVDJVWXKO=PE+amp$
DWK8QLYHUVLWDHW(LFKVWDHWWQJROVWDGWamp$ +ampOREDOamp$ 1HWRFNR]MHJ]RLampODVV$7DQXVLWYDQNLDGR X[7UXVW4XDOLILHGamp$ 8QL+amp$LJLW3$amp$
8QLYHUVLWDHWDUHXWKamp$817amp$ 3++HLGHOEHUJamp$
)UHLH8QLYHUVLWDHWHUOLQ)8amp$ 7amp7UXVWampHQWHUampODVVamp$ $amp0LQLVWumlUH ampEHUWUXVW3XEOLF6XUH6HUYHU69amp$ XQGHVDPWIXHUDUWRJUDSKLHXQGHRGDHVLHamp$ 8QLYHUVLWDHW6WXWWJDUWamp$ 6ZLVV6LJQROGamp$ 8QLYHUVLWDHWUHPHQamp$ amp$ampDPHUILUPD([SUHVVampRUSRUDWH6HUYHU LJLampHUW$VVXUHG5RRWamp$ (lt1(amp76([WHQGHG9DOLGDWLRQamp$ 7HOH6HF6HUYHU3DVVamp$ ampHUWXPHYHOamp$ $amp5DFLQH 8QL6LHJHQamp$ ampHUWXPHYHO9amp$ 8QLXHVVHOGRUIamp$ $ampamp$0(5)50$$$33 )+)OHQVEXUJamp$ 01()$amp7((352amp(85(6 $amp6HUYHXUV
amp$ amp$GHU8QLYHUVLWDHW]XXHEHFN )UDXQKRIHU5RRWamp$
ampHUWXPamp$ +RFKVFKXOHDUPVWDGW 1HWZRUN6ROXWLRQV(966amp$ -DFN+HQUURXSamp$ 1HVWOH([WHUQDOamp$ 6LHPHQVQWHUQHWamp$9 )1amp$OREDO HXWVFKH7HOHNRP5RRWamp$
DOWLPRUHampEHU7UXVW5RRW LJLampHUW$VVXUHGamp$
ampHUWXPHYHOamp$ $amp5DFLQH ampEHUWUXVW-DSDQ3XEOLFamp$ )UDXQKRIHU6HUYLFHamp$
01()$87257((amp(57)amp$7215$amp1( $ampampDPHUILUPD([SUHVVampRUSRUDWH6HUYHUY ampODVV3ULPDUamp$ RDGGampODVVampHUWLILFDWLRQ$XWKRULW $amp-25DFLQH -DFN+HQU$SSOLFDWLRQamp$
ampHUWXPOREDO6HUYLFHVamp$ 6KRSHUn66 $amp0LQLVWHUH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
6LHPHQVVVXLQJamp$ampODVVQWHUQHW6HUYHU 6KDUHGXVLQHVVamp$ 7amp$6HFXUHamp$ $amp$QIUD ampKDPEHUVRIampRPPHUFH5RRW 7amp7UXVWampHQWHUampODVVamp$ amp$66(lt1(amp76amp$ $ampQIUDVWUXFWXUH 7amp$6HFXUHampHUWLILFDWLRQ$XWKRULW 76amp$6amp 9HUL6LJQampODVV6HFXUH2)amp$ $amp6HUYHXUV6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH
1HWZRUN6ROXWLRQVampHUWLILFDWH$XWKRULW $amp5DFLQH6HFWHXUSXEOLFGHYHORSSHPHQWGXUDEOH 7amp7UXVWampHQWHU8QLYHUVDOamp$ 9HUL6LJQampODVV3XEOLF3ULPDUampHUWLILFDWLRQ$XWKRULW $ampamp(57120666 $GPLQamp$amp7 OREH66amp$ 9HUL6LJQampODVV6HFXUH6HUYHUamp$ $$$ampHUWLILFDWH6HUYLFHV 7amp7UXVWampHQWHUampODVVamp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW 86(57UXVW+LJK$VVXUDQFH6HFXUH6HUYHUamp$ 1HWZRUN6ROXWLRQV(96HUYHUamp$ 7KDZWH66amp$ RDGG6HFXUHampHUWLILFDWLRQ$XWKRULW
9HUL6LJQampODVV6HFXUH6HUYHUELWamp$ QQR667UXVW6LJQ9ampHUWLILFDWLRQ$XWKRULW 7amp7UXVWampHQWHUampODVVamp$9 6XQ0LFURVVWHPVQF66amp$ ampUD]RPDLQV29ampHUWLILFDWLRQ$XWKRULW
KWWSZZZYDOLFHUWFRP 3RVLWLYH66amp$ 9LVDHampRPPHUFH5RRW 7UXVWHG6HFXUHampHUWLILFDWH$XWKRULW
86QWamp$ 7KDZWH3UHPLXP6HUYHUamp$ 66OLQGDGR 86VXamp$ 66FRP+LJK$VVXUDQFHamp$
7KDZWH966amp$ 6WDUILHOG6HFXUHampHUWLILFDWLRQ$XWKRULW H9LVD (QWUXVWampHUWLILFDWLRQ$XWKRULWamp 7KDZWH6ampamp$ 6WDUILHOGampODVVampHUWLILFDWLRQ$XWKRULW
6HFXUHXVLQHVV6HUYLFHVamp$ -XXU6 (QWUXVWQHWampHUWLILFDWLRQ$XWKRULW QQR667UXVW6LJQ29ampHUWLILFDWLRQ$XWKRULW $666
(QWUXVW(GXFDWLRQ6KDUHG6HUYLFH3URYLGHU 7UHQG0LFURamp$ $GG7UXVW([WHUQDOamp$5RRW amp2022+LJK$VVXUDQFH6HFXUH6HUYHUamp$
(QWUXVW0DQDJHG6HUYLFHVampRPPHUFLDO3XEOLF5RRWamp$ $IILUP7UXVW1HWZRUNLQJ 86(57UXVW6HFXUH6HUYHUamp$ HOOV)DUJR5RRWampHUWLILFDWH$XWKRULW 76amp$SURKRVWLQJ
6HFXUH6LJQ3XEOLFamp$ 7KHDOWLVQHampRPSDQVVXLQJamp$ LJLampHUWOREDOamp$ OREH66amp$ HOOV)DUJR(QWHUSULVHamp$
0DUNHWDUH6HUYHUamp$ 1HWZRUN6ROXWLRQV96HUYHUamp$ 7KHDOWLVQHampRPSDQ5RRWamp$
XSDVVampODVVamp$ amp202266amp$
20(1lt329ampHUWLILFDWLRQ$XWKRULW
ampUD]RPDLQV9ampHUWLILFDWLRQ$XWKRULW 66FRP)UHH66amp$ 6HFXUH6LJQ5RRWamp$
76amp$EXVLQHVV +RQJNRQJ3RVWHampHUWamp$
+RQJNRQJ3RVW5RRWamp$ QampRPPRQ6HUYHUamp$ OREDO7UXVWampHUWLILFDWLRQ$XWKRULW 20(1lt39ampHUWLILFDWLRQ$XWKRULW
7UXVW6LJQ5ampHUWLILFDWLRQ$XWKRULW29 LFHZDUSFRPFHDUSRPDLQ9DOLGDWLRQampHUWLILFDWLRQ$XWKRULW amp202266amp$
httpnotaryicsiberkeleyedutrust-tree
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
CA Incidents Tuumlrktrust Attacked clients view
TUumlRKTRUST Root
TUumlRKTRUST Intermediate
egogovtr
hellipbankasiorg googlecom
World view
Equifax Root
Google CA
googlecom
Tuumlrktrust issued two CA certificates to two of their customers Reason wrong profiles were copied between test and production
At some point one of the sites apparently noticed and began to MITM their local users
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
CA Attacks RapidSSL Flame
RapidSSL MD5 collision attack GeoTrust Global CA
Demonstrated at CCC Not enough certificate entropy Predicatable serial amp timestamp RapidSSL
CA Equifax Repeated by flame
with higher amount of entropy Same Hash hellipshirtphreedomorg Attackers had to predict
timestamp with millisecond resolution
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Other CA Incidents UTN-USERFirst-Hardware
Comodo certificates for google mozilla livecom loginyahoocom wwwgooglecom
skype loginskypecom
DigiNotar completely compromised CA googlecom skypecom com intermediate CAs enabled for EV
Trustwave issued intermediate CA for DLP system
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Changes in January 2013 741424 total certificates
489551 valid
80477 new
54321 validate correctly
40885 are for ldquonewrdquo domains
9400 match exactly one other certificate
1382 match more than 20
224 match more than 100
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Legitimate Changes Foursquare GlobalSign Root DigiCert Root
foursquarecom
foursquarecom
foursquarecom
DigiCert Akamai
GTE CyberTrust Root
GlobalSign
Several well-known certificates
Suddenly a new certificate for the same domain appears
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Legitimate Changes qqcom
Old certificates
VeriSign Root
VeriSignIntermediate
ptlogin2qqcom
ptlogin2tenpaycom
New certificate
ptlogin2qqcom
GeoTrust Global
GeoTrust SSL
ptlogin2tenpaycom
Chinese instant messenger service
Alexa position 8
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Other Changes we see Old certificate New certificate
New intermediates for Entrust Digital Signature Trust
known domains Entrust Identrust
Suddenly appearing new hellipdelawaregov certificates for banks hellipdelawaregov
eg americanexpresscom
Switches of CA countries nova scotia department of education privacyboxde to Israel zekurnl from US to Bermudas
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Validity Overlap
000
025
050
075
100
ECD
F
365 730 1095 1460 Time (days)
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Not practical
Notary systems
Certificate Transparency
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Proposed Remedies
User-side monitoring
Monitoring for CA country changes
Notary systems
Not practical
Privacy and other problems
Certificate Transparency
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
er-side monitoring
onitoring for CA country changes
otary systems
tificate Transparency
Proposed Remedies
Us
M
N
Cer
Not practical CT opens up possibilities
parties can prove possession of old keys to CA while requesting certificate in new certificate extension or pin new key to their domain
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
Summary
Our notary is an on-going large-scale measurement effort
It seems impractical to spot malicious certificates using only structural properties
Resolving these problems involves multiple actors
