Now Let's Make It Physical: Enabling Physically Trusted Certificate Issuance for Keyless Security in CAs
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866912184695521280 |
|---|---|
| author | Zhang, Xiaolin Chen, Chenghao Qin, Kailun Wang, Yuxuan Qu, Shipei Wang, Tengfei Zhang, Chi Gu, Dawu |
| author_facet | Zhang, Xiaolin Chen, Chenghao Qin, Kailun Wang, Yuxuan Qu, Shipei Wang, Tengfei Zhang, Chi Gu, Dawu |
| contents | The signing key protection of Certificate Authorities (CAs) remains a critical challenge in PKI. Traditional approaches struggle to eliminate the risk of key exposure due to those (un)intentional human errors. This long-standing dilemma motivates us to propose Armored Core, a novel PKI security extension using the trusted binding of Physically Unclonable Function (PUF) for CAs. PUFs leverage manufacturing variations to generate unique and random responses. Combining with XOR and hash, they can make key exposure impossible for CAs through keyless certificate issuance.
In Armored Core, we design a set of PUF-based X.509v3 certificate functions for CAs to generate physically trusted "signatures" without using a digital key. Moreover, we introduce a novel PUF transparency mechanism to effectively monitor the PUF operations in CAs. We integrate Armored Core into real-world PKI systems including Let's Encrypt Pebble and Certbot. We also provide a PUF-embedded hardware prototype. The evaluation results show that Armored Core can achieve keyless certificate issuance while improving the computation performance by 4.9%~73.7%. It only incurs small communication and storage overhead (<4%). |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2404_15582 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Now Let's Make It Physical: Enabling Physically Trusted Certificate Issuance for Keyless Security in CAs Zhang, Xiaolin Chen, Chenghao Qin, Kailun Wang, Yuxuan Qu, Shipei Wang, Tengfei Zhang, Chi Gu, Dawu Cryptography and Security The signing key protection of Certificate Authorities (CAs) remains a critical challenge in PKI. Traditional approaches struggle to eliminate the risk of key exposure due to those (un)intentional human errors. This long-standing dilemma motivates us to propose Armored Core, a novel PKI security extension using the trusted binding of Physically Unclonable Function (PUF) for CAs. PUFs leverage manufacturing variations to generate unique and random responses. Combining with XOR and hash, they can make key exposure impossible for CAs through keyless certificate issuance. In Armored Core, we design a set of PUF-based X.509v3 certificate functions for CAs to generate physically trusted "signatures" without using a digital key. Moreover, we introduce a novel PUF transparency mechanism to effectively monitor the PUF operations in CAs. We integrate Armored Core into real-world PKI systems including Let's Encrypt Pebble and Certbot. We also provide a PUF-embedded hardware prototype. The evaluation results show that Armored Core can achieve keyless certificate issuance while improving the computation performance by 4.9%~73.7%. It only incurs small communication and storage overhead (<4%). |
| title | Now Let's Make It Physical: Enabling Physically Trusted Certificate Issuance for Keyless Security in CAs |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2404.15582 |