Trust No One Else: Detecting MITM Attacks against SSL/TLS without Third-Parties

摘要: The security guarantees provided by SSL/TLS depend on the correct authentication of servers through certificates signed a trusted authority. However, as recent incidents have demonstrated, trust in these authorities is not well placed. Increasingly, certificate (by coercion or compromise) been creating forged for range adversaries, allowing seemingly secure communications to be intercepted via man-in-the-middle (MITM) attacks. A variety solutions proposed, but their complexity and deployment costs hindered adoption. In this paper, we propose Direct Validation Certificates (DVCert), novel protocol that, instead relying third-parties validation, allows domains directly securely vouch using previously established user credentials. By robust cryptographic construction, relatively simple means enhancing server identity validation only efficient comparatively easy deploy, it also solves other limitations third-party solutions. Our extensive experimental analysis both desktop mobile platforms shows that DVCert transactions require little computation time (e.g., less than 1 ms) are unlikely degrade performance experience. short, provide practical mechanism enhance protect web applications from MITM attacks against SSL/TLS.