EU Article 45 requires that browsers trust certificate authorities appointed by governments
EU Article 45 requires that browsers trust certificate authorities appointed by governments
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
EU Article 45 requires that browsers trust certificate authorities appointed by governments::The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
You're viewing a single thread.
That means cryptographic keys under one government’s control could be used to intercept HTTPS communication
Could someone smarter than me explain how this would be possible? Wouldn’t the browser still be able to enforce privacy between the client and origin? Or is it the case that certificates issued by these CAs could in theory only support weaker cyphers?
Edit: Some really useful explanations. Thank you!
There can be an infinite amount of certificates for a single domain.
When you setup a connection to a website you basically get a response back that has been signed with a certificate.
Your Browser / OS has a list of certification authorities that it deems trustworthy.
So when you get the response the browser checks if the certificate was issued by a trusted CA.
Now, if the EU forces browsers to trust their CA they can facilitate a man-in-the-middle attack.
In this instance they will intercept the TLS Handshake and give you back a response that was signed by their certificate. Your Browser deems the certificate valid and sets up a secure tunnel to the EUs Server.
From then on they can forward packets between you and the real website while being able to read everything in cleartext
Cryptography works. At least until sufficiently powerful quantum computers arrive, TLS reliably ensures confidentiality between your browser and the server. No one else can snoop on the data transmitted via that connection.
But are you connected to the right server? Without some kind of authentication, any adversary in the middle (such as your ISP) could impersonate the real server.
That is where certificates come in. They are issued by neutral certificate authorities (CAs) that check the identity. It works something like this:
- I, the server operator, create a private key on that server. I use that key to create a certificate request which asks the CA to give me a certificate. This request also contains the domain names for which the key shall be used.
- The CA performs identity checks.
- The CA issues me the certificate. I install it on my server. Now, when browsers create a TLS connection I can tell them: here's my public key you can use to check my identity, and here's a certificate that shows that this is a valid key for this domain name!
- The browser will validate the certificate and see if the domain name matches one of the names in the certificate.
What kind of checks are done depends on the CA. I've obtained certificates by appearing in person at a counter, showing my government ID, and filling out a form. Nowadays more common is the ACME protocol which enables automated certificate issuance. With ACME, the CA connects to the server from multiple network locations (making interception unlikely) and checks if the server provides a certain authentication token.
To know which certificates are valid, browsers must know which CAs are trusted. Browser makers and CAs have come together to create an evolving standard of minimum requirements that CAs must fulfill to be eligible for inclusion in the browser's default trust store. If a CA violates this (for example by creating certificates that can be used for government traffic interception, or by creating a certificate without announcing it in a public transparency list), then future browser versions will remove them, making all their certificates worthless.
eIDAS 2 has the effect of circumventing all of this. There is to be a government-controlled CA (already high-risk) that has its own verification rules set by legislation (does not meet industry standard rules). And browsers would be legally forced to include the eIDAS CAs as "trusted".
This puts browsers in a tough spot because they've resisted these kinds of requests from authoritarian regimes in the past. But now the world's largest trade bloc is asking. Browsers can comply or leave the EU market, or maybe provide a less secure EU edition? Awakens uncomfortable memories around the failed US attempts at cryptography export control (cryptography is considered a munition, like hand grenades or ballistic missiles).
It is plausible that the EU is doing this with good intentions: having a digital identity scheme is useful, it makes sense for identity to be government-controlled (like passports), and such a scheme will only see success if it sees industry adoption. The EU has also seen that hoping for voluntary industry adoption doesn't generally work, e.g. see the USB-C mandate.
you seem to know what you are talking about and I looked into this very long ago, maybe you can help me understand.
From what I can understand reading most of the article this forces browsers to accept the certificates, but it doesn't force the websites to use them, right?
So what is stopping Firefox from showing a warning (like the lock icon being orange, but it could also be a more intrusive message) stating that the certificate was issued by a country and/or doesn't fullfil modern security standards in case one of these CAs is used?
On top of that, the CA doesn't really encrypt the private key of the domain, it just adds a signature stating that the message with the salt and the public key are legit, right? everyone seems to think the government itself will be able to passively see the traffic, but if I remember correctly they would have to gateway the whole transaction (I'm guessing the browser will also have a cache of keys and this could become a bit tricky to do in a global way)
But of course we all know how technologically illiterate governments are (there could be one good, but there will be some "less good" for sure). So yeah, it does sound like a horrible idea to begin with. Because if a CA starts being insecure nowadays browsers can just remove them and go with their life, but if there is a law forcing browsers wouldn't be able to.
I'm just curious about the specifics in case I'm outdated on what I remember.
Regarding what a browser like Firefox can do, they aren't allowed to impose any stricter checks or requirements than what the EU's standards body permits and they must trust them, according to these rules. That means that the warning you suggested likely wouldn't be allowed.
As for it not happening passively, your right that it would need to be actively man in the middled. It would be fairly easy to detect but what could be done about it? The browser is required to trust it, additional checks can't be enforced, and the CA involved wouldn't be allowed to be distrusted without the relevant government's permission. It then becomes a game of who blinks first, the browser vendors potentially pulling out of a country or the EU entirely or a government that for some reason thinks it's in the right by intercepting traffic for the children, against terrorism, or whatever excuse they come up with.
Well why couldnt firefox implemwnt the check anyways and have it trigger only if the signature is valid. That way the only proof the EU would have would be if they where activly performing man in the middle. Whats the eu gonna do ban them when they catch browsers catching them spying, think of the public outrage that would cause. Think of the headline "Browser xyz banned in EU after it caught EU spying on citizen".
Id need to read the whole law ( as we all should if we were to discuss it ), but everyone says trust the certificate, etc.
We can trust the certificate, but if the hostname does not match the certificate's domains, you can ( and should ) deny it. Law doesnt say to trust the connection if a parameter is wrong, it says that browsers should consider certs provided by the government CA to be legit.The only mitm that can be done is at the server itself or in a website pretending to be the requested server. But for this to work you need to have the private and public keys of the server you want to act like.
... Aka, government can read your data just as easily as facebook, google, pornhub or whatever.
The only thing this changes is that a government can easily issue a new cert without having to wait, and deal with e-ids easier.
As a european i have very mixed feelings about the new law, but the reactions are ,imo, a bit overrated because there is a lot more factors that go into secure connections than just the cert
The problem is that you can issue two certificates for one domain from two different CAs. Which one is valid?
If you only have one of the certificates, you also can't know that another exists to warn the user that they might be connecting to a government-operated middleman.
The problem with a government issued CA being trusted is that the government can now issue whatever certificates they want for any website, and then all they need to do is force your traffic to pass through their servers first.
And no they don't even need to make fake website clones, they have you connect to their proxy server which has a valid cert, then they have everything plaintext to save off to look at, and they forward the connection to the original website. Reverse proxy servers to accomplish this take minutes to set up.
The only mitm that can be done is at the server itself or in a website pretending to be the requested server. But for this to work, you need to have the private and public keys of the server you want to act like.
Maybe I misunderstand what you're saying, but since the wide majority of EU citizens use their ISP's DNS, it's trivial for them to mandate a domain redirection to another server which would act as a proxy of the original (and thus only need the original server's public key).
So far, the only protection we have against that are:
- Changing DNS (WAY too complicated for the average user, also brings the DNS' own contry's censorship)
- The fact that they wouldn't have a valid certificate for it because any sensible CA would see it for what it is: a MITM.
That's why, to my understanding, this is such a big deal. At any point, ANY EU gov (and I want to emphasis that part because ot's important in the context of tjhs law) can request a change of DNS from their ISP's DNS (many already do right now) and emit a fully trusted certificate for the domain they want to MITM.
It is also a huge deal because since (at least in France) the government forced ISPs to log DNS queries, a lot of browsers (and latest android and iOSversion's) have now migrated to DNS over https or TLS DNS, which means that the only clear text DNS query they can intercept is the one to fetch your secure DNS service address. Now, having a trusted CA installed in browsers means that they can also spoof the identity of this secure name service, and regain a bit of control.
They invested a lot in surveillance technology (for both good and bad reasons), and https, DNS and encrypted messaging / phone calls means this was all for nothing.
And yes, by being authorized as a trusted CA, you can effectively spoof pretty much anything by setting a proxy. Some tools even leverage this for app analysis. Look up mitmproxy for example, or squid. A lot of companies already do this to inspect inbound / outbound traffic.
The government CA could just issue a new certificate for let's say Google, force your ISP to return a wrong IP when you ask your ISPs dns server what the address of Google is and then return a fake Google page instead or forward traffic to Google on your behalf and read all data. And since your browser trusts the new fake Google certificate from the government you won't get any https error or warning.
A government could create a new certificate for any domain without having ownership of the domain or permission of the owner. This way they can perform Man-in-the-middle attacks.
In such an attack someone intercepts the traffic of a client and presents their own certificate.
Because a government can create a universally accepted certificate, thise would be accepted as valid. The traffic can then be decrypted and forwarded to the real website. The attacker is now between the client and the real host (the Man in the middle) and can view the unencrypted traffic.
The CA (Certification Authority) is what validates the encryption certificates that TLS uses in HTTPS. In this case it can certify a cypher that can be used in a site's certificates and be known to a government agency (the 3rd party) and used to decrypt the HTTPS stream. This basically an Man-In-The-Middle attack.
When a website uses HTTPS they have a certificate that proves who they are. Your device uses that certificate to encrypt your data so that only that service can decrypt it. The issue is that it's just a file and anyone can make one. So to determine whether I trust your certificate I need it to be cryptographically signed by someone I already trust. These are the certificate authorities.
If I was a certificate authority that your device trusts then I could create a certificate for any domain and your device would believe me. Meaning I could sit between you and any web service and have you encrypt things with my certificate in a way that lets me decrypt everything before forwarding it to the service and you would never know.