Post

Hello Blue Sky! Check out first post in my series on transparency systems. educatedguesswork.org/posts/transp...

Most real-world authentication protocols rely on some kind of trusted authentication service to attest to endpoint identities. The obvious problem here is the word "trusted"; if the authentication service misbehaves, then the whole system breaks down.

The solution that the ecosystem has converged on is something called a "transparency system", and in the case of the WebPKI "certificate transparency". Instead of trying to prevent misbehavior by CAs, a transparency system tries to make it detectable.

The basic idea is to require every certificate has to be published, thus allowing sites -- or services on their behalf -- to detect (at least in principle) when a certificate has been misissued

A misissued certificate can be revoked, and, if investigation reveals improper practices, browsers might choose to distrust the CA, thus rendering all of its certificates invalid.