2026-09-18T21:13:16Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/1040282022-01-31T17:01:44Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
David D. Clark and Daniel J. Weitzner.
Specter, Michael Alan
Technology and Policy Program.
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Massachusetts Institute of Technology. Engineering Systems Division
Massachusetts Institute of Technology. Institute for Data, Systems, and Society
Technology and Policy Program
2016-08-26T14:39:45Z
2016-08-26T14:39:45Z
2016
2016
http://hdl.handle.net/1721.1/104028
957287604
Thesis: S.M. in Technology and Policy, Massachusetts Institute of Technology, Institute for Data, Systems, and Society, Technology and Policy Program, 2016.
Thesis: S.M., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2016.
Cataloged from PDF version of thesis.
Includes bibliographical references (pages 71-75).
Certificate Authorities (CAs) play a crucial role in HTTPS, the mechanism that secures all of the web's most important communication; if it has a log-in page, it must use HTTPS. However, recent history is littered with instances of CAs unabashedly undermining the trust model of the web in favor of economic gain, causing catastrophic harm to users in the process. The purpose of this thesis is to understand how well user, domain owner, and browser vendor controls function in order to evaluate methods of realigning CA incentives. Using a compendium of past incidents of CA failure as a series of natural experiments, along with a large dataset of all publicly available certificate collections, we find that it is possible to causally link a very slight increase in domain owners leaving a CA when a CA acts inappropriately. We further find that the technical architecture of the CA system leaves users without effective control over which CAs they trust, and that browsers face certain difficulty in distrusting larger CAs. The end result is a system where large CAs can unilaterally undermine the trust model of the web without clear repercussion.
by Michael Alan Specter.
S.M. in Technology and Policy
S.M.
75 pages
eng
Massachusetts Institute of Technology
M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.
http://dspace.mit.edu/handle/1721.1/7582
Institute for Data, Systems, and Society.
Electrical Engineering and Computer Science.
Engineering Systems Division.
Technology and Policy Program.
The economics of cryptographic trust : understanding certificate authorities
Thesis
application/pdf
false
Publication
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="e8f2d41b-184f-49e5-aada-b71f29faad47">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>The economics of cryptographic trust : understanding certificate authorities</Title>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2016</PublicationDate>
<Authors>
<Author>
<DisplayName>Specter, Michael Alan</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>Institute for Data, Systems, and Society.</Keyword>
<Keyword>Electrical Engineering and Computer Science.</Keyword>
<Keyword>Engineering Systems Division.</Keyword>
<Keyword>Technology and Policy Program.</Keyword>
<Abstract>Certificate Authorities (CAs) play a crucial role in HTTPS, the mechanism that secures all of the web's most important communication; if it has a log-in page, it must use HTTPS. However, recent history is littered with instances of CAs unabashedly undermining the trust model of the web in favor of economic gain, causing catastrophic harm to users in the process. The purpose of this thesis is to understand how well user, domain owner, and browser vendor controls function in order to evaluate methods of realigning CA incentives. Using a compendium of past incidents of CA failure as a series of natural experiments, along with a large dataset of all publicly available certificate collections, we find that it is possible to causally link a very slight increase in domain owners leaving a CA when a CA acts inappropriately. We further find that the technical architecture of the CA system leaves users without effective control over which CAs they trust, and that browsers face certain difficulty in distrusting larger CAs. The end result is a system where large CAs can unilaterally undermine the trust model of the web without clear repercussion.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>