Can a certificate chain be used for a hidden service's private key? It would be nice to be able to periodically re-sign a public key and upload it to the host. This would mean that in the case of the private key on the host being compromised, it is only valid for a short amount of time, due to the manual reauthorization process.
I'm not sure of the correct terminology to use, so I'll try to explain it with some examples and my reasoning behind wanting this:
- Host: I am
ONION_ADDRESS, my public key isHOST_PUBLIC_KEY. - HSDir: I don't trust that public key.
- Host: Here is the signature from root key
ROOT_PUBLIC_KEY:SIGNED_HOST_PUBLIC_KEY.
Depending on whether the signature has expired:
- HSDir:
ROOT_PUBLIC_KEYis valid, and that signature is valid. Go ahead.
or
- HSDir:
ROOT_PUBLIC_KEYis valid, but that signature has expired. Goodbye.
The ROOT_PRIVATE_KEY is stored on a machine under physical control of the hidden service operator. The remote host is considered the weakest point. Should the remote host be compromised, all that can be obtained is HOST_PRIVATE_KEY (and of course HOST_PUBLIC_KEY), and the SIGNED_HOST_PUBLIC_KEY. Due to the signature being created with an expiry date, the adversary can only masquerade as the hidden service for as long as SIGNED_HOST_PUBLIC_KEY remains valid. Should the hidden service operator become aware of the host becoming compromised, he would not renew the signature. Once the SIGNED_HOST_PUBLIC_KEY expires, due to the absence of a renewed signature, HOST_PUBLIC_KEY will not be trusted, resulting in the adversary's loss of control of the hidden service.
The purpose of this is to limit the impact which a compromise would have. Further, once SIGNED_HOST_PUBLIC_KEY expires, the hidden service operator can regain exclusive control of the .onion address – it would not be necessary for a new .onion to be created.
Are there currently any methods (or any planned methods) which would allow for the host to be given partial/temporary authority to serve as the hidden service?
Related:
