Postcertificates for Revocation Transparency

• URL: http://arxiv.org/abs/2203.02280v1
• Date: Thu, 3 Mar 2022 18:43:09 GMT
• Title: Postcertificates for Revocation Transparency
• Abstract summary: We propose a new revocation transparency protocol that introduces postcertificates and utilizes the existing Certificate Transparency (CT) logs. The protocol is practical, has a low deployment cost, provides an immutable history of revocations, enables delegation, and helps to detect revocation-related misbehavior. We evaluate the protocol, measure log and monitor performance, and conclude that it is possible to provide revocation transparency using existing CT logs.
• Score: 3.4269133917069263
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The modern Internet is highly dependent on trust communicated via certificates. However, in some cases, certificates become untrusted, and it is necessary to revoke them. In practice, the problem of secure revocation is still open. Furthermore, the existing procedures do not leave a transparent and immutable revocation history. We propose and evaluate a new revocation transparency protocol that introduces postcertificates and utilizes the existing Certificate Transparency (CT) logs. The protocol is practical, has a low deployment cost, provides an immutable history of revocations, enables delegation, and helps to detect revocation-related misbehavior by certificate authorities (CAs). With this protocol, a holder of a postcertificate can bypass the issuing CA and autonomously initiate the revocation process via submission of the postcertificate to a CT log. The CAs are required to monitor CT logs and proceed with the revocation upon detection of a postcertificate. Revocation status delivery is performed independently and with an arbitrary status protocol. Postcertificates can increase the accountability of the CAs and empower the certificate owners by giving them additional control over the status of the certificates. We evaluate the protocol, measure log and monitor performance, and conclude that it is possible to provide revocation transparency using existing CT logs.

Related papers

• Accountability in Certificate Transparency and Variants [5.3011521265234425]
  Certificate Transparency aims to reduce the trust required in Certificate Authorities (CAs) within the TLS certificate ecosystem.<n>The protocol obliges all CAs to record the certificates they issue in a public log, which itself is monitored for compliance and consistency by third parties.<n>We show that plain CT relies on an honest log, but provides accountability under this assumption.
  arXiv  Detail & Related papers  (2026-09-10T13:45:01Z)
• Sovereign Execution Broker: Enforcing Certificate-Bound Authority in Agentic Control Planes [2.124730017640531]
  Sovereign Execution Broker (SEB) is a runtime enforcement boundary for certificate-bound agentic infrastructure.<n>By separating proposal, admission, and execution, SEB turns certified authority into a short-lived, auditable runtime capability.<n>We present the SEB execution model, certificate and replay-verification predicates, scoped identity semantics, bypass-prevention deployment patterns, failure behavior, and a concrete prototype implementation.
  arXiv  Detail & Related papers  (2026-06-18T17:36:46Z)
• Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure [2.124730017640531]
  Sovereign Assurance Boundary is a certificate-bound runtime admission layer for autonomous execution authority.<n>We detail the airlock-broker architecture, formalize its admission and revocation invariants, and report preliminary feasibility measurements from a Go prototype.
  arXiv  Detail & Related papers  (2026-06-10T03:49:57Z)
• Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing [75.56230265544042]
  Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns.<n>We propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing.<n>Under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks.
  arXiv  Detail & Related papers  (2026-05-28T11:54:52Z)
• The Hidden Signal of Verifier Strictness: Controlling and Improving Step-Wise Verification via Selective Latent Steering [67.8271652641864]
  We study whether verifier strictness can be controlled through hidden-state intervention.<n>VerifySteer exploits latent correctness signals for sample-level routing and selectively intervenes on paragraph boundaries.
  arXiv  Detail & Related papers  (2026-05-20T05:48:16Z)
• Preventing the Collapse of Peer Review Requires Verification-First AI [49.995126139461085]
  We propose truth-coupling, i.e. how tightly venue scores track latent scientific truth.<n>We formalize two forces that drive a phase transition toward proxy-sovereign evaluation.
  arXiv  Detail & Related papers  (2026-01-23T17:17:32Z)
• Managed TLS Under Migration: Authentication Authority Across CDN and Hosting Transitions [0.0]
  This study investigates how managed TLS platforms behave when a domain is moved away from the platform that originally issued and stored its certificate.<n> measurements show that platforms continue to serve the same certificate until it expires, even after DNS resolvers direct traffic toward new infrastructure.<n>Findings indicate that authentication authority remains with the previous platform for the entire lifetime of certificates issued during the delegation period.
  arXiv  Detail & Related papers  (2025-12-07T22:52:52Z)
• zkToken: Empowering Holders to Limit Revocation Checks for Verifiable Credentials [0.0]
  We propose a novel framework for time-limited continuous verification.<n>The system guarantees proven untraceability of the revocation status after the verification period expires.<n>In addition to theoretically proving security, we evaluate the approach analytically and experimentally.
  arXiv  Detail & Related papers  (2025-09-15T13:48:41Z)
• Formal Verification of Neural Certificates Done Dynamically [7.146556437126553]
  We propose a lightweight runtime monitoring framework that integrates real-time verification and does not require access to the underlying control policy.<n>Our approach enables timely detection of safety violations and incorrect certificates with minimal overhead.
  arXiv  Detail & Related papers  (2025-07-16T07:37:23Z)
• CertDW: Towards Certified Dataset Ownership Verification via Conformal Prediction [48.82467166657901]
  We propose the first certified dataset watermark (i.e., CertDW) and CertDW-based certified dataset ownership verification method.<n>Inspired by conformal prediction, we introduce two statistical measures, including principal probability (PP) and watermark robustness (WR)<n>We prove there exists a provable lower bound between PP and WR, enabling ownership verification when a suspicious model's WR value significantly exceeds the PP values of benign models trained on watermark-free datasets.
  arXiv  Detail & Related papers  (2025-06-16T07:17:23Z)
• Formal Verification of Permission Voucher [1.4732811715354452]
  The Permission Voucher Protocol is a system designed for secure and authenticated access control in distributed environments. The analysis employs the Tamarin Prover, a state-of-the-art tool for symbolic verification, to evaluate key security properties. Results confirm the protocol's robustness against common attacks such as message tampering, impersonation, and replay.
  arXiv  Detail & Related papers  (2024-12-18T14:11:50Z)
• Securing Legacy Communication Networks via Authenticated Cyclic Redundancy Integrity Check [98.34702864029796]
  We propose Authenticated Cyclic Redundancy Integrity Check (ACRIC) ACRIC preserves backward compatibility without requiring additional hardware and is protocol agnostic. We show that ACRIC offers robust security with minimal transmission overhead ( 1 ms)
  arXiv  Detail & Related papers  (2024-11-21T18:26:05Z)
• A Call to Reconsider Certification Authority Authorization (CAA) [1.3124513975412255]
  We show how shortcomings in CAA concepts and operational aspects undermine its effectiveness in preventing certificate misissuance. Our discussion reveals pitfalls and highlights best practices when designing security protocols based on DNS.
  arXiv  Detail & Related papers  (2024-11-12T10:35:59Z)
• Formally Verifying Deep Reinforcement Learning Controllers with Lyapunov Barrier Certificates [2.0611129932396164]
  We present a novel method for training and verifying NLB-based certificates for discrete-time systems. Specifically, we introduce a technique for certificate composition, which simplifies the verification of highly-complex systems. We demonstrate the merits of our approach with a case study on providing safety and liveness guarantees for a DRL-controlled spacecraft.
  arXiv  Detail & Related papers  (2024-05-22T23:06:34Z)
• CrossCert: A Cross-Checking Detection Approach to Patch Robustness Certification for Deep Learning Models [6.129515045488372]
  Patch robustness certification is an emerging kind of defense technique against adversarial patch attacks with provable guarantees. This paper proposes a novel certified defense technique called CrossCert.
  arXiv  Detail & Related papers  (2024-05-13T11:54:03Z)
• DID Link: Authentication in TLS with Decentralized Identifiers and Verifiable Credentials [0.0]
  This article presents DID Link, a novel authentication scheme for TLS 1.3. It empowers entities to authenticate in a TLS-compliant way with self-issued X.509 certificates that are equipped with ledger-anchored DIDs. A prototypical implementation shows comparable TLS handshake durations of DID Link if verification material is cached and reasonable prolongations if it is obtained from a ledger.
  arXiv  Detail & Related papers  (2024-05-13T08:03:32Z)
• Hybrid Online Certificate Status Protocol with Certificate Revocation List for Smart Grid Public Key Infrastructure [0.7249731529275341]
  Hsu et al. proposed a cryptographic scheme within the public key infrastructure to bolster the security of smart grid meters. We introduce a Hybrid Online Certificate Status Protocol mechanism. Our simulations, mimicking meter behavior, demonstrated increased efficiency, creating a more robust architecture tailored to the smart grid meter landscape.
  arXiv  Detail & Related papers  (2024-01-19T16:16:11Z)
• Sound and Complete Verification of Polynomial Networks [55.9260539566555]
  Polynomial Networks (PNs) have demonstrated promising performance on face and image recognition recently. Existing verification algorithms on ReLU neural networks (NNs) based on branch and bound (BaB) techniques cannot be trivially applied to PN verification. We devise a new bounding method, equipped with BaB for global convergence guarantees, called VPN.
  arXiv  Detail & Related papers  (2022-09-15T11:50:43Z)
• Towards Evading the Limits of Randomized Smoothing: A Theoretical Analysis [74.85187027051879]
  We show that it is possible to approximate the optimal certificate with arbitrary precision, by probing the decision boundary with several noise distributions. This result fosters further research on classifier-specific certification and demonstrates that randomized smoothing is still worth investigating.
  arXiv  Detail & Related papers  (2022-06-03T17:48:54Z)
• COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attacks [49.15885037760725]
  We focus on certifying the robustness of offline reinforcement learning (RL) in the presence of poisoning attacks. We propose the first certification framework, COPA, to certify the number of poisoning trajectories that can be tolerated. We prove that some of the proposed certification methods are theoretically tight and some are NP-Complete problems.
  arXiv  Detail & Related papers  (2022-03-16T05:02:47Z)
• Sample-efficient device-independent quantum state verification and certification [68.8204255655161]
  Authentication of quantum sources is a crucial task in building reliable and efficient protocols for quantum-information processing. We develop a systematic approach to device-independent verification of quantum states free of IID assumptions in the finite copy regime. We show that device-independent verification can be performed with optimal sample efficiency.
  arXiv  Detail & Related papers  (2021-05-12T17:48:04Z)
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates [57.52763961195292]
  We present a new attack that exploits not only the labelling function of a classifier, but also the certificate generator. The proposed method applies large perturbations that place images far from a class boundary while maintaining the imperceptibility property of adversarial examples.
  arXiv  Detail & Related papers  (2020-03-19T17:59:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.