A metric to assess the trustworthiness of certificate authorities

Abstract

In the recent past, there has been a series of security incidents leading to increasing concern regarding the trust model currently employed by public key infrastructures. One of the key criticisms is the architectureʼs implicit assumption that certificate authorities (CAs) are trustworthy a priori. This work proposes a metric to compensate this assumption by a differentiating assessment of a CAʼs individual trustworthiness based on objective criteria. The metric utilizes a wide range of factors derived from existing policies, technical guidelines, and research. It consists of self-contained submetrics allowing the simple extension of the existing set of criteria. The focus is thereby on aspectswhich canbe assessedby employing practically applicable methods of independent data collection. The metric is meant to help organizations, individuals, and service providers deciding which CAs to trust or distrust. For this, the modularized submetrics are clustered into coherent submetric groups covering a CAʼs different properties and responsibilities. By applying individually chosen weightings to these submetric groups, themetricʼs outcomes can be adapted to tailored protection requirements according to an exemplifying attacker model.