CrySP Speaker Series on Privacy • CVE-2022-23491, or Why PO Boxes Can’t be Root Certificate Authorities Anymore

Please note: This talk will take place in DC 3317 and online over Zoom.

Joel Reardon, Associate Professor
Department of Computer Science, University of Calgary

Mozilla curates a set of root certificate authorities to validate hostnames for TLS in the Firefox browser. Many other software projects, such as Tor Browser and ca-certificates simply follow Mozilla’s list; other entities, such as Apple and Microsoft, make their own decisions for inclusion with considerations for Mozilla’s decisions and the associated public discussion.

In March 2023, Mozilla introduced a set of new considerations when deciding on inclusions and removals to their authorities list. Among these are being closely tied through ownership or operation to a spyware operation, having as its address a P.O. box or being a shell corporation, being audited by an auditor that does not audit any other certificate authorities, and not being transparent on matters such as legal domicile and control.

In this talk, we’ll discuss our research into a root certificate authority and the associated disclosure that led to Mozilla distrusting it and Github assigning CVE-2022-23491. This was despite no evidence of any mis-issued certificates or wrongdoing tied to its certificate authority operations. This removal was soon after followed by Mozilla producing their new set of root inclusion considerations, some of which are directly relevant to our disclosure.

Bio: Joel Reardon is an associate professor at the University of Calgary who researches mobile security and privacy issues and data collection done through those devices. He received his Bachelor’s and Master’s at the University of Waterloo and his Doctor of Sciences at the ETH Zurich.

His research has been covered by the CBC, the BBC, the Washington Post, and the Wall Street Journal, among other places. His research has received the Emilio Aced Research and Personal Data Protection Award, the CNIL–Inria Data Protection Award, and the Caspar Bowden Award for Outstanding Research in Privacy Enhancing Technologies. He likes bicycling and snowboarding.

To attend this talk in person, please go to DC 3317. You can also attend virtually on Zoom at https://uwaterloo.zoom.us/j/95095716565.