Главная
Study mode:
on
1
Intro
2
Alice and Bob
3
Certificate Authorities
4
Cats
5
Certificate Transparency
6
What is a CT Log
7
How does a CT Log protect us
8
What is an SCT
9
How SCT logs can be abused
10
Public keys
11
Persistent data storage
12
Example
13
Chunking
14
Catalog
15
Demo
16
Who is this person
17
Summary
18
Entropy
19
Googlecom
20
Multidomain ProPer
21
Wrap Up
22
Final Thoughts
23
Outro
Description:
Explore the world of Certificate Transparency (CT) logs in this 33-minute conference talk from BSidesSF 2019. Dive deep into the mechanics of CT logs, their role in web security, and their potential for misuse. Learn how these append-only logs bring auditability and accountability to the public web certificate ecosystem. Discover the importance of CT logging in modern browsers like Chrome and its impact on the web's ecosystem. Investigate novel and potentially nefarious uses of CT logs, including their unexpected role as a repository for cat pictures. Gain insights into the structure of CT logs, Signed Certificate Timestamps (SCTs), and how they can be exploited. Through examples and demonstrations, understand concepts like public keys, persistent data storage, chunking, and cataloging in the context of CT logs. Conclude with a discussion on entropy, multi-domain certificates, and final thoughts on the implications of this technology for internet security and unexpected uses.

Cats in My Certificate Transparency Logs

Security BSides San Francisco
Add to list