Domain Validation++ for MitM-resilient PKI

Markus Brandt, Tianxiang Dai, Haya Shulman, Amit Klein, Michael Waidner

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

54 Scopus citations


The security of Internet-based applications fundamentally relies on the trustworthiness of Certificate Authorities (CAs). We practically demonstrate for the first time that even a weak off-path attacker can effectively subvert the trustworthiness of popular commercially used CAs. Our attack targets CAs which use Domain Validation (DV) for authenticating domain ownership; collectively these CAs control 99% of the certificates market. The attack utilises DNS Cache poisoning and tricks the CA into issuing fraudulent certificates for domains the attacker does not legitimately own – namely certificates binding the attacker’s public key to a victim domain. We discuss short and long term defences, but argue that they fall short of securing DV. To mitigate the threats we propose Domain Validation++ (DV++). DV++ replaces the need in cryptography through assumptions in distributed systems. While retaining the benefits of DV (automation, efficiency and low costs) DV++ is secure even against Man-in-the-Middle (MitM) attackers. Deployment of DV++ is simple and does not require changing the existing infrastructure nor systems of the CAs. We demonstrate security of DV++ under realistic assumptions and provide open source access to DV++ implementation.

Original languageAmerican English
Title of host publicationCCS 2018 - Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
PublisherAssociation for Computing Machinery
Number of pages17
ISBN (Electronic)9781450356930
StatePublished - 15 Oct 2018
Externally publishedYes
Event25th ACM Conference on Computer and Communications Security, CCS 2018 - Toronto, Canada
Duration: 15 Oct 2018 → …

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221


Conference25th ACM Conference on Computer and Communications Security, CCS 2018
Period15/10/18 → …

Bibliographical note

Publisher Copyright:
© 2018 Association for Computing Machinery.


  • CA attacks
  • Certificates
  • DNS cache poisoning
  • PKI security


Dive into the research topics of 'Domain Validation++ for MitM-resilient PKI'. Together they form a unique fingerprint.

Cite this