Podcast
Root Causes Special Bulletin: Kazakhstan Weaponizes the Public CA


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
July 30, 2019
The Kazakhstan government is taking measures to force citizens to trust its own root, enabling the widespread persecution of dissidents, journalists, and human rights advocates. Join our hosts to learn the long history of Kazakhstan's weaponization of PKI, what its effects may be, and the opportunities and challenges the browser community faces in fighting it.
Podcast Transcript
Lightly edited for flow and brevity.
Much of the reason was what we just talked about, a belief that it was not intended to be used in the spirit of a trusted root in a browser. The browsers, of course, they own their root stores. Even though they have guidelines, they are allowed to choose not to give access if they deem that it’s bad for their users and bad for the security of the internet on the whole. That’s what happened.
Everybody thought that episode was over, and I guess for a couple of years it was. But now, three years later, 2019 Kazakhstan’s taking another run at it, and they’ve decided that they can just force the whole thing to happen on their end.
And then if the victim is essentially connected to you with a certificate that you had previously convinced them to install into their root store, you can look at all the communication because you you have the keys to both sides.
You know how is it expected that they will use it? The government of Kazakhstan is a dictatorship, and the widespread expectation is that this will be used to persecute their political enemies and human rights activists and journalists and really anybody who is not working to the advantage of what the sitting government in control wants.
There is a lively discussion on Mozilla board about this right now. People are proposing alternatives and actions, and the trouble is they’re all fraught with problems. It’s not an easy solution. You might say, “Well, why don’t we just do a manual one-off distrust of this root so that in our browser the root is distrusted regardless what you do as an end user?” But the response to that is, “Well then they’ll go to a different browser.” And then you go, “Ok fine. Let’s say we get all the major browsers to agree and all the major browsers do it?”
So that seems like a neat solution, right? But popular browsers including Firefox and Chrome are open sourced. So, you just branch the code, stub that part out, and release it locally and call it KazakhFox, and by the way if you don’t use KazakhFox you can’t connect to the internet. Bam.
Here’s another thing to understand. There are lots of great reasons for trust of a private root to be added to browsers. Like I might want all of the browsers inside of my enterprise firewall to have trust so that I can have my own root and have my own pages on my root using my self-signed CA and have you able to access them. They have it be secure and not in the clear and defended from attackers getting in and putting up their own false pages. Like there’s really good reasons to have this stuff.
Plus there are actually benevolent man-in-the-middle mechanisms. For instance if I have a firewall and need to be able to monitor data coming in and out to take out malware and prevent removal of data that’s not supposed to leave my firewall. If I work for a company and part of what the firewall does is it makes sure that my W-2 information isn’t being sent out, then that’s actually good for me. That’s benevolent. But how do you know when you’re building a technology platform… You can’t build into the code that this can only be used for things that are good and not things that are evil. That’s not a command that you can write.
So thankfully, a lot of the mechanisms that do the legitimate work are typically very, very well-engineered, and they have to be exactly for the reason you just said.
It’s been a good working assumption, but now all those same mechanisms basically are being used by a crafty government in a way nobody intended. And of course, one of the questions that comes up next is, “Well if this works, do we think we’re going to see other governments doing the exact same thing?”
In other words, if it roots to something that’s in the trust store already, then first of all your employees are going to feel a lot more comfortable. Secondly, the whole process is a lot easier. When we first started talking about the subject, remember CA/Browser Forum, the browsers themselves, the decision was made not to allow Kazakhstan to have a trusted third-party CA.
I'm not saying that aren’t valid reasons for this functionality because there are, but to your point, for almost all use cases there is a better way, and why don’t you use the better way instead?
While you and I are talking, I’ll throw it in just as a reminder to people because there was a Wild West day that was bad, and thankfully we’ve moved on from it, but it’s easy to make mistakes.
But in this case, you know I do agree with you. I think that a private CA on a public trusted root is just a much a cleaner approach. It solves a lot of problems and really is the thing to do.

