Hash-based digital signatures for hierarchical internet public key infrastructure
Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.
1. A method of electronically signing at least one internet record, the method comprising:
accessing the at least one internet record;
generating a plurality of leaf nodes, wherein at least one leaf node of the plurality of leaf nodes is generated from the at least one internet record;
constructing a hash tree from the plurality of leaf nodes, wherein the hash tree comprises a first node from the plurality of leaf nodes, a second node derived from a child node, and a root node;
providing, as a public key, data derived from the root node; and
providing, with the at least one internet record, validation data derived from the hash tree,
wherein the at least one internet record is validatable by:
using the validation data to construct at least a portion of the hash tree to obtain an accumulated hash value, and
confirming that the accumulated hash value is consistent with the public key.
2. The method of claim 1 , wherein the at least one internet record comprises the at least one Domain Name System (DNS) resource record.
3. The method of claim 2 , wherein the DNS resource record comprises one of an A resource record, an AAAA resource record, or a Delegation Signer (DS) resource record.
4. The method of claim 1 , further comprising publishing the public key with a Domain Name System Security Extensions (DNSSEC) key record.
5. The method of claim 4 , wherein the publishing comprises publishing the public key as a Zone Signing Key (ZSK).
6. The method of claim 1 , wherein the validation data comprises a signature, and wherein providing the validation data comprises providing the signature with the at least one internet record.
7. The method of claim 6 , further comprising publishing the signature with a Domain Name System Security Extensions (DNSSEC) signature record.
8. The method of claim 1 , further comprising obtaining a hash-based signature on the public key using a second hash tree.
9. The method of claim 8 , further comprising publishing the hash-based signature in a Domain Name System Security Extensions (DNSSEC) signature record.
10. The method of claim 8 , further comprising publishing data derived from a root node of the second hash tree as a Key Signing Key (KSK) in a Domain Name System Security Extensions (DNSSEC) key record.
11. The method of claim 1 , wherein the data derived from the root node comprises the root node.
12. The method of claim 1 , wherein the first node comprises a first subset of nodes of a plurality of nodes, wherein the second node comprises a second subset of nodes from the plurality of nodes, wherein the child node comprises at least one child node from the plurality of nodes.
13. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI).
14. The method of claim 1 , wherein constructing at least the portion of the hash tree using the validation data to confirm consistency with the public key comprises:
constructing at least the portion of the hash tree using the validation to obtain an accumulated value; and
confirming the accumulated value is consistent with the public key.
15. The method of claim 1 , further comprising obtaining a non-hash-based signature on the public key using a non-hash-based signature scheme involving a non-hash-based public key.
16. The method of claim 15 , further comprising publishing the non-hash-based signature in a Domain Name System Security Extensions (DNSSEC) signature record.
17. The method of claim 15 , further comprising publishing data derived from the public key of the non-hash-based signature scheme as a Key Signing Key (KSK) in a Domain Name System Security Extensions (DNSSEC) key record.
18. The method of claim 15 , wherein the non-hash-based signature scheme is a post-quantum signature scheme.
19. The method of claim 15 , wherein the non-hash-based signature scheme is a conventional signature scheme.
20. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI),
wherein the providing, as a public key, data derived from the root node is performed by a certification authority,
wherein the providing, with the at least one internet record, validation data derived from the hash tree is performed by the certification authority,
wherein the at least one internet record comprises the at least one digital certificate content,
wherein the plurality of leaf nodes comprises cryptographic hashes of the at least one digital certificate content,
wherein the public key is published as an intermediate-level certification authority public key, and
further comprising publishing a second public key for validating a signature of the public key, wherein the second public key is published as a higher-level certification authority public key.
21. The method of claim 20 , further comprising:
accessing a plurality of electronically stored Online Certificate Status Protocol (OCSP) certificate status data records;
generating a second plurality of leaf nodes from the plurality of OCSP certificate status data records;
constructing a second hash tree, wherein the second hash tree comprises the second plurality of leaf nodes, a second root node, and at least one node comprising a hash of data comprising child nodes;
deriving information sufficient to validate the second root node;
publishing, in the internet PKI and as the at least one synthesized OCSP responder public key, the information sufficient to validate the second root node; and
providing, as a signature on at least one OCSP certificate status data record of the plurality of OCSP certificate status data records, second validation data comprising sibling path data from the second hash tree, wherein the second validation data is validatable by using at least the second validation data and the synthesized OCSP responder public key,
wherein the at least one internet data record comprises the synthesized OCSP responder public key.
22. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI),
wherein the providing, as a public key, data derived from the root node is performed by an Online Certificate Status Protocol (OCSP) responder,
wherein the providing, with the at least one internet record, validation data derived from the hash tree is performed by the Online Certificate Status Protocol (OCSP) responder,
wherein the at least one internet record comprises the at least one OCSP certificate status data record,
wherein the plurality of leaf nodes comprises cryptographic hashes of the at least one OCSP certificate status data record,
wherein the public key is published as an OCSP responder public key, and
further comprising publishing a second public key for validating a signature of the public key, wherein the second public key is published as a certification authority public key.
23. The method of claim 22 , wherein the at least one OCSP certificate status data record comprises at least one multiple inconsistent status indicator.
24. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI),
wherein the providing, as a public key, data derived from the root node is performed by an identity provider,
wherein the providing, with the at least one internet record, validation data derived from the hash tree is performed by the identity provider,
wherein the at least one internet record comprises the at least one authentication assertion content,
wherein the plurality of leaf nodes comprises cryptographic hashes of the at least one authentication assertion content,
wherein the public key is published as an identity provider public key, and
further comprising publishing a second public key for validating a signature of the public key, wherein the second public key is published as an identity provider key validating key.
25. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI),
wherein the providing, as a public key, data derived from the root node is performed by a code signer,
wherein the providing, with the at least one internet record, validation data derived from the hash tree is performed by the code signer,
wherein the at least one internet record comprises the at least one software image,
wherein the plurality of leaf nodes comprises cryptographic hashes of the at least one software image,
wherein the public key is published as a code signing public key, and
further comprising publishing a second public key for validating a signature of the public key, wherein the second public key is published as a code signing key validating key.
26. The method of claim 1 , wherein the public key is a public key of an internet Public Key Infrastructure (PKI),
wherein the providing, as a public key, data derived from the root node is performed by a payment authority,
wherein the providing, with the at least one internet record, validation data derived from the hash tree is performed by the payment authority,
wherein the at least one internet record comprises the at least one payment transaction data,
wherein the plurality of leaf nodes comprises cryptographic hashes of the at least one payment transaction data,
wherein the public key is published as a payment authority public key, and
further comprising publishing a second public key for validating a signature of the public key, wherein the second public key is published as a payment authority key validating key.
27. The method of claim 1 , wherein the at least one internet record comprises at least one computer-interpretable object.
28. The method of claim 27 , wherein the at least one computer-interpretable object comprises at least one of: at least one digital certificate content, at least one synthesized Online Certificate Status Protocol (OCSP) responder public key, at least one OCSP certificate status data record, at least one authentication assertion content, at least one software image, at least one payment transaction data, and/or at least one Domain Name System (DNS) resource record.
29. The method of claim 28 , wherein the at least one software image comprises software code or a hash of software code.
30. A system for electronically signing at least one internet record, the system comprising:
at least one electronic processor programmed to perform:
accessing the at least one internet record;
generating a plurality of leaf nodes, wherein at least one leaf node of the plurality of leaf nodes is generated from the at least one internet record;
constructing a hash tree from the plurality of leaf nodes, wherein the hash tree comprises a first node from the plurality of leaf nodes, a second node derived from a child node, and a root node;
providing, as a public key, data derived from the root node; and
providing, with the at least one internet record, validation data derived from the hash tree,
wherein the at least one internet record is validatable by:
using the validation data to construct at least a portion of the hash tree to obtain an accumulated hash value, and
confirming that the accumulated hash value is consistent with the public key.