🤖 AI Summary
To address the security vulnerability in traditional certificate authorities (CAs) where private keys are prone to leakage due to human operational errors, this paper proposes a keyless certificate issuance mechanism based on Physical Unclonable Functions (PUFs). The method leverages PUF responses combined with XOR and cryptographic hashing to generate physically unclonable signature credentials, thereby eliminating private key storage and manual intervention entirely. It introduces the first integration of PUFs into the X.509v3 certificate extension field and designs a PUF transparency monitoring mechanism to establish a physically rooted, truly keyless CA signing infrastructure. Evaluated in a realistic PKI environment integrating Let’s Encrypt’s Pebble test CA and Certbot, the approach achieves 4.9%–73.7% improvement in certificate issuance computational performance, while keeping communication and storage overhead below 4%.
📝 Abstract
The signing key protection of Certificate Authorities (CAs) remains a critical challenge in PKI. Traditional approaches struggle to eliminate the risk of key exposure due to those (un)intentional human errors. This long-standing dilemma motivates us to propose Armored Core, a novel PKI security extension using the trusted binding of Physically Unclonable Function (PUF) for CAs. PUFs leverage manufacturing variations to generate unique and random responses. Combining with XOR and hash, they can make key exposure impossible for CAs through keyless certificate issuance. In Armored Core, we design a set of PUF-based X.509v3 certificate functions for CAs to generate physically trusted"signatures"without using a digital key. Moreover, we introduce a novel PUF transparency mechanism to effectively monitor the PUF operations in CAs. We integrate Armored Core into real-world PKI systems including Let's Encrypt Pebble and Certbot. We also provide a PUF-embedded hardware prototype. The evaluation results show that Armored Core can achieve keyless certificate issuance while improving the computation performance by 4.9%~73.7%. It only incurs small communication and storage overhead (<4%).