Four of Six

On 10 November, Let’s Encrypt will start checking every domain-validation challenge from seven places instead of five: its primary datacenter plus six remote “network perspectives” (announcement, 15 Oct). The trigger is CA/Browser Forum Baseline Requirements §3.2.2.9, which from 15 December 2026 requires every publicly trusted CA to corroborate validation from at least five remote perspectives (BR 2.3.1). The announcement says more perspectives make BGP hijacks harder, but the rule’s quorum table says something narrower: with 2–5 remote perspectives one non-corroboration is allowed, and with 6 or more, two are. Boulder implements this literally; maxAllowedFailures returns 2 once perspectiveCount reaches 6 (va.go). So a hijacker who already holds the primary path has needed 2 of 3 remotes in 2020, 3 of 4 in 2024, and from November will need 4 of 6. The capture fraction goes 67%, 75%, then back to 67%. No model is needed to see what the sixth perspective buys: drop any one of the six, and the five-perspective rule still demands 4 captures, so any capture that beats five also beats six. Against hijacks it adds nothing. Against benign outages it is a large gain. If each remote fails independently 0.5% of the time, false blocks fall from 2.5×10⁻⁴ to 2.5×10⁻⁶. (Compared with the old 3-of-4 rule under independent capture probability p, the new rule is safer only when p < 0.4; at exactly 0.4 both let through 0.1792 of attacks.)

Real captures aren’t independent, which is why the quorum knob matters more than the head count. Birge-Lee et al. (USENIX Security 2021) ran 62 live BGP attacks against Let’s Encrypt. The 2-of-3 policy stopped 67% of them, and full 3-of-3 consensus stopped 94%. Cimaszewski et al. (USENIX Security 2023) modelled about a million domains and found median resilience of 88.6% for three remotes at n−1, 96.5% for the same three at full quorum, and 97.5% for two added cross-cloud perspectives at n−1. Requiring consensus was worth about as much as two new datacenters, at no cost, because two US-region perspectives on the same cloud could outvote Frankfurt. Full quorum isn’t the standard because of benign failures. Of 451 million validations sampled in September 2020, 1.2% had at least one remote disagree with the primary: DNS resolution failures 52.6%, dropped or blocked connections 24.3%, “unauthorized” responses where the server answered without the token 20.9%, internal RPC errors 2.0%.

The proposal is a typed quorum. Split non-corroborations into two kinds. Silent means no answer: resolution failure, timeout, refused connection, RPC error. Silent results count toward the allowance of two. Contradicting means the perspective reached a server that answered without the token, and any contradiction vetoes issuance. This fits the threat the BR names: in an equally-specific-prefix hijack the uncaptured perspectives are routed to the genuine server, which doesn’t hold the attacker’s token, so they don’t go quiet. They contradict. The attacker would have to capture all six, which is full-quorum security, while about 79% of 2020’s benign disagreements would still be absorbed. Cimaszewski et al. gestured at this (“distinguishing benign failure modes … may reduce the false positive rate”); the point here is to apply it at the one row of the table where it pays. The holes are real. The ~21% of benign disagreements that do contradict, mostly hosts migrating mid-DNS-propagation, would now block, though the BR already allows immediate retries. Silence can also be manufactured: if the genuine server drops port 80 or can be flooded, HTTP-01 falls back to n−2. That takes a second capability, and for DNS-01 the genuine authoritative server answers.

The test data already exists, because BR §5.4.1 requires CAs to log every quorum result. Reclassify those logs. If contradictions turn out to be more than a third of all non-corroborations, or would block more than about 0.5% of orders after one retry, the typed quorum costs too much and the table is right. My bet is that they come in near 2020’s one-fifth. My other bet is that the Forum’s next MPIC ballot will add perspectives rather than type the failures, which is the more expensive way to buy the same thing.