Cryptographically-Secured Domain Validation#

Authors: Henry Birge-Lee (Princeton University), Grace H. Cimaszewski (Princeton University), Cyrill Krähenbühl (Princeton University), Liang Wang (Princeton University), Aaron Gable (Let's Encrypt), Prateek Mittal (Princeton University)

• Why: Domain control validation is the weakest link in web PKI, and it fails at exactly your intersection — routing (BGP/IP hijack of ACME challenges) meets certificate identity. The Princeton group has previously published real attacks on certificate issuance via network-level manipulation, and the Let's Encrypt co-author signals this is aimed at deployable CA-side change, not a paper-only fix.
• What: Apparently a scheme to make the domain validation step of certificate issuance cryptographically verifiable rather than trusting the network path (title/author line only — no abstract in program).
• How: Not described in the program; given the team's prior work, expect mechanisms that bind validation evidence to authenticated infrastructure or challenge exchanges so a network adversary can't satisfy a challenge they don't control.
• Where applicable: The ACME/web PKI ecosystem broadly — any CA, and by extension every TLS-terminated service. The Let's Encrypt involvement makes the deployment path unusually credible for a PETS paper.