Re: CT-Policy (was: Comments on draft-stark-expect-ct-00)
Martin Thomson <martin.thomson@gmail.com> Thu, 24 November 2016 03:47 UTC
Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D176A12943A for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 23 Nov 2016 19:47:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.498
X-Spam-Level:
X-Spam-Status: No, score=-8.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z4m5My5By1Nj for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 23 Nov 2016 19:47:07 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2CBF129533 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 23 Nov 2016 19:47:07 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1c9kwF-0008Ot-4B for ietf-http-wg-dist@listhub.w3.org; Thu, 24 Nov 2016 03:43:07 +0000
Resent-Date: Thu, 24 Nov 2016 03:43:07 +0000
Resent-Message-Id: <E1c9kwF-0008Ot-4B@frink.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by frink.w3.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <martin.thomson@gmail.com>) id 1c9kw6-0008O4-C2 for ietf-http-wg@listhub.w3.org; Thu, 24 Nov 2016 03:42:58 +0000
Received: from mail-qt0-f170.google.com ([209.85.216.170]) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <martin.thomson@gmail.com>) id 1c9kw0-0002pG-Hr for ietf-http-wg@w3.org; Thu, 24 Nov 2016 03:42:53 +0000
Received: by mail-qt0-f170.google.com with SMTP id c47so29749347qtc.2 for <ietf-http-wg@w3.org>; Wed, 23 Nov 2016 19:42:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=dheAEDBfHekKvFk5Kmk0Ja1aZ8GdHlQZteMlPYqQ+Pc=; b=Y5hxw1oKtgQES79iCpBOg4e+s4ra24IsdOEea4L7mkfrf4QLH2yXTjBWIkugCcril/ OLtg2NYT0xS+xJPnc7QYiXs/i5yuObu6DXQyXs5flJXxvj2wTgGniqnZJ0oI52Z4HjuA dW7MFUdvaIcZOtgNWJnGz1BLU+yT6cwH4VO34Oq+lwDW+Fd61p/WrpS0RS6MxpCpNnQo OQuxkeoUrr5FfFtPTyJAGI2bQzDNMynEXqRa7GL9E+Bw6sEaw8Rd9cIebOWQ26GB8Cex s4mzJVCUbEuDfQ3+KWdCCL22579FzsMyRjOaiZ8ujCTncijmw9m/VmBH5boNR1RPn8F7 6v8g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=dheAEDBfHekKvFk5Kmk0Ja1aZ8GdHlQZteMlPYqQ+Pc=; b=LNhnDRSKqueVCkxFpKosUOETULym7EikyxRo3vgjb80dodyOAs+os3+7efPGHAw0rq 2TDdrQ86hEqDwaC9XOG03AQA9ruU8++PeRj6l3joxoFADt3Qheblw0EMrjxN5I0lidsU hkCKSYdAnBg09yWgWkf37Cbxe0XutFd1FYeUxvDsTSNycHak8B1DLjofLJ2wjONB+Ylv nIX+nMEo2AzuENrMFrXfCR9zqvcdIxMEcIXPdDCVAwiXEcVNKjm0vBdzUnTyV1w2pETB AJz0urRQ+oFt/R6o7tcJv/Z/x05Hrh6sYERRyEn1cnonVOpJKHghtOOmJ8XsoXsL14Ir YoQg==
X-Gm-Message-State: AKaTC00ybbMWnc4dxdA5mSIF6s3Elb9cfnxFdm5CR5H/lyKHbfQgrG89viuE7HlP65bmnMcx/Ecsq4+4Efnqfg==
X-Received: by 10.237.44.161 with SMTP id g30mr203507qtd.144.1479958946559; Wed, 23 Nov 2016 19:42:26 -0800 (PST)
MIME-Version: 1.0
Received: by 10.140.85.101 with HTTP; Wed, 23 Nov 2016 19:42:26 -0800 (PST)
In-Reply-To: <0514193c-a27d-4510-5c2f-caf82162bfc3@KingsMountain.com>
References: <0514193c-a27d-4510-5c2f-caf82162bfc3@KingsMountain.com>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Thu, 24 Nov 2016 14:42:26 +1100
Message-ID: <CABkgnnWhMz0pf7P55Drp1w3vVgY2w90kTPmOzQ-He1CJnnWUJQ@mail.gmail.com>
To: =JeffH <Jeff.Hodges@kingsmountain.com>
Cc: Emily Stark <estark@google.com>, IETF HTTP WG <ietf-http-wg@w3.org>, Eric Rescorla <ekr@rtfm.com>
Content-Type: text/plain; charset="UTF-8"
Received-SPF: pass client-ip=209.85.216.170; envelope-from=martin.thomson@gmail.com; helo=mail-qt0-f170.google.com
X-W3C-Hub-Spam-Status: No, score=-6.4
X-W3C-Hub-Spam-Report: AWL=0.353, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_WL=-1
X-W3C-Scan-Sig: titan.w3.org 1c9kw0-0002pG-Hr 46e19b50dcb87940b69b70f748c74e82
X-Original-To: ietf-http-wg@w3.org
Subject: Re: CT-Policy (was: Comments on draft-stark-expect-ct-00)
Archived-At: <http://www.w3.org/mid/CABkgnnWhMz0pf7P55Drp1w3vVgY2w90kTPmOzQ-He1CJnnWUJQ@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32986
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
On 24 November 2016 at 13:33, =JeffH <Jeff.Hodges@kingsmountain.com> wrote: >> Do you think it would be reasonable to reference the Chromium + >> Mozilla CT policies but not define a particular policy in a normative >> way? > > > yep :) If HSTS is our benchmark, and that benchmark is so nebulous then it's a bad one. The objection that ekr raised was fair: how do I know what baseline I have to reach in order to avoid the footgun. Maybe there are weasel words that can be used to allow browsers to choose their own logs. But can we at least write down the basics: the certificate is logged, the TLS handshake includes an SCT, etc... Surely the current set of policies indicates a common set of principles that can be written into a specification. If we're well outside 6962 territory and into policy land, at least proscribe what falls into policy. Reading the Mozilla policy, it seems like number and choice of logs might be the only places where variation is possible.
- Re: CT-Policy (was: Comments on draft-stark-expec… =JeffH
- Re: CT-Policy (was: Comments on draft-stark-expec… Emily Stark
- Re: CT-Policy (was: Comments on draft-stark-expec… =JeffH
- Re: CT-Policy (was: Comments on draft-stark-expec… Martin Thomson
- Re: CT-Policy (was: Comments on draft-stark-expec… Emily Stark
- Re: CT-Policy (was: Comments on draft-stark-expec… Martin Thomson
- CT-Policy (was: Comments on draft-stark-expect-ct… =JeffH