Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
Subject: Re: [therightkey] LC comments on draft-laurie-pki-sunlight-05
From: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <CAMm+LwiCQXq9ZLMGtVQMsS8MN9HRDtjg2DqTk9B8S6A7Q38J8w@mail.gmail.com>
Date: Sat, 16 Feb 2013 10:54:32 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <72D4ABBB-9B39-41F6-9AFF-37F0A7DBDAC1@vpnc.org>
References: <CABrd9SQMAGtOTcWVaUfxRE9SZS2dZVhUa3WbJVk8or_LxH6i1w@mail.gmail.com>
 <CAMm+LwiCQXq9ZLMGtVQMsS8MN9HRDtjg2DqTk9B8S6A7Q38J8w@mail.gmail.com>
To: Phillip Hallam-Baker <hallam@gmail.com>
Cc: therightkey@ietf.org, IETF Discussion List <ietf@ietf.org>
Precedence: list

On Feb 16, 2013, at 10:22 AM, Phillip Hallam-Baker <hallam@gmail.com> =
wrote:

> Looking at the CT proposal, it seems to me that we could fix the =
business model issue and remove a lot of the CA operational issues as =
follows:
>=20
> 1) Each browser provider that is interested in enforcing a CT =
requirement stands up a meta-notary server.
>=20
> 2) Each CA runs their own notary server and this is the only resource =
that needs to have a check in at certificate issue.
>=20
> 3) Each CA notary server checkpoints to one or more meta-notary =
servers every 60 minutes. As part of the check in process it uploads the =
whole information for all the certificates issued in that time interval.
>=20
> 4) Meta-Notaries deliver tokens that assert that the CA notaries are =
current every 60 minutes. Note here that 'current' is according to the =
criteria set by the meta notary. This is an intentional piece of 'slop' =
in the system.=20
>=20
> 5) The OCSP tokens delivered by the CA contain the information =
necessary to checkpoint the certificate to the Meta-Notaries.
>=20
> 6) A browser enforcing CT disclosure pulls a list of anchor points =
from its chosen meta-notary every 60 minutes and uses them to validate =
the CT assertions delivered in certs.

Are you saying that those six items should be added to the experimental =
RFC as requirements, or are you just discussing what might happen =
operationally after the RFC is published?=20

--Paul Hoffman=