Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan

[Carl Wallace <[e-mail]>]

On 2/4/14, 2:41 PM, "Adam Langley" <[e-mail]> wrote:

>On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley
><[e-mail]> wrote:
>> I do not think this is correct.  The number of proofs actually
>>increases as you decrease validity periods.
>
>Consider a certificate setting out on a journey. It always needs to
>have identity papers with it because the Browser Police are always on
>the lookout for unregistered certificates. However, the Browser Police
>sometimes decide that certain forms of ID are no longer acceptable and
>so a certificate needs to carry several forms of ID with it. If it's
>setting out on a one year journey it's wise to have two forms of ID
>because one might become distrusted over the year, but it's
>vanishingly unlikely that both would be.
>
>However, if our plucky certificate is setting out on a two year
>journey then it's wise to carry three forms of ID just in case two
>become useless while it's out in the world. The longer it'll be out,
>the more forms of id it should carry to ensure that one is always
>acceptable.

This would be more clear if the section of the document that notes Chrome
will periodically refresh the list of qualifying logs also indicated the
list of formerly qualifying logs will also be updated.  You will need both
lists.