Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan

[Ben Laurie <[e-mail]>]

On 5 February 2014 16:51, Carl Wallace <[e-mail]> wrote:
>
> On 2/4/14, 2:41 PM, "Adam Langley" <[e-mail]> wrote:
>
>>On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley
>><[e-mail]> wrote:
>>> I do not think this is correct.  The number of proofs actually
>>>increases as you decrease validity periods.
>>
>>Consider a certificate setting out on a journey. It always needs to
>>have identity papers with it because the Browser Police are always on
>>the lookout for unregistered certificates. However, the Browser Police
>>sometimes decide that certain forms of ID are no longer acceptable and
>>so a certificate needs to carry several forms of ID with it. If it's
>>setting out on a one year journey it's wise to have two forms of ID
>>because one might become distrusted over the year, but it's
>>vanishingly unlikely that both would be.
>>
>>However, if our plucky certificate is setting out on a two year
>>journey then it's wise to carry three forms of ID just in case two
>>become useless while it's out in the world. The longer it'll be out,
>>the more forms of id it should carry to ensure that one is always
>>acceptable.
>
> This would be more clear if the section of the document that notes Chrome
> will periodically refresh the list of qualifying logs also indicated the
> list of formerly qualifying logs will also be updated.  You will need both
> lists.

Good point, I will update the document.

>
>
>
> _______________________________________________
> therightkey mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/therightkey