Re: [TLS] draft-rescorla-tls-subcerts

[Kyle Rose <[e-mail]>]

On Fri, Jul 8, 2016 at 6:09 AM, Ilari Liusvaara <[e-mail]>
wrote:

>
> There is validity start time in there, the relative end time would
> be relative to that.
>
> That is, instead of saying "this is valid from t1 to t2", saying "this
> is valid from t to t+dt".
>
> No real perference either way, it was just an experiment to play with
> time notations.
>

I think either would be fine, but once we start playing with the units
(e.g., decaseconds), we're probably likely to increase errors. The nice
thing about (t,dt) is that of the required checks:

t <= now
now <= t+dt
dt <= 7 days

the complex case (doing arithmetic on timestamps, for some value of
"complex") has a straightforward backup control with no arithmetic and with
comparison to a static value: dt <= 604800. With (t1,t2), the 7 day hard
limit is the more complex check.

That said, anyone hacking on security software probably shouldn't screw
this up in either case. I'm even struggling to imagine a system library
that could lead to unexpected errors here, given that the values are just
epoch times.

Kyle