Re: [Trans] Proving certificate freshness

[Ben Laurie <[e-mail]>]

On 1 October 2014 04:56, David Leon Gil <[e-mail]> wrote:
> Something that is rather difficult to prove, at present, is that a
> certificate has been used after it has expired or been revoked.
>
> If servers were required to include a signature over a recent STH (or
> STH+OCSP staple) along with their SCT, this would provide an easy way
> of showing that a *server* was behaving incorrectly. E.g., as a TLS
> extension:
>
> struct {
>   STH;
>   sign(SignedCertificateTimestamp || OCSP || STH);
> } FreshnessProof;
>
> This seems rather better than signing a timestamp; the STH isn't
> predictable without a colluding log, so it isn't possible to
> "accidentally" sign a future time.
>
> Any thoughts?

Interesting idea. Note that even with a colluding log, predicting a
future STH is tricky, since the log has to include any certs it's
signed SCTs for within the MMD...