Re: [Trans] Write-up of the "Strict CT" variant

Andrew Ayer <agwa@andrewayer.name> Wed, 24 May 2017 19:41 UTC

Date: Wed, 24 May 2017 12:41:09 -0700
From: Andrew Ayer <agwa@andrewayer.name>
To: Eran Messeri <eranm@google.com>
Cc: Ryan Sleevi <ryan-ietf@sleevi.com>, "trans@ietf.org" <trans@ietf.org>
Message-Id: <20170524124109.52359e9ed92cdb5cf4be5833@andrewayer.name>
In-Reply-To: <CALzYgEfkatrhUi_vVkc3P55yd0-82OkaZcv7Sx7RytKvh4G7KA@mail.gmail.com>
References: <CALzYgEeUCmj4BgY7uKdMnsvTcbvfAunquuqHxD7FxuzZxY1=Fg@mail.gmail.com> <CAErg=HHLVyTS=PxbUWsNQpzkc+S4SS9t5Bz3KHm1oFmJiyf+dg@mail.gmail.com> <CALzYgEfkatrhUi_vVkc3P55yd0-82OkaZcv7Sx7RytKvh4G7KA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/YlMxjsJxFRVyyBdaundBDcjJ30s>
Subject: Re: [Trans] Write-up of the "Strict CT" variant
Precedence: list

On Tue, 23 May 2017 14:43:09 +0100
Eran Messeri <eranm@google.com> wrote:

> >> [6] In theory, a new certificate, with the inclusion proof embedded,
> >> could be issued - but it may run afoul of the restriction on issuing
> >> different certificates with the same serial number.
> >>
> >
> > Isn't that the whole reason 6962-bis moved to the (terrible) CMS
> > structure? :) That CAs were concerned that precerts & certs constituted two
> > logically distinct X.509 certificates? If that was to be introduced, it
> > would make sense to simply return to the critical extension, since we'd
> > have lost the main argument for using CMS :)
> >
> Yes :( I mention that as an unlikely option.
> I'd like to return to the critical extension too, the main concern brought
> against it (AFAIK) is some TLS libraries that would accept precerts as
> valid X.509 certificates.

Is that such a bad thing?  RFC6962 and RFC6962-bis are both quite clear
that a pre-certificate is a binding commitment by the CA to issue the
final certificate, and that misissuance of a pre-certificate is
equivalent to misissuance of the final certificate.  So what's the
difference between a client accepting a pre-certificate and a client
accepting the final certificate which the CA is bound to issue
anyways?  The only difference I see is that one has embedded CT
information and the other doesn't.  The pre-certificate is not
inherently untrustworthy.

CT would be simpler and more flexible if it didn't have
pre-certificates, and instead CAs were permitted to re-issue
certificates with duplicate serial numbers as long as the only change
was the addition/modification of the Transparency Information
extension.  I suggest keeping this in mind for RFC6962-bis-bis.

Regards,
Andrew

[Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Andrew Ayer
Re: [Trans] Write-up of the "Strict CT" variant Andrew Ayer
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Tom Ritter
Re: [Trans] Write-up of the "Strict CT" variant Filippo Valsorda
Re: [Trans] Write-up of the "Strict CT" variant Jacob Hoffman-Andrews
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Phillip Hallam-Baker
Re: [Trans] Write-up of the "Strict CT" variant Watson Ladd