Re: [Trans] Write-up of the "Strict CT" variant

Magnus Ahltorp <map@kth.se> Thu, 25 May 2017 11:01 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Magnus Ahltorp <map@kth.se>
In-Reply-To: <CALzYgEeUCmj4BgY7uKdMnsvTcbvfAunquuqHxD7FxuzZxY1=Fg@mail.gmail.com>
Date: Thu, 25 May 2017 13:01:03 +0200
Cc: "trans@ietf.org" <trans@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <3FECD8A3-4B3E-471D-9F2D-3524A87694B6@kth.se>
References: <CALzYgEeUCmj4BgY7uKdMnsvTcbvfAunquuqHxD7FxuzZxY1=Fg@mail.gmail.com>
To: Eran Messeri <eranm@google.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/ivDTzqKY97JB-zHxN-JULo59RZg>
Subject: Re: [Trans] Write-up of the "Strict CT" variant
Precedence: list

> 23 May 2017 14:42 Eran Messeri <eranm@google.com> wrote:
> 
> *Overview*:
> 
>   - UA vendor ("auditor") periodically collects an STH (denoted "official"
>   STH [1]) from each log, distributes it to its UAs ("clients"). Clients are
>   expected to cache all STHs.
>   - CA/Site Owner ("submitter") submits (pre)certificate to the log, gets
>   SCT [2].
>   - Submitter waits until the next official STH that includes the
>   certificate, gets an inclusion proof to be served alongside the certificate
>    + SCT.
>   - In the TLS handshake, clients get certificate + SCT + inclusion proof
>   to an official STH they know about [5].
> 
> 
> The purpose of the UA vendor sending down the official STH is to provide
> third-party verification of the consensus.
> The purpose of the submitter bundling the STH + inclusion proof is to avoid
> the client having to retrieve it via some other protocol

I may have misunderstood something, but why would the STH not always be included with the inclusion proof? What is the reason for all this extra complexity (UA vendor distributing the STH, inclusion proof not self-contained)?

/Magnus

[Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Eran Messeri
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Andrew Ayer
Re: [Trans] Write-up of the "Strict CT" variant Andrew Ayer
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Tom Ritter
Re: [Trans] Write-up of the "Strict CT" variant Filippo Valsorda
Re: [Trans] Write-up of the "Strict CT" variant Jacob Hoffman-Andrews
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Magnus Ahltorp
Re: [Trans] Write-up of the "Strict CT" variant Ryan Sleevi
Re: [Trans] Write-up of the "Strict CT" variant Phillip Hallam-Baker
Re: [Trans] Write-up of the "Strict CT" variant Watson Ladd