Re: [Trans] STH Discipline & Security Considerations
Ben Laurie <benl@google.com> Tue, 07 March 2017 18:10 UTC
Return-Path: <benl@google.com>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0B42129467 for <trans@ietfa.amsl.com>; Tue, 7 Mar 2017 10:10:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PuvVc7qpSduH for <trans@ietfa.amsl.com>; Tue, 7 Mar 2017 10:10:22 -0800 (PST)
Received: from mail-ua0-x229.google.com (mail-ua0-x229.google.com [IPv6:2607:f8b0:400c:c08::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51001129442 for <trans@ietf.org>; Tue, 7 Mar 2017 10:10:22 -0800 (PST)
Received: by mail-ua0-x229.google.com with SMTP id 72so15129284uaf.3 for <trans@ietf.org>; Tue, 07 Mar 2017 10:10:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mRddUvcLFrBmVDxxpaOBjnu/c1xZsYw6TJhJ2wJS/fE=; b=rKqLZpcE1yXY4lLVgK/BSYa0HV73YQk6wpmRtXMAFT+NhcWUVrfC9awi/d0jz0glyn QNgOFrZcfHRKXlxz8cleXPnIm2hV3Mzhkray92v0xR6yDWn5kSQ6CEkglv6x95AnjtW1 +h8xiOeIpiqi3vnxUwzXzIkOMCJ6Q4ro/C+MUbagV46Poj9hCKWPncpfIs3rMsZjPmDF wsljeObtl8Yz7y94F6NLrZmvDyFkqsLStTwkP7QZZlJY49s4XQN3fYpvi23KrDdKssDv VOHIvh0Jid1OxvGJM3anIuG46l45rBplNspBZs3/M8BRyU47MvcrgPK8P/veTS3sQcSV FsqA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mRddUvcLFrBmVDxxpaOBjnu/c1xZsYw6TJhJ2wJS/fE=; b=QynxiifmJMhT+yRscnq8KHBxdoiuOupRQdRMmy6dcEePl7+2z/3rww4pLNlMFVk033 iJZkKjgOJNwmy4ECDVub1QejZkD0YdyXoS86HL1KPqgOce1E14D/CkLF1pegaDNnTF/s 3fY6OAppcgZf+PhLKPPLLFXWW8eyJ6FvKPfVcljk3emrll9ABm45QBJ9djH3wKwfjIiB w4+/w4GssrtrPCBICxk9JGok5hJTclrU9hEpiDVAW0lMBcFSq8UGdUiSt7+r1wcrUkYo MYYvU70Wc0Kmc3opPuEL8/NvXuCtEBzo7OaLh/lx9bIwVvkz+8woAvy9tQ5s0VcXVOSc 5NwA==
X-Gm-Message-State: AMke39nkwXpkYIOdqWxAmbSdTPBw7t2aMMy+o0RW3nYot2MAdKE8Ik026+ENaOxmQD/kNyUOlw4Be2erJiIq2/2g
X-Received: by 10.31.235.6 with SMTP id j6mr885672vkh.75.1488910221071; Tue, 07 Mar 2017 10:10:21 -0800 (PST)
MIME-Version: 1.0
Received: by 10.31.174.73 with HTTP; Tue, 7 Mar 2017 10:10:20 -0800 (PST)
In-Reply-To: <20170303110950.b04152416b71a5873b74fa37@andrewayer.name>
References: <CAL02cgSr_G6HdS7f28cgBE4G_DAhnz6ios2EsTGEx==t6ONOZw@mail.gmail.com> <20170303110950.b04152416b71a5873b74fa37@andrewayer.name>
From: Ben Laurie <benl@google.com>
Date: Tue, 07 Mar 2017 18:10:20 +0000
Message-ID: <CABrd9SSeiFPZ=aTpe_LBVe4t74mHe7dqtfY1mCC-qVV0CF29yQ@mail.gmail.com>
To: Andrew Ayer <agwa@andrewayer.name>
Content-Type: multipart/alternative; boundary="94eb2c0944d6d4cf27054a27eca2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/jLpty3uMrpbr_lO9kf1apQATimk>
Cc: Richard Barnes <rlb@ipv.sx>, Trans <trans@ietf.org>
Subject: Re: [Trans] STH Discipline & Security Considerations
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Mar 2017 18:10:23 -0000
On 3 March 2017 at 19:09, Andrew Ayer <agwa@andrewayer.name> wrote: > On Fri, 3 Mar 2017 13:24:51 -0500 > Richard Barnes <rlb@ipv.sx> wrote: > > - A field in an SCT that indicates the canonical STH for the > > certificate in question. Possibly a serial number in STH that SCTs > > could refer to. > > Is this necessary? Why not define the canonical STH as the first STH > issued after the SCT (based on timestamp)? > That doesn't work - the cert may not have been included in the log by then. That said, not sure how Richard's proposal works, either - in general, the front-end that returns the SCT cannot know when the cert will be included, and hence cannot predict the relevant STH. Not entirely sure I agree with the initial premise anyway. > >
- [Trans] STH Discipline & Security Considerations Richard Barnes
- Re: [Trans] STH Discipline & Security Considerati… Andrew Ayer
- Re: [Trans] STH Discipline & Security Considerati… Richard Barnes
- Re: [Trans] STH Discipline & Security Considerati… Ben Laurie
- Re: [Trans] STH Discipline & Security Considerati… Richard Barnes
- Re: [Trans] STH Discipline & Security Considerati… Al Cutter