IETF Logo Mail Archive

Re: [Trans] Reviving Redaction

Peter Bowen <pzbowen@gmail.com> Mon, 06 March 2017 22:50 UTC

Return-Path: <pzbowen@gmail.com>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B35A2129547 for <trans@ietfa.amsl.com>; Mon, 6 Mar 2017 14:50:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OztIRB8FmMFs for <trans@ietfa.amsl.com>; Mon, 6 Mar 2017 14:50:35 -0800 (PST)
Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A12B129493 for <trans@ietf.org>; Mon, 6 Mar 2017 14:50:35 -0800 (PST)
Received: by mail-ot0-x22e.google.com with SMTP id x37so79428712ota.2 for <trans@ietf.org>; Mon, 06 Mar 2017 14:50:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PXZBTeTPKq+Ty4LUo8OtnhqCIyF4gpUZ7r1+kmuVBLo=; b=QPpKs9oGMXsYq7gozMOuUYnwT2T+bWnw8y1X7lMznbWZRxXEm6TMKpwhdyxceH4r0v 1BxhsqGxVeZylXW/Zc6wmCQ0+BOAoui6zotf6vsbQT5HgRJdrsclUOnLKJ5CFJhcekrk VvIivy9v2yzHhndg29o1Tb6yuKuKADZnoVyCcWDDsD8D2i/WwbtEQXF3RA74h82BG7id fnitoAUJqI6Qb7EBWENX/E7gsEkbntSBnENY+WEDEcE8myQP2wO7yxRS/Wp6+jjU6oj5 1RyRhmTVb+nXx20DvnOe2y0s8rOf6rKGVeuaHSkOX2dBi9HrP8VAqY6lYLyVvTZEk61r Jw/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PXZBTeTPKq+Ty4LUo8OtnhqCIyF4gpUZ7r1+kmuVBLo=; b=KBDXKxKzf1pnOjZSfcc8hdd/P5uY7iM74dXUsOH30KkB1TyED4HAdmjLs4iSmoIXlF kISRtgvXC5d3rs+h+OgxFly64mWZ3lUC0eA+N3cuMuZiMtNpEJpQhSYItRTXJWbaJ3sM tZuC3F4lVV0jYInUQtwPLGdPU8BuL0ef6zzbwAEL+tAkF29vgOYomZXzFLrZurDZ2Ngd 2U2D1DjUlrrFxkqMylGcNYnlgfL7JEsOD3YpsgD/ktM7ekktMX5ohdBpkwwkCI4aEdG0 0s3amU9brAMh44TdGrWK5SK8iJaef6jTJWJZNuFAgSs5+o5+D1nGgxmAeMkEA0jj6Jxu Xk+Q==
X-Gm-Message-State: AMke39l3ArJlkp21zyzzncv/ExiWGqxj+JXxEycro0HK/sAKrj40nRacee7FbXTMEdObiVF8BSVZcmDJwBR5TQ==
X-Received: by 10.157.82.22 with SMTP id e22mr11135576oth.76.1488840634637; Mon, 06 Mar 2017 14:50:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.157.46.116 with HTTP; Mon, 6 Mar 2017 14:50:34 -0800 (PST)
In-Reply-To: <CAErg=HE5tsuY5v8HYzhQaxS1C-D39adGogeoTtxzOqaXz2SkjQ@mail.gmail.com>
References: <CAK6vND826Sy6hH1Gf0gnP0T8dGUyRQmGe408UPp0oKgnkzfK+w@mail.gmail.com> <af9dc8c9-1ea3-1862-fb6e-0020b3ea4361@comodo.com> <CABrd9SQqdgs-DtcP830tA8wXDekguaET2y8N+3L1PqNc7NTbTQ@mail.gmail.com> <CAErg=HE5tsuY5v8HYzhQaxS1C-D39adGogeoTtxzOqaXz2SkjQ@mail.gmail.com>
From: Peter Bowen <pzbowen@gmail.com>
Date: Mon, 06 Mar 2017 14:50:34 -0800
Message-ID: <CAK6vND-m7feTNJj1+8ZnTT_MqRXLky1g9qeOxwkKLiC8PRXHOA@mail.gmail.com>
To: Ryan Sleevi <ryan-ietf@sleevi.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/yGHDB0J29i9X1S5XuBS4Nk7o9AY>
Cc: "trans@ietf.org" <trans@ietf.org>, Rob Stradling <rob.stradling@comodo.com>, Ben Laurie <benl@google.com>
Subject: Re: [Trans] Reviving Redaction
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Mar 2017 22:50:37 -0000

On Mon, Mar 6, 2017 at 1:36 PM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:
> On Mon, Mar 6, 2017 at 4:22 PM, Ben Laurie <benl@google.com> wrote:
>>
>> I think you can waste a lot of brainpower on redaction, but really the
>> answer is: if you don't want to publish your names, then don't use a
>> mechanism that requires you to. There are alternatives: name-constrained
>> sub-CAs. Private CAs. You can even have private CT to go along with them.
>> Why mess up a protocol whose intent is to show everything?
>
> Name-constrained sub-CAs have not been accepted by Chrome as a redaction
> mechanism. They were moved to the redaction spec precisely because they are
> a variation of redaction.

Yes, Ryan hit the nail on the head.  I'm trying to waste brainpower on
coming up with a plan Chrome will accept that allows named-constrained
sub-CAs not log the full details of all the certs they issue.

If Chrome had accepted logging the named-constrained CA certificate in
lieu of logging the end-entity certificate, we would be done.

Thanks,
Peter

v2.46.0 | Report a Bug | By Email | System Status