From nobody Wed Apr 1 00:54:43 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 957E91A8A3F for ; Wed, 1 Apr 2015 00:54:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.651 X-Spam-Level: X-Spam-Status: No, score=-1.651 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YOFQz-gAG37u for ; Wed, 1 Apr 2015 00:54:40 -0700 (PDT) Received: from e-mailfilter02.sunet.se (e-mailfilter02.sunet.se [IPv6:2001:6b0:8:2::202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C56571A8A09 for ; Wed, 1 Apr 2015 00:54:39 -0700 (PDT) Received: from smtp1.nordu.net (smtp1.nordu.net [IPv6:2001:948:4:6::32]) by e-mailfilter02.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t317sZ6i001716 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 1 Apr 2015 09:54:35 +0200 Received: from kerio.nordu.net (kerio.nordu.net [109.105.110.42]) by smtp1.nordu.net (8.14.7/8.14.7) with ESMTP id t317sWwq027572 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 1 Apr 2015 07:54:34 GMT VBR-Info: md=nordu.net; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nordu.net; s=default; t=1427874875; bh=gjCUMhzDiF/uIdFdfmXMGp1m0w9lzHih4lSTXo1tnAU=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=KhKhdPngFRD+x5FNa7dHJrEecGjqBJrNPivBpTUg+w0MLBV0IV/AY1/UD1LffEavY Fgv8UqV+/2WpN2WbqBDYRK+omNvPjLDEc12E991tOKMv/xCPOjFfExJAIfuAlkyqNt 0tV+fKlU5/V202z/sZSCoSa9/6bpoY3idx7ezJYQ= X-Footer: bm9yZHUubmV0 Received: from flogsta ([193.10.5.129]) (authenticated user linus@nordu.net) by kerio.nordu.net (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)); Wed, 1 Apr 2015 09:56:50 +0200 From: Linus Nordberg To: Melinda Shore Organization: NORDUnet A/S References: <551067E8.1010201@gmail.com> Date: Wed, 01 Apr 2015 09:54:27 +0200 In-Reply-To: <551067E8.1010201@gmail.com> (Melinda Shore's message of "Mon, 23 Mar 2015 14:22:16 -0500") Message-ID: <87y4mcthak.fsf@nordberg.se> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: CanIt (www . roaringpenguin . com) X-Scanned-By: MIMEDefang 2.74 on 109.105.111.32 X-p0f-Info: os=unknown unknown, link=Ethernet or modem X-CanIt-Geo: ip=109.105.110.42; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-nordu-net:outbound (inherits from outbound-nordu-net:default, nordu-net:default, base:default) X-Canit-Stats-ID: 0aOavSzE7 - c24a316272f7 - 20150401 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter02.sunet.se: 109.105.110.42 is neither permitted nor denied by domain linus@nordu.net) receiver=e-mailfilter02.sunet.se; client-ip=109.105.110.42; envelope-from=; helo=smtp1.nordu.net; identity=mailfrom Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 07:54:42 -0000 Melinda Shore wrote Mon, 23 Mar 2015 14:22:16 -0500: | This call closes on Friday, April 10. Please review the | slides and provide an indication of whether or not you | support draft adoption. I support wg adoption of this draft. From nobody Wed Apr 1 01:59:38 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CFF31A8AD1 for ; Wed, 1 Apr 2015 01:59:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jQFJ0zGZGl1J for ; Wed, 1 Apr 2015 01:59:36 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F196E1A8AD0 for ; Wed, 1 Apr 2015 01:59:35 -0700 (PDT) Received: from localhost ([::1]:48587 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1YdEUo-0005Gy-Qq; Wed, 01 Apr 2015 01:59:34 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.3 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.3, by Edgewall Software To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, rob.stradling@comodo.com X-Trac-Project: trans Date: Wed, 01 Apr 2015 08:59:34 -0000 X-URL: http://tools.ietf.org/trans/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/trans/trac/ticket/82#comment:1 Message-ID: <073.7a4807543d1ade2b2d16e009157efc12@tools.ietf.org> References: <058.605775396b2af7a29113e5c5c8670c40@tools.ietf.org> X-Trac-Ticket-ID: 82 In-Reply-To: <058.605775396b2af7a29113e5c5c8670c40@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, rob.stradling@comodo.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Resent-To: draft-ietf-trans-rfc6962-bis@ietf.org Resent-Message-Id: <20150401085935.F196E1A8AD0@ietfa.amsl.com> Resent-Date: Wed, 1 Apr 2015 01:59:35 -0700 (PDT) Resent-From: trac+trans@tools.ietf.org Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #82 (rfc6962-bis): add integrity validation to get-entries (and fetching SCTs?) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 08:59:37 -0000 #82: add integrity validation to get-entries (and fetching SCTs?) Changes (by rob.stradling@comodo.com): * component: client-behavior => rfc6962-bis -- -------------------------+------------------------------------------------- Reporter: | Owner: draft-ietf-trans- pphaneuf@gmail.com | rfc6962-bis@tools.ietf.org Type: enhancement | Status: new Priority: major | Milestone: Component: rfc6962-bis | Version: Severity: - | Resolution: Keywords: | -------------------------+------------------------------------------------- Ticket URL: trans From nobody Wed Apr 1 07:50:46 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D18291ACCF4 for ; Wed, 1 Apr 2015 07:50:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-OH96lcXl3j for ; Wed, 1 Apr 2015 07:50:34 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C831A1ACCFC for ; Wed, 1 Apr 2015 07:50:16 -0700 (PDT) Received: from localhost ([::1]:45353 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1YdJyC-0008No-5p; Wed, 01 Apr 2015 07:50:16 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.3 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.3, by Edgewall Software To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, dkg@fifthhorseman.net X-Trac-Project: trans Date: Wed, 01 Apr 2015 14:50:16 -0000 X-URL: http://tools.ietf.org/trans/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/trans/trac/ticket/83 Message-ID: <061.2bfddb2a99fba55e98e48bb1cf4767e9@tools.ietf.org> X-Trac-Ticket-ID: 83 X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, dkg@fifthhorseman.net, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Resent-To: draft-ietf-trans-rfc6962-bis@ietf.org Resent-Message-Id: <20150401145016.C831A1ACCFC@ietfa.amsl.com> Resent-Date: Wed, 1 Apr 2015 07:50:16 -0700 (PDT) Resent-From: trac+trans@tools.ietf.org Archived-At: Cc: trans@ietf.org Subject: [Trans] [trans] #83 (rfc6962-bis): CT should mandate the use of deterministic ECDSA X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 14:50:37 -0000 #83: CT should mandate the use of deterministic ECDSA RFC:6979 describes how to do deterministic ECDSA. certificate transparency logs should be required to use this mechanism, for two reasons: * using non-deterministic ECDSA with a predictable source of randomness means that each signature can potentially leak the secret material of the signing key. * a log that produces two separate valid STHs with the same timestamp and same data but with different signatures should be considered dubious (though i don't have a concrete attack i can describe for this scenario yet) -- ensuring the use of deterministic ECDSA means that in normal operation, regular logs won't produce this behavior. -- -------------------------+------------------------------------------------- Reporter: | Owner: draft-ietf-trans- dkg@fifthhorseman.net | rfc6962-bis@tools.ietf.org Type: defect | Status: new Priority: major | Milestone: Component: rfc6962-bis | Version: Severity: - | Keywords: -------------------------+------------------------------------------------- Ticket URL: trans From nobody Wed Apr 1 07:59:30 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A97FB1ACD11 for ; Wed, 1 Apr 2015 07:59:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wwKI_fAtuvXi for ; Wed, 1 Apr 2015 07:59:26 -0700 (PDT) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 90A301A8A82 for ; Wed, 1 Apr 2015 07:59:26 -0700 (PDT) Received: from localhost (unknown [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id 7EEBE9A4055 for ; Wed, 1 Apr 2015 10:59:16 -0400 (EDT) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id 238XM380EPwK for ; Wed, 1 Apr 2015 10:58:54 -0400 (EDT) Received: from [192.168.2.100] (pool-96-255-133-185.washdc.fios.verizon.net [96.255.133.185]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 5F68A9A401B for ; Wed, 1 Apr 2015 10:58:55 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1085) From: Russ Housley In-Reply-To: <061.2bfddb2a99fba55e98e48bb1cf4767e9@tools.ietf.org> Date: Wed, 1 Apr 2015 10:58:44 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <061.2bfddb2a99fba55e98e48bb1cf4767e9@tools.ietf.org> To: trans@ietf.org X-Mailer: Apple Mail (2.1085) Archived-At: Subject: Re: [Trans] [trans] #83 (rfc6962-bis): CT should mandate the use of deterministic ECDSA X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 14:59:28 -0000 * using non-deterministic ECDSA with a predictable source of randomness means that each signature can potentially leak the secret material of = the signing key. My understanding is that the first step in generating an ECDSA signature = is to generate a random value K. The private key is disclosed if the = same K is used to produce more than one signature. The chances of = generating the same K is vanishingly small if there is a reasonable = pseudorandom source. I would hope that the servers running the logs = have a reasonable source of pseudorandom values. Russ On Apr 1, 2015, at 10:50 AM, trans issue tracker wrote: > #83: CT should mandate the use of deterministic ECDSA >=20 > RFC:6979 describes how to do deterministic ECDSA. >=20 > certificate transparency logs should be required to use this = mechanism, > for two reasons: >=20 > * using non-deterministic ECDSA with a predictable source of = randomness > means that each signature can potentially leak the secret material of = the > signing key. >=20 > * a log that produces two separate valid STHs with the same timestamp = and > same data but with different signatures should be considered dubious > (though i don't have a concrete attack i can describe for this = scenario > yet) -- ensuring the use of deterministic ECDSA means that in normal > operation, regular logs won't produce this behavior. >=20 > --=20 > = -------------------------+------------------------------------------------= - > Reporter: | Owner: draft-ietf-trans- > dkg@fifthhorseman.net | rfc6962-bis@tools.ietf.org > Type: defect | Status: new > Priority: major | Milestone: > Component: rfc6962-bis | Version: > Severity: - | Keywords: > = -------------------------+------------------------------------------------= - >=20 > Ticket URL: > trans >=20 > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans From nobody Wed Apr 1 08:31:46 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 454A61ACE3B for ; Wed, 1 Apr 2015 08:31:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYW1i5UE6xAt for ; Wed, 1 Apr 2015 08:31:40 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by ietfa.amsl.com (Postfix) with ESMTP id 5D33A1ACDD6 for ; Wed, 1 Apr 2015 08:31:40 -0700 (PDT) Received: from fifthhorseman.net (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id C6F00F984; Wed, 1 Apr 2015 11:31:37 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id 08AED2023A; Wed, 1 Apr 2015 10:31:25 -0500 (CDT) From: Daniel Kahn Gillmor To: Russ Housley , trans@ietf.org In-Reply-To: References: <061.2bfddb2a99fba55e98e48bb1cf4767e9@tools.ietf.org> User-Agent: Notmuch/0.18.2 (http://notmuchmail.org) Emacs/24.4.1 (x86_64-pc-linux-gnu) Date: Wed, 01 Apr 2015 11:31:25 -0400 Message-ID: <871tk3hnle.fsf@alice.fifthhorseman.net> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [Trans] [trans] #83 (rfc6962-bis): CT should mandate the use of deterministic ECDSA X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 15:31:44 -0000 On Wed 2015-04-01 10:58:44 -0400, Russ Housley wrote: > * using non-deterministic ECDSA with a predictable source of randomness > means that each signature can potentially leak the secret material of the > signing key. > > My understanding is that the first step in generating an ECDSA > signature is to generate a random value K. The private key is > disclosed if the same K is used to produce more than one signature. This is true. AIUI, the private key is also disclosed if an attacker can learn/predict/guess any single K used for a specific signature. > The chances of generating the same K is vanishingly small if there is > a reasonable pseudorandom source. I would hope that the servers > running the logs have a reasonable source of pseudorandom values. I'd hope so too, but there's no reason to rely on that being the case. The approach outlined in RFC 6979 avoids this risk entirely. --dkg From nobody Wed Apr 1 08:38:53 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9F121ACEC8 for ; Wed, 1 Apr 2015 08:38:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m-F3ppK5YNLL for ; Wed, 1 Apr 2015 08:38:50 -0700 (PDT) Received: from mail-wg0-x22b.google.com (mail-wg0-x22b.google.com [IPv6:2a00:1450:400c:c00::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F8D11ACDE5 for ; Wed, 1 Apr 2015 08:37:10 -0700 (PDT) Received: by wgdm6 with SMTP id m6so57685332wgd.2 for ; Wed, 01 Apr 2015 08:37:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=Ihf4gSxr/ZSDoHBN/MCMXj3hvKomG4zUyeBPGuwDETc=; b=Ul438wuJ5c4G6J+30pSMfLCFLQICAEDN5PS74sbxc8T/OPhv6J+i4Xo++Q+obp3hTB 9eDXPlaANqLK58Z1dDa9SZbOHqVSJxyqG9aq37Zev5UnswtfgoFufTsH03pbOD5E+J9h ffCjz2VWAeK0qVHdPqoaWjlmj5JX0PnGOq+27VCvS5dHoo0wCe+cX9C5zMjAuSswQKDA s2iD8gsBAH2xRj6zxt8sA5NSonrmiPgTPV1yLWmqFSFI8/aI/0bDrPTLAdrJscLY7C2M pcSDii+UR65jmVtNwjfHSUwfFq8e6Bduz0BeYIbuOeWrsjLfUAJWZ22DDqPNCCnmP4Dg rjZw== MIME-Version: 1.0 X-Received: by 10.194.9.98 with SMTP id y2mr86915115wja.85.1427902629284; Wed, 01 Apr 2015 08:37:09 -0700 (PDT) Received: by 10.194.136.233 with HTTP; Wed, 1 Apr 2015 08:37:09 -0700 (PDT) In-Reply-To: References: <061.2bfddb2a99fba55e98e48bb1cf4767e9@tools.ietf.org> Date: Wed, 1 Apr 2015 08:37:09 -0700 Message-ID: From: Watson Ladd To: Russ Housley Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] [trans] #83 (rfc6962-bis): CT should mandate the use of deterministic ECDSA X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 15:38:53 -0000 On Wed, Apr 1, 2015 at 7:58 AM, Russ Housley wrote: > * using non-deterministic ECDSA with a predictable source of randomness > means that each signature can potentially leak the secret material of the > signing key. > > My understanding is that the first step in generating an ECDSA signature = is to generate a random value K. The private key is disclosed if the same = K is used to produce more than one signature. The chances of generating th= e same K is vanishingly small if there is a reasonable pseudorandom source.= I would hope that the servers running the logs have a reasonable source o= f pseudorandom values. So these servers wouldn't be running Debian, would they? Or Freebsd pre-release versions? In fact, secret keys can be revealed via slight biases or a few leaked bits of k over multiple signatures. Sincerely, Watson Ladd > > Russ > > > On Apr 1, 2015, at 10:50 AM, trans issue tracker wrote: > >> #83: CT should mandate the use of deterministic ECDSA >> >> RFC:6979 describes how to do deterministic ECDSA. >> >> certificate transparency logs should be required to use this mechanism, >> for two reasons: >> >> * using non-deterministic ECDSA with a predictable source of randomness >> means that each signature can potentially leak the secret material of th= e >> signing key. >> >> * a log that produces two separate valid STHs with the same timestamp a= nd >> same data but with different signatures should be considered dubious >> (though i don't have a concrete attack i can describe for this scenario >> yet) -- ensuring the use of deterministic ECDSA means that in normal >> operation, regular logs won't produce this behavior. >> >> -- >> -------------------------+----------------------------------------------= --- >> Reporter: | Owner: draft-ietf-trans- >> dkg@fifthhorseman.net | rfc6962-bis@tools.ietf.org >> Type: defect | Status: new >> Priority: major | Milestone: >> Component: rfc6962-bis | Version: >> Severity: - | Keywords: >> -------------------------+----------------------------------------------= --- >> >> Ticket URL: >> trans >> >> _______________________________________________ >> Trans mailing list >> Trans@ietf.org >> https://www.ietf.org/mailman/listinfo/trans > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans --=20 "Those who would give up Essential Liberty to purchase a little Temporary Safety deserve neither Liberty nor Safety." -- Benjamin Franklin From nobody Wed Apr 1 09:21:00 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C81011AD065 for ; Wed, 1 Apr 2015 09:20:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tJ1lpturgVvZ for ; Wed, 1 Apr 2015 09:20:57 -0700 (PDT) Received: from ecl1mtaoutpex01.symantec.com (ecl1mtaoutpex01.symantec.com [166.98.1.209]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48F6B1AD0A6 for ; Wed, 1 Apr 2015 09:20:53 -0700 (PDT) X-AuditID: a66201d1-f790d6d00000461a-da-551c1ae3b498 Received: from tus1smtintpin02.ges.symantec.com (tus1smtintpin02.ges.symantec.com [192.168.215.102]) by ecl1mtaoutpex01.symantec.com (Symantec Brightmail Gateway out) with SMTP id 57.09.17946.3EA1C155; Wed, 1 Apr 2015 16:20:52 +0000 (GMT) Received: from [155.64.220.139] (helo=TUS1XCHHUBPIN03.SYMC.SYMANTEC.COM) by tus1smtintpin02.ges.symantec.com with esmtp (Exim 4.76) (envelope-from ) id 1YdLNr-0007xX-N5; Wed, 01 Apr 2015 16:20:51 +0000 Received: from TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM ([155.64.220.146]) by TUS1XCHHUBPIN03.SYMC.SYMANTEC.COM ([155.64.220.139]) with mapi; Wed, 1 Apr 2015 09:20:51 -0700 From: Rick Andrews To: Melinda Shore , "trans@ietf.org" Date: Wed, 1 Apr 2015 09:20:50 -0700 Thread-Topic: [Trans] Poll for adoption of working group draft on threat analysis for CT Thread-Index: AdBlntMi8zIgramJTnqIH3pg0sW+8wG+Oq5Q Message-ID: <544B0DD62A64C1448B2DA253C01141460BD6B9950B@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> References: <551067E8.1010201@gmail.com> In-Reply-To: <551067E8.1010201@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnkeLIzCtJLcpLzFFi42I5sOJ6mu4TKZlQg+YVnBZtbbNYLNY+vsji wOSxc9Zddo8lS34yBTBFcdmkpOZklqUW6dslcGW0NbxgLHjBVtF55gFrA+Ml1i5GTg4JAROJ ps+/2CFsMYkL99azgdhCAh8ZJXr2iXUxcgHZrxglfi8+xwbhrGSUeH53KVgVm4CexJbHV8C6 RQT8JLovP2IGsVkEVCROftsGFhcWiJSY1necBaImSuL2kleMELaRxPFvj4FqODh4geIHG4Ig FmtI7Jj2AqyVU0BT4sKE22CtjEDHfT+1hgnEZhYQl7j1ZD4TxNECEkv2nGeGsEUlXj7+xwpR Lypxp309I0S9jsSC3Z/YIGxtiWULX4PV8woISpyc+YRlAqPYLCRjZyFpmYWkZRaSlgWMLKsY ZVKTcwxzSxLzS0sKUisMDPWKK3MTgZGUrJecn7uJERhNy5IYL+5gvHBY9xCjAAejEg+vFK9M qBBrYhlQ5SFGCQ5mJRFeSRGgEG9KYmVValF+fFFpTmrxIUZpDhYlcd5HnaKhQgLpiSWp2amp BalFMFkmDk6pBsZmUTWnnekRiUrsUw6+4i/yVJM+8dfgupCr5PJJSYk/Y7/V6DDMuOr+5o6M Lp/YKZbadYxpeknli/R37bVb6Jd6OODYnTn8x6609KcvvSm8ZnLnNz2zrElqe7Mlg00Cdn8u LrYPevQrk/XS6w9sfJfU36nPeHP+3C7hvJhl/3SLugMU/d8nuiuxFGckGmoxFxUnAgCL/ty7 ogIAAA== Archived-At: Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 16:20:59 -0000 I support adoption of the threat analysis as a wg item. -----Original Message----- From: Trans [mailto:trans-bounces@ietf.org] On Behalf Of Melinda Shore Sent: Monday, March 23, 2015 12:22 PM To: trans@ietf.org Subject: [Trans] Poll for adoption of working group draft on threat analysi= s for CT Hi, all: This is a call for adoption of a working group deliverable providing a thre= at analysis for CT, based on the summary provided by http://www.ietf.org/pr= oceedings/92/slides/slides-92-trans-0.pdf and on previous discussion on this mailing list. This call closes on Friday, April 10. Please review the slides and provide= an indication of whether or not you support draft adoption. Thanks, Melinda & Paul _______________________________________________ Trans mailing list Trans@ietf.org https://www.ietf.org/mailman/listinfo/trans From nobody Wed Apr 1 10:36:02 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3D3D1A19F0 for ; Wed, 1 Apr 2015 10:36:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hu4thbZs4aR8 for ; Wed, 1 Apr 2015 10:36:00 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67E8B1A06FD for ; Wed, 1 Apr 2015 10:36:00 -0700 (PDT) Received: from dhcp89-089-172.bbn.com ([128.89.89.172]:51402) by smtp.bbn.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1YdMYX-000LkH-FE for trans@ietf.org; Wed, 01 Apr 2015 13:35:57 -0400 Message-ID: <551C2C7E.2090900@bbn.com> Date: Wed, 01 Apr 2015 13:35:58 -0400 From: Karen Seo User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: trans@ietf.org References: <551067E8.1010201@gmail.com> In-Reply-To: <551067E8.1010201@gmail.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 17:36:01 -0000 +1 to adopt On 3/23/15 3:22 PM, Melinda Shore wrote: > Hi, all: > > This is a call for adoption of a working group deliverable > providing a threat analysis for CT, based on the summary > provided by > http://www.ietf.org/proceedings/92/slides/slides-92-trans-0.pdf > and on previous discussion on this mailing list. > > This call closes on Friday, April 10. Please review the > slides and provide an indication of whether or not you > support draft adoption. > > Thanks, > > Melinda & Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Wed Apr 1 12:01:19 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7DA21A8A8B for ; Wed, 1 Apr 2015 12:01:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aO6lKLjIRdQF for ; Wed, 1 Apr 2015 12:01:17 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 457261A9046 for ; Wed, 1 Apr 2015 12:00:49 -0700 (PDT) Received: from localhost ([::1]:35962 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1YdNsb-0005s6-0g; Wed, 01 Apr 2015 12:00:45 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.3 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.3, by Edgewall Software To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, rob.stradling@comodo.com, eranm@google.com X-Trac-Project: trans Date: Wed, 01 Apr 2015 19:00:44 -0000 X-URL: http://tools.ietf.org/trans/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/trans/trac/ticket/82#comment:2 Message-ID: <073.7d8fd20c01aad3caea0692eb85197180@tools.ietf.org> References: <058.605775396b2af7a29113e5c5c8670c40@tools.ietf.org> X-Trac-Ticket-ID: 82 In-Reply-To: <058.605775396b2af7a29113e5c5c8670c40@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: draft-ietf-trans-rfc6962-bis@tools.ietf.org, rob.stradling@comodo.com, eranm@google.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Resent-To: draft-ietf-trans-rfc6962-bis@ietf.org Resent-Message-Id: <20150401190049.457261A9046@ietfa.amsl.com> Resent-Date: Wed, 1 Apr 2015 12:00:49 -0700 (PDT) Resent-From: trac+trans@tools.ietf.org Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #82 (rfc6962-bis): add integrity validation to get-entries (and fetching SCTs?) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 19:01:18 -0000 #82: add integrity validation to get-entries (and fetching SCTs?) Comment (by eranm@google.com): SGTM - providing the SCTs together with entries in the get-entries response would enable efficient mirroring of logs and integrity checking of returned entries (although not for truncated responses). It seems most suitable to encapsulate the entire output of add-chain/add- pre-chain in an additional field for each entry returned by get-entries (named 'sct'). -- -------------------------+------------------------------------------------- Reporter: | Owner: draft-ietf-trans- pphaneuf@gmail.com | rfc6962-bis@tools.ietf.org Type: enhancement | Status: new Priority: major | Milestone: Component: rfc6962-bis | Version: Severity: - | Resolution: Keywords: | -------------------------+------------------------------------------------- Ticket URL: trans From nobody Wed Apr 1 12:44:35 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 375B01A872F for ; Wed, 1 Apr 2015 12:44:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ow0A54oIaYby for ; Wed, 1 Apr 2015 12:44:32 -0700 (PDT) Received: from mail-pa0-x22c.google.com (mail-pa0-x22c.google.com [IPv6:2607:f8b0:400e:c03::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A82881A1A66 for ; Wed, 1 Apr 2015 12:44:32 -0700 (PDT) Received: by pactp5 with SMTP id tp5so61218315pac.1 for ; Wed, 01 Apr 2015 12:44:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=04H9zwuGMqGUHmNecGdR7dsloASaL7Pcs/OjFub7x+M=; b=PI02qtk5PUtF9d4MU679jYemGVMUcz36ijKA5iXpSCYGJQ53o5hkj9hjIbs8sbnXU9 ES1MF/Iw1Sv06idftrBdua0/Wd7XLb2MH0tsBcc1EaLZffFKrjK62neX9nn2iqYEOF+E O80g9xMAib+/aScdB04rwTEkXzCqzMzadJe1YPfsEUjTYcE5PQuAOws9tt0B7tenNf/H iJ9iGSXHNgqRv6X1zPZG+SQlE8AEMAsoUwvDV85c01D+dtP37VntqLDDVwJl6+k4PtIP DjHNfkzagH2dNri6ev50hXZg4i/UGVvlT/lH3oXLHPg4XDJibQC+pOFq6pF6jmDfhwqE 8HkQ== X-Received: by 10.70.98.139 with SMTP id ei11mr80312638pdb.3.1427917472260; Wed, 01 Apr 2015 12:44:32 -0700 (PDT) Received: from spandex.local (209-112-223-242-rb1.sol.dsl.dynamic.acsalaska.net. [209.112.223.242]) by mx.google.com with ESMTPSA id cz10sm2950610pdb.9.2015.04.01.12.44.30 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 01 Apr 2015 12:44:31 -0700 (PDT) Message-ID: <551C4A9D.3000003@gmail.com> Date: Wed, 01 Apr 2015 11:44:29 -0800 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: "trans@ietf.org" References: <8B8C515B-3D14-4D17-AAD3-72A0EFF99E0D@iab.org> In-Reply-To: <8B8C515B-3D14-4D17-AAD3-72A0EFF99E0D@iab.org> X-Forwarded-Message-Id: <8B8C515B-3D14-4D17-AAD3-72A0EFF99E0D@iab.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Trans] Fwd: Date change for CARIS submissions X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 19:44:34 -0000 FYI. Melinda -------- Original Message -------- Subject: Date change for CARIS submissions Date: Wed, 1 Apr 2015 15:17:04 -0400 From: IAB Chair Reply-To: ietf@ietf.org To: ietf list , ietf@ietf.org Dear colleagues, The Co-ordinating Attack Response at Internet Scale (CARIS) workshop program committee is extending the deadline for submissions by one week, to 10 April 2015. The call for papers is available from https://www.iab.org/activities/workshops/caris/call-for-papers/. For more information on CARIS, please see https://www.iab.org/activities/workshops/caris/. Best regards, Andrew Sullivan IAB Chair From nobody Wed Apr 1 13:47:38 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E01D31A7011 for ; Wed, 1 Apr 2015 13:47:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X10Em9nN9yUr for ; Wed, 1 Apr 2015 13:47:35 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 666B41A0060 for ; Wed, 1 Apr 2015 13:47:35 -0700 (PDT) Received: from dhcp89-089-172.bbn.com ([128.89.89.172]:55704) by smtp.bbn.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1YdPXy-0005XQ-68 for trans@ietf.org; Wed, 01 Apr 2015 16:47:34 -0400 Message-ID: <551C5968.4090903@bbn.com> Date: Wed, 01 Apr 2015 16:47:36 -0400 From: Karen Seo User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: trans@ietf.org References: <551067E8.1010201@gmail.com> <551C2C7E.2090900@bbn.com> In-Reply-To: <551C2C7E.2090900@bbn.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 20:47:37 -0000 Sorry for redundant vote -- looked for my earlier vote and somehow missed it. On 4/1/15 1:35 PM, Karen Seo wrote: > +1 to adopt > > On 3/23/15 3:22 PM, Melinda Shore wrote: >> Hi, all: >> >> This is a call for adoption of a working group deliverable >> providing a threat analysis for CT, based on the summary >> provided by >> http://www.ietf.org/proceedings/92/slides/slides-92-trans-0.pdf >> and on previous discussion on this mailing list. >> >> This call closes on Friday, April 10. Please review the >> slides and provide an indication of whether or not you >> support draft adoption. >> >> Thanks, >> >> Melinda & Paul >> >> _______________________________________________ >> Trans mailing list >> Trans@ietf.org >> https://www.ietf.org/mailman/listinfo/trans >> > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans From nobody Wed Apr 1 13:56:24 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCD4F1ABC75 for ; Wed, 1 Apr 2015 13:56:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rc3AowjzA694 for ; Wed, 1 Apr 2015 13:56:21 -0700 (PDT) Received: from mail-pa0-x232.google.com (mail-pa0-x232.google.com [IPv6:2607:f8b0:400e:c03::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76B7A1A9244 for ; Wed, 1 Apr 2015 13:56:21 -0700 (PDT) Received: by patj18 with SMTP id j18so62903513pat.2 for ; Wed, 01 Apr 2015 13:56:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=MkNjNIrBp1dUKVt3P4rLTeG80Rlht9v5KW8LBtOWOPc=; b=Cy419mqoo8R2HKvaMUoZcpA6YmNFmbTe/c5xKWETWe5ItERn03Poa86Jng7svZKPCq mNpdP2jcse5zPavtM+K94GMrwkSFJz66osA9alU+ZqLvAyFTWN80WTgVvIpfWuVGFVi/ VwOK9f9KzoSW1YPZlmObHFZW9Wr1gTwkI/e2grW4dpLX0kEm6kCELe8AND9zc34BSlTO 6Hb6b3ZmjFwBZC2OATZqKXeqDuxbwxIkTQeOkCE4bCi5jsEouRwO038ne+6xF2cngzIA CtHI0GRJVNnyT14jj4ZSbcctnmsmAqUAbEeD2/DquV8FNBp04bWp6XzlrJrIzn69A9gx c4og== X-Received: by 10.66.240.33 with SMTP id vx1mr81022673pac.112.1427921781120; Wed, 01 Apr 2015 13:56:21 -0700 (PDT) Received: from spandex.local (209-112-223-242-rb1.sol.dsl.dynamic.acsalaska.net. [209.112.223.242]) by mx.google.com with ESMTPSA id j2sm3028198pdn.44.2015.04.01.13.56.20 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 01 Apr 2015 13:56:20 -0700 (PDT) Message-ID: <551C5B72.7030506@gmail.com> Date: Wed, 01 Apr 2015 12:56:18 -0800 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: trans@ietf.org References: <551067E8.1010201@gmail.com> <551C2C7E.2090900@bbn.com> <551C5968.4090903@bbn.com> In-Reply-To: <551C5968.4090903@bbn.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 20:56:22 -0000 On 4/1/15 12:47 PM, Karen Seo wrote: > Sorry for redundant vote -- looked for my earlier vote and somehow > missed it. That's okay. We don't count "votes" - we look for consensus and at any discussion that's taken place around adoption, so no apology (or adjustment) necessary. Melinda From nobody Wed Apr 1 14:01:02 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ADB81A913E for ; Wed, 1 Apr 2015 14:01:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.389 X-Spam-Level: X-Spam-Status: No, score=-1.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqgiEsm_9k24 for ; Wed, 1 Apr 2015 14:01:00 -0700 (PDT) Received: from mail-qg0-x22e.google.com (mail-qg0-x22e.google.com [IPv6:2607:f8b0:400d:c04::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 365FA1AC39A for ; Wed, 1 Apr 2015 14:00:54 -0700 (PDT) Received: by qgfa8 with SMTP id a8so54165487qgf.0 for ; Wed, 01 Apr 2015 14:00:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=MZpQQVYw00O/kvPuCBcDgfrqiXuXGWpeECYrgVZAqq0=; b=jVIz9paM3g2s3w6FbDOQ6kvieKUUcmdzasoCCK+wmlIk35ZoOZaQIouYW0afNsE6qe vLv/u+pSvvUPMKF5SYn+YPqk3eCmK8tIzrWF3DCXSW+oNWRCH0Mem4Tu0ZUEzEFX/nFg rycpn7VO7buj/HLuWCEdUja0jK713KM+3QupbSG+VYTcCnyavfcx6ciHAY+XF08PEWmC hZ6P/oewWXVKlRwY30N1m65fab6nVRxhVaepBY/KG5moI1qGweTYL7soHuASpXkC0coY MlsiIgFCIAEFGRuyQaBHMPpaIhqJquYqQTshREI3B1rOhHNkB64xlxqJFc8Z+3QL2tRJ /AmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=MZpQQVYw00O/kvPuCBcDgfrqiXuXGWpeECYrgVZAqq0=; b=coxuV/adQJMr+azlvqkMQd0wV7YZ7qaakg5XZM+ajLj80La4vqyEtCb/h29PKf2az6 kNaSsY6cZUUImsEw/hcb+jsiSTyF5qFU/SB0JUeHjzxZ+xz82MMpOUzH7r/jFKjvSZS2 eFJFCUObzA2RuSm4ScIzzzebysTB0ok4gcEjRquaG+1SD2FhJCeCKo+0IajvhaVDsjCu Ul7J5uhHyON3D6xFd69Mdt35zGZfepClFGVxkNWJI94YgzApsOVfy/mj4KxY3hOzzvtz 6FqA/XdzANz1bGviVwxZF5Nh2LOTFF01H7Ed7mt7hdPKbOjCz2y2bWYzZLcaPC7LeKzX QxYg== X-Gm-Message-State: ALoCoQm7Gdpb28t6rizRhQK9kt2QtArAfMyhW3VBNlKUlyUD9a/A8mx5TqoDC9jFO5Oi5R+DsLMb MIME-Version: 1.0 X-Received: by 10.55.52.83 with SMTP id b80mr94262661qka.36.1427922053452; Wed, 01 Apr 2015 14:00:53 -0700 (PDT) Received: by 10.229.178.135 with HTTP; Wed, 1 Apr 2015 14:00:53 -0700 (PDT) In-Reply-To: <551067E8.1010201@gmail.com> References: <551067E8.1010201@gmail.com> Date: Wed, 1 Apr 2015 22:00:53 +0100 Message-ID: From: Ben Laurie To: Melinda Shore Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 21:01:01 -0000 On 23 March 2015 at 19:22, Melinda Shore wrote: > Hi, all: > > This is a call for adoption of a working group deliverable > providing a threat analysis for CT, based on the summary > provided by http://www.ietf.org/proceedings/92/slides/slides-92-trans-0.pdf > and on previous discussion on this mailing list. > > This call closes on Friday, April 10. Please review the > slides and provide an indication of whether or not you > support draft adoption. +1 > > Thanks, > > Melinda & Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans From nobody Wed Apr 1 14:47:03 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F41C31A86F5 for ; Wed, 1 Apr 2015 14:47:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9TI2cj-oPT0M for ; Wed, 1 Apr 2015 14:47:00 -0700 (PDT) Received: from mail-wi0-f173.google.com (mail-wi0-f173.google.com [209.85.212.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B25D1A8707 for ; Wed, 1 Apr 2015 14:47:00 -0700 (PDT) Received: by widdi4 with SMTP id di4so59466451wid.0 for ; Wed, 01 Apr 2015 14:46:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=7p/dQz8HPcjtrAF+w8TGQA+K7l8fnRAPhOqTSinfLMk=; b=D1CimJ37s3i2pXWGZQdFt2Y/jZDKrGD8/mrm9EhPmk/qW6m2x8x8+zzrVv9BCtZCyC qlkgfls+YC1ESBOQgK0kruPS3uAxw9ZOGOAj/CY4kBX8Y8MKbGU3gEyXdANaKCC2oxKD 7IdjfVpjichdDX14wVcnDPETId/EsVUYpXVwIp283I1mziL9NrJFg+QVsOr9zg90m+TC 0ENLObu6bUzNRYylGaUVEt3YjGAhGr5WipL42Y33HtC9b5ZnJ1ceJbgst3ViaKBBrWvw MfYICN88V284KvJUsGfku7NlysgP4jj4vG1cJluFwGP3H4Goi0lG2IbE2nbsm6E3wim2 +kqw== X-Gm-Message-State: ALoCoQligXWux5kMuXeNvHzU1APAVap6hc6JC3sBtM/cEVqHwOKmd1v1Bh9cBsLd6HBO9aIvgHel MIME-Version: 1.0 X-Received: by 10.194.63.16 with SMTP id c16mr89111430wjs.117.1427924818960; Wed, 01 Apr 2015 14:46:58 -0700 (PDT) Received: by 10.194.110.97 with HTTP; Wed, 1 Apr 2015 14:46:58 -0700 (PDT) In-Reply-To: <87y4mcthak.fsf@nordberg.se> References: <551067E8.1010201@gmail.com> <87y4mcthak.fsf@nordberg.se> Date: Wed, 1 Apr 2015 17:46:58 -0400 Message-ID: From: Warren Kumari To: Linus Nordberg Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Melinda Shore , "trans@ietf.org" Subject: Re: [Trans] Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 21:47:02 -0000 Me too! On Wed, Apr 1, 2015 at 3:54 AM, Linus Nordberg wrote: > Melinda Shore wrote > Mon, 23 Mar 2015 14:22:16 -0500: > > | This call closes on Friday, April 10. Please review the > | slides and provide an indication of whether or not you > | support draft adoption. > > I support wg adoption of this draft. > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf From nobody Thu Apr 2 12:22:21 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0FA11A1B8B for ; Thu, 2 Apr 2015 12:22:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Td9K0WvUzrXD for ; Thu, 2 Apr 2015 12:22:17 -0700 (PDT) Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2F3B1B2D88 for ; Thu, 2 Apr 2015 12:21:44 -0700 (PDT) Received: by obvd1 with SMTP id d1so144467720obv.0 for ; Thu, 02 Apr 2015 12:21:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to:content-type; bh=6UXOGx+Gb8VASjv5lERsHeTKOu54KFnxgP4ARnm2h1Y=; b=xzPtcacXeDihN2gUCbPuRLb9LRh9pJfI3Z9m7l3njPO1oToA6nulPAYSdBVZUHgxe9 9QhxH0XQXr25iVuPTg+6sagCFgY9KoDG4k5ozdI53nUO5sOl8E7esluNbvy2/DlGRy58 sxuxcMdmTn4AzsG+IPTCy5vcyWU6cLhaxFrw3bjBdq7YESkxdbMDVvd/QZkRb4qCLi9s QvpgUEUUj2ClX6jFClYNQTtK03GewaVnORK+m4ITwSomcXVsZJj+WF10rX6ftld2E3Lu tJSHuC0RgEEzps91MYxORSc99g+LLvuOSbAKUOWbLMTqj8XIiaVPChF02BkoaiFRl714 8TUA== X-Received: by 10.182.74.166 with SMTP id u6mr48659406obv.68.1428002504426; Thu, 02 Apr 2015 12:21:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.166.232 with HTTP; Thu, 2 Apr 2015 12:21:22 -0700 (PDT) From: Tony Arcieri Date: Thu, 2 Apr 2015 12:21:22 -0700 Message-ID: To: trans@ietf.org Content-Type: multipart/alternative; boundary=001a11c1f23203ccff0512c2be6a Archived-At: Subject: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 19:22:19 -0000 --001a11c1f23203ccff0512c2be6a Content-Type: text/plain; charset=UTF-8 Please let me know if it's way too early to consider this, but... We run many in-house CA services, and I thought it would be interesting if they all reported to an in-house CT log each time they signed a CSR which we could use for record-keeping and auditing purposes. I saw Google has the appropriate client code to do this (ostensibly hardcoded to report to Google's CT log), however AFAIK that log implementation isn't open source. Are there any open source ones worth using? Are changes to the specification happening so quickly that this isn't advisable yet? -- Tony Arcieri --001a11c1f23203ccff0512c2be6a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Please let me know if it's way too early to consider t= his, but...

We run many in-house CA services, and I thou= ght it would be interesting if they all reported to an in-house CT log each= time they signed a CSR which we could use for record-keeping and auditing = purposes.

I saw Google has the appropriate client = code to do this (ostensibly hardcoded to report to Google's CT log), ho= wever AFAIK that log implementation isn't open source.

Are there any open source ones worth using? Are changes to the spe= cification happening so quickly that this isn't advisable yet?

--
Tony Arcieri<= br>
--001a11c1f23203ccff0512c2be6a-- From nobody Thu Apr 2 12:41:00 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61BB71A0103 for ; Thu, 2 Apr 2015 12:40:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.389 X-Spam-Level: X-Spam-Status: No, score=-1.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iEiGxrCzpwbV for ; Thu, 2 Apr 2015 12:40:58 -0700 (PDT) Received: from mail-qg0-x236.google.com (mail-qg0-x236.google.com [IPv6:2607:f8b0:400d:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 372471A00FD for ; Thu, 2 Apr 2015 12:40:58 -0700 (PDT) Received: by qgep97 with SMTP id p97so78353859qge.1 for ; Thu, 02 Apr 2015 12:40:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=EHS0NEsGlvnGhzIp0ev3kK1w3eWgbXhIuxYQlkxsNg0=; b=k4nVcQlsMhzP1dBm9dWdep/YnW+viRC6RRdd65rnK62Uye7TblQrw7al5BxfcRrQTS w2fsKtXlJolBzWhyq4lN4I4q7emOQRjNy2FaCD2UUwoUyiy9953De591oj+E6/VMRe3D 0btNbdgI4zpdkcnoo/dxGmbiql6uCjE791pOIrjr4uLqF9gX//EplvwnVBb2ZbTtHOob GmB5hLZ0x57EM5mPA95cUb6XKwbcT3L8xnF71TxkPG0f8+M9MMNTDzz2X1zQrA8hk7xn zt/EqusbmR3jjCHEbRNaGDdnXITMAF7WmB5K+dTqgxwaetGo5Za+NVlpLrcM4J1FoIsn oBrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=EHS0NEsGlvnGhzIp0ev3kK1w3eWgbXhIuxYQlkxsNg0=; b=k714LC3fvFUiKyy0OHj3EDSQ8y5Q7KJEJuGYACGy8c2j7T18uQLj5/83h53m9/u9d2 KVidNLyiZgvtorr2WviMHvLNphvC4nElozgQiluqnIyPRAqV1vePAYj3NdZ9RbXfpY59 pz5AFRG5yzFRdbtMBtQljIQO4bkDQFbx+NCGGqX1R23f0/QKArC/Cru3jZ8Eb7J0grc9 fJJeVmpGZN+WE71FDkRAl4PBOx4CvG6/cl/vcPX/ZZ3kVVBnIUUnpumEJ0m2nkYir8Ag qvUdWtMfsZ5UmLT6QD3QGDSZIrZFPgTSabCLsfVeFt/n8YCmgZ9oGbmuqqhZico6wT64 3O4g== X-Gm-Message-State: ALoCoQlKDje/AU0occASlhR3F3TbHCvOMzg9HkAM4JnE6xbudHhlPp68PBASwSMj6zUiJDihx3Wu MIME-Version: 1.0 X-Received: by 10.140.92.51 with SMTP id a48mr15396747qge.30.1428003657442; Thu, 02 Apr 2015 12:40:57 -0700 (PDT) Received: by 10.229.178.135 with HTTP; Thu, 2 Apr 2015 12:40:57 -0700 (PDT) In-Reply-To: References: Date: Thu, 2 Apr 2015 20:40:57 +0100 Message-ID: From: Ben Laurie To: Tony Arcieri Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 19:40:59 -0000 On 2 April 2015 at 20:21, Tony Arcieri wrote: > Please let me know if it's way too early to consider this, but... > > We run many in-house CA services, and I thought it would be interesting if > they all reported to an in-house CT log each time they signed a CSR which we > could use for record-keeping and auditing purposes. > > I saw Google has the appropriate client code to do this (ostensibly > hardcoded to report to Google's CT log), however AFAIK that log > implementation isn't open source. What implementation do you mean? We have: https://github.com/google/certificate-transparency which implements both client and server and is open source. > Are there any open source ones worth using? Are changes to the specification > happening so quickly that this isn't advisable yet? > > -- > Tony Arcieri > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Thu Apr 2 12:53:48 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 882421A026A for ; Thu, 2 Apr 2015 12:53:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.259 X-Spam-Level: X-Spam-Status: No, score=-2.259 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CJNhsv-DVDvn for ; Thu, 2 Apr 2015 12:53:45 -0700 (PDT) Received: from mail.primekey.se (mail.primekey.se [213.179.18.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20AC21A0242 for ; Thu, 2 Apr 2015 12:53:45 -0700 (PDT) Received: from mail.primekey.se (localhost [127.0.0.1]) by mail.primekey.se (Postfix) with ESMTP id 9AC8E45C0081; Thu, 2 Apr 2015 21:53:42 +0200 (CEST) Received: from android-44415d29ec552778 (h-24-169.a328.priv.bahnhof.se [46.59.24.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.primekey.se (Postfix) with ESMTPSA id 855CB45C007F; Thu, 2 Apr 2015 21:53:42 +0200 (CEST) User-Agent: K-9 Mail for Android In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----SJ301IP3C7KLC4L2VDUXSLQ4P7VZFH" Content-Transfer-Encoding: 8bit From: Tomas Gustavsson Date: Thu, 02 Apr 2015 21:53:40 +0200 To: Tony Arcieri ,trans@ietf.org Message-ID: <1D856710-22C5-462E-8690-B2EA874F457B@primekey.se> X-Virus-Scanned: ClamAV using ClamSMTP Archived-At: Subject: Re: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 19:53:47 -0000 ------SJ301IP3C7KLC4L2VDUXSLQ4P7VZFH Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 We use the Google open source code to set up a test CT server when testing EJBCA, and of course the client code to submit. I don't see any obstacles to running this in-house? Cheers, Tomas On April 2, 2015 9:21:22 PM GMT+02:00, Tony Arcieri wrote: >Please let me know if it's way too early to consider this, but... > >We run many in-house CA services, and I thought it would be interesting >if >they all reported to an in-house CT log each time they signed a CSR >which >we could use for record-keeping and auditing purposes. > >I saw Google has the appropriate client code to do this (ostensibly >hardcoded to report to Google's CT log), however AFAIK that log >implementation isn't open source. > >Are there any open source ones worth using? Are changes to the >specification happening so quickly that this isn't advisable yet? > >-- >Tony Arcieri > > >------------------------------------------------------------------------ > >_______________________________________________ >Trans mailing list >Trans@ietf.org >https://www.ietf.org/mailman/listinfo/trans ------SJ301IP3C7KLC4L2VDUXSLQ4P7VZFH Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit We use the Google open source code to set up a test CT server when testing EJBCA, and of course the client code to submit.
I don't see any obstacles to running this in-house?

Cheers,
Tomas

On April 2, 2015 9:21:22 PM GMT+02:00, Tony Arcieri <bascule@gmail.com> wrote:
Please let me know if it's way too early to consider this, but...

We run many in-house CA services, and I thought it would be interesting if they all reported to an in-house CT log each time they signed a CSR which we could use for record-keeping and auditing purposes.

I saw Google has the appropriate client code to do this (ostensibly hardcoded to report to Google's CT log), however AFAIK that log implementation isn't open source.

Are there any open source ones worth using? Are changes to the specification happening so quickly that this isn't advisable yet?

--
Tony Arcieri


Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans
------SJ301IP3C7KLC4L2VDUXSLQ4P7VZFH-- From nobody Thu Apr 2 13:56:33 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 983031A1B18 for ; Thu, 2 Apr 2015 13:56:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XO_fAuOvuRCs for ; Thu, 2 Apr 2015 13:56:28 -0700 (PDT) Received: from mail-ob0-x233.google.com (mail-ob0-x233.google.com [IPv6:2607:f8b0:4003:c01::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CDE91A1B17 for ; Thu, 2 Apr 2015 13:56:28 -0700 (PDT) Received: by obbgh1 with SMTP id gh1so140115863obb.1 for ; Thu, 02 Apr 2015 13:56:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=IM/H3U+f6z7avmkxQB3OUih3IcN16Ynoxc8xK0Pr0aI=; b=E3vck6MpY5q0ZPDR49pP6pncvusr72Ae33+HzD/cdcSQJtfq+H3SeBqC2fB5JrIv6j 9e/SKteB9LODvZ3R3S5Iu5E6NqjazJPSbi60igmarvKIalD9ivPVDcpIaVBqwSxjF5CY AsWrwznwiVnzGxSZYkP2HLloK92NrQS7Z2lyC0uzGNfOKBfDwczMof4pOs97YMROhvs3 jUUrhuEI4SHgtPi0hdo817eJQohEftf1qyssGc/H3tw1OqLOje/7oE7NmhxgNGFKFpFk wN2qD8u1ELPhEuNXdooNP5m3hWGH7GwqOMzKyNCnQwq7NuWgU+jWZRORBB8EvYLX2/Qs 20MA== MIME-Version: 1.0 X-Received: by 10.182.24.133 with SMTP id u5mr49280184obf.27.1428008187522; Thu, 02 Apr 2015 13:56:27 -0700 (PDT) Received: by 10.76.166.232 with HTTP; Thu, 2 Apr 2015 13:56:27 -0700 (PDT) In-Reply-To: References: Date: Thu, 2 Apr 2015 13:56:27 -0700 Message-ID: From: Tony Arcieri To: Ben Laurie Content-Type: multipart/alternative; boundary=001a11c30864c0f4390512c4101f Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 20:56:29 -0000 --001a11c30864c0f4390512c4101f Content-Type: text/plain; charset=UTF-8 On Thursday, April 2, 2015, Ben Laurie wrote: > What implementation do you mean? > > We have: https://github.com/google/certificate-transparency > > which implements both client and server and is open source. > Orly! Seems I was confused then. Are there any instructions on how to compile, set up, and and run a log server? -- Tony Arcieri --001a11c30864c0f4390512c4101f Content-Type: text/html; charset=UTF-8 On Thursday, April 2, 2015, Ben Laurie <benl@google.com> wrote:
What implementation do you mean?

We have: https://github.com/google/certificate-transparency

which implements both client and server and is open source.

Orly! Seems I was confused then.

Are there any instructions on how to compile, set up, and and run a log server?


--
Tony Arcieri

--001a11c30864c0f4390512c4101f-- From nobody Fri Apr 3 01:16:16 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95DAD1A0178 for ; Fri, 3 Apr 2015 01:16:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t09SnFQg9rxS for ; Fri, 3 Apr 2015 01:16:12 -0700 (PDT) Received: from mail-la0-f44.google.com (mail-la0-f44.google.com [209.85.215.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B66F1A0137 for ; Fri, 3 Apr 2015 01:16:12 -0700 (PDT) Received: by lagg8 with SMTP id g8so75920080lag.1 for ; Fri, 03 Apr 2015 01:16:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=ST9YyKH4DfB1jiogMauG7iQSr46NA81L5AFSstcF7g8=; b=Nr0t093IYTvlBVunWl8dgSjDAJZC5Pp9oXsVn/AuG3noIjrV5moy/+XOYGePAl+IX4 odYzJE3vzbqft2PFj22i2kCiUhmAeRuYVNHW9/KC0am7ZVsv58kCMbG0/apVE8lzNjWj k7NCoDp88xBzpLZeYfEdHMpTBkfpK0pAZAPIDn0E0wcQ851BpDQwxqCtoswBuDaukLy2 w2ECU/3ItHv+6X4O8rnMXN7qTuy8EdEWopK1n2975b0IE5g1JGzyFI2CAgAcGETDz2UP QuCL5mZao8MQEGJF5vD6hMd2JLvSgKCf9Boq/6OxWHYj99ZrbZrrTNkon8BMwROUOgJB 4f5A== X-Gm-Message-State: ALoCoQlhqgt3N8uW5g+7e47fcoOvfKlB0xunG0x2FS81CqxFk9JUSDb1VfBcg+Ti6QHuerKBrNkq X-Received: by 10.112.125.167 with SMTP id mr7mr1178445lbb.106.1428048970867; Fri, 03 Apr 2015 01:16:10 -0700 (PDT) Received: from [10.0.0.141] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id ei4sm1452765lad.31.2015.04.03.01.16.09 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 03 Apr 2015 01:16:10 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Leif Johansson X-Mailer: iPhone Mail (12D508) In-Reply-To: Date: Fri, 3 Apr 2015 10:16:09 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <6DA53A19-0A7B-4D3E-84CF-4D126DA86E72@mnt.se> References: To: Tony Arcieri Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2015 08:16:14 -0000 ct.nordu.net is the home of the catlfish log - BSD licensed > 2 apr 2015 kl. 21:21 skrev Tony Arcieri : >=20 > Please let me know if it's way too early to consider this, but... >=20 > We run many in-house CA services, and I thought it would be interesting if= they all reported to an in-house CT log each time they signed a CSR which w= e could use for record-keeping and auditing purposes. >=20 > I saw Google has the appropriate client code to do this (ostensibly hardco= ded to report to Google's CT log), however AFAIK that log implementation isn= 't open source. >=20 > Are there any open source ones worth using? Are changes to the specificati= on happening so quickly that this isn't advisable yet? >=20 > --=20 > Tony Arcieri > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans From nobody Fri Apr 3 02:38:49 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 975E01A6EDA for ; Fri, 3 Apr 2015 02:38:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.389 X-Spam-Level: X-Spam-Status: No, score=-1.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKxEImWDXe2j for ; Fri, 3 Apr 2015 02:38:47 -0700 (PDT) Received: from mail-qg0-x230.google.com (mail-qg0-x230.google.com [IPv6:2607:f8b0:400d:c04::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 863DD1A3B9F for ; Fri, 3 Apr 2015 02:38:47 -0700 (PDT) Received: by qgeb100 with SMTP id b100so48386197qge.3 for ; Fri, 03 Apr 2015 02:38:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=LlwBxqQb1N8zsK1of9IyNpJg2lI8qOGBWv5WJ2wBnWY=; b=At8EspXXNCpinVv8nHlRRgxfSunYzC7sj+rSyXnAPY1l8FZF8TbGYMH1S5YGlMLiK8 enbuCNnt3RF+gqoayhhPr7r/C6rL5KlAfhwjAWG9gVzFRRNFG8elC0BoDGD4mpBktlyN BZk7/mbexstS6eWSWhb3UelBDjQFbbxMfheb9uDMJPcEsfgFbfNrMr/CFsl0WOv5k6gR B3+VPs9NZo62jhwNuIINd4ApykcdCKPOgidUiPO5A+boA63A7N9T2QQ1+quO8cxneP3f bGlGRAdx1aE9aWdYXpLZkTTWZfHVAY70Qnt2eOT8z5fWXgrdF2tfnjx1Ph0MZ22fpe0K 8h8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=LlwBxqQb1N8zsK1of9IyNpJg2lI8qOGBWv5WJ2wBnWY=; b=atb6r9MdCRWz3w0O9JdnROD0zEu0XnVAQdrCSr8yW2TsYYAu5zVBH1nlyY3tqBD456 sLvT1Pf9WbJVGSq2vSCTCux9eQSonx92K7t76/cjIZELnc8YkLrH/PNBsHjX01uFHwWm kBO00V/HwSsbIFXlnBMLD3LheGlC4tAnfprdkPyHBq3rcSLDcv9/IeeeP9k9xgraNu5p 1tWlD9a8oc6IDiObP2X4IGVccn20zzWTb5pYXReLH2HKx/Qm6bunRnnGgzw1OjNXJyaQ lHkpG6SW7glG6wFEPhnHPUGgNptVK17TCza0JrL9yc793dhfBaw+d9tnMXCsaU5fTbCM V7Ew== X-Gm-Message-State: ALoCoQkud+5K3+uuxt+mhxbHkYnLISHiaXhfpGcgWN91/fEu6A7T2TgC7YFTQwq0bUBnEXYmc4pI MIME-Version: 1.0 X-Received: by 10.229.68.136 with SMTP id v8mr1725735qci.16.1428053926669; Fri, 03 Apr 2015 02:38:46 -0700 (PDT) Received: by 10.229.178.135 with HTTP; Fri, 3 Apr 2015 02:38:46 -0700 (PDT) In-Reply-To: References: Date: Fri, 3 Apr 2015 10:38:46 +0100 Message-ID: From: Ben Laurie To: Tony Arcieri Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Open source CT log implementations X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2015 09:38:48 -0000 On 2 April 2015 at 21:56, Tony Arcieri wrote: > On Thursday, April 2, 2015, Ben Laurie wrote: >> >> What implementation do you mean? >> >> We have: https://github.com/google/certificate-transparency >> >> which implements both client and server and is open source. > > > Orly! Seems I was confused then. > > Are there any instructions on how to compile, set up, and and run a log > server? Compile, yes. Set up and run, no - probably best to look at the end-to-end tests for that part. This test might be the easiest to follow: https://github.com/google/certificate-transparency/blob/master/cpp/server/ct-dns-server-test.py. We are working on a more robust, scaleable version in the super_duper branch, BTW. From nobody Fri Apr 10 08:27:10 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A112F1A1B8F for ; Fri, 10 Apr 2015 08:27:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NRPQKFkb12pL for ; Fri, 10 Apr 2015 08:27:08 -0700 (PDT) Received: from mail-pd0-x22e.google.com (mail-pd0-x22e.google.com [IPv6:2607:f8b0:400e:c02::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D52C41A1B81 for ; Fri, 10 Apr 2015 08:26:49 -0700 (PDT) Received: by pddn5 with SMTP id n5so25866015pdd.2 for ; Fri, 10 Apr 2015 08:26:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=Afop4J013EeUTZyj7bFPgdo7nNfSv5+b2bVZE9Zo75Q=; b=RKvXkRUXIc2Sc0zfFPIUvCjwghKuTkXXEXPFUVYL2EvS4Jvm+SrFSejYm+Ocsk0n2H ixD9bVz59FRNs+Su/2jMpJ51bNbZJd4fOa2Ktbg6T/2Yn+/SdErhfhk8ehRqpVxd6FQD 79mMIKXWz1SLhMbP0+HNe90nU79ETSdOXnxHNZ/uMJVaYlPYXrxHuKp0kw++QOPpxgkK SJw24ESJqmRjS5goM/NqbDjv1K5GCW9iwIUclY9i7/xZi6mO7OEu4kHiEY+DTFCzJSSI 2FLBCtpZaTbMpXGI9F8Woa9CbyKOzQhxFAafcop2v0nQDC+664+MZeLWPkDNjEUSbNv7 ChsA== X-Received: by 10.68.223.165 with SMTP id qv5mr3634222pbc.82.1428679608592; Fri, 10 Apr 2015 08:26:48 -0700 (PDT) Received: from spandex.local (124-pm34.nwc.acsalaska.net. [209.112.159.124]) by mx.google.com with ESMTPSA id v3sm2610970pbs.18.2015.04.10.08.26.46 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 10 Apr 2015 08:26:47 -0700 (PDT) Message-ID: <5527EBB5.6020404@gmail.com> Date: Fri, 10 Apr 2015 07:26:45 -0800 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: "trans@ietf.org" References: <551067E8.1010201@gmail.com> In-Reply-To: <551067E8.1010201@gmail.com> X-Forwarded-Message-Id: <551067E8.1010201@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Trans] Fwd: Poll for adoption of working group draft on threat analysis for CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Apr 2015 15:27:10 -0000 Reminder: poll for adoption of a draft on a threat analysis closes today. If you've got an opinion on this and haven't yet weighed in, please speak up. Melinda -------- Original Message -------- Subject: Poll for adoption of working group draft on threat analysis for CT Date: Mon, 23 Mar 2015 14:22:16 -0500 From: Melinda Shore To: trans@ietf.org Hi, all: This is a call for adoption of a working group deliverable providing a threat analysis for CT, based on the summary provided by http://www.ietf.org/proceedings/92/slides/slides-92-trans-0.pdf and on previous discussion on this mailing list. This call closes on Friday, April 10. Please review the slides and provide an indication of whether or not you support draft adoption. Thanks, Melinda & Paul From nobody Sun Apr 12 12:46:57 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6A201B3847 for ; Sun, 12 Apr 2015 12:46:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p2UcOq5QNhyx for ; Sun, 12 Apr 2015 12:46:54 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 368BA1B384D for ; Sun, 12 Apr 2015 12:46:54 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3lQ3W05tBYz9Gq; Sun, 12 Apr 2015 21:46:52 +0200 (CEST) Authentication-Results: mx.nohats.ca; dkim=pass (1024-bit key) header.d=nohats.ca header.i=@nohats.ca header.b=oL812WKe X-OPENPGPKEY: Message passed unmodified X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 8Q5iBKvc9ZOR; Sun, 12 Apr 2015 21:46:52 +0200 (CEST) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sun, 12 Apr 2015 21:46:52 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 2CFBA803E0; Sun, 12 Apr 2015 15:46:51 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1428868011; bh=moZqgg2JZ4JyfjvZv4bgUBdOl6dICrRFiYzcy7Tbc80=; h=Date:From:To:cc:Subject; b=oL812WKeVPZXKC+YR9Wlc6ITwcyG7cmeB0mp/PZYF2W+Amued8DRWkxIPhKIzB3Dj RUUMWk1cA0Nrj/ERuYP4taNpXM2gJi3E/uOZ9i/4I0RXaS4C+FLTWiBuYJj+qLb0TB 7n/Wlqrh1y5b08CGbsh4jnhkdwOPUFkKgT4uuHB8= Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id t3CJkpgR006374; Sun, 12 Apr 2015 15:46:51 -0400 X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs Date: Sun, 12 Apr 2015 15:46:50 -0400 (EDT) From: Paul Wouters To: Trans Message-ID: User-Agent: Alpine 2.10 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: Stephen Kent Subject: [Trans] Threat Analysis for CT adopted by the working group X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Apr 2015 19:46:55 -0000 Hi, The call for adoption of a working group deliverable providing a threat analysis has closed and there is a clear consensus for adoption. Steve, can you submit a document as draft-ietf-trans-threat-analysis ? It's also never to early to commit to reviewing a document, so if you'd like to review this document, please let us now, and we will send you reminders for your review. Thanks, Melinda & Paul From nobody Wed Apr 22 02:04:03 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A1031B32CF for ; Wed, 22 Apr 2015 02:04:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1MRoR6emn-E2 for ; Wed, 22 Apr 2015 02:03:59 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 480B61B32C9 for ; Wed, 22 Apr 2015 02:03:58 -0700 (PDT) Received: (qmail 16891 invoked by uid 1004); 22 Apr 2015 09:03:57 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Wed, 22 Apr 2015 10:03:57 +0100 Received: (qmail 15329 invoked by uid 1000); 22 Apr 2015 09:03:57 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Wed, 22 Apr 2015 10:03:57 +0100 Message-ID: <553763FC.7000504@comodo.com> Date: Wed, 22 Apr 2015 10:03:56 +0100 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: noloader@gmail.com, "trans@ietf.org" References: In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: PKIX Subject: Re: [Trans] [pkix] Certificate Transparency and user agent warnings X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2015 09:04:02 -0000 (Cross-posting to TRANS) Jeffrey, does "private PKI" mean... 1. A publicly-trusted root, a publicly-logged intermediate, and non-logged end-entity certs. or 2. A non-publicly-trusted root, a non-logged intermediate, and non-logged end-entity certs. If 1, then please take a look at the mechanism in 6962-bis [1] for logging a name-constrained intermediate CA certificate in place of the end-entity certs issued under it. If 2, then I suspect that this is out of scope for CT, since it seems likely that most CT logs accepted by browsers will only issue SCTs for (intermediate or end-entity) certs that chain to publicly-trusted roots. [1] https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/?include_text=1 On 22/04/15 00:59, Jeffrey Walton wrote: > According to the CT FAQ at > http://www.certificate-transparency.org/faq, there are three ways to > avoid warnings in some user agents: > > * X509v3 Certificate Extension > * TLS Extension > * OCSP Stapling > > If a private PKI includes a subordinate in the chain that is name > constrained, then can that be used in lieu of the three methods above? > > RFC 6962 does not discuss it (https://tools.ietf.org/html/rfc6962). > But I feel like if the problem is issuing server certificates for > domains *not* authorized to do so, then name constraints seems like a > natural solution. > > Thanks in advance. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Wed Apr 22 06:12:07 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 273C01A6F2B; Wed, 22 Apr 2015 02:20:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v0Ga3ValyXVc; Wed, 22 Apr 2015 02:20:53 -0700 (PDT) Received: from mail-ie0-x234.google.com (mail-ie0-x234.google.com [IPv6:2607:f8b0:4001:c03::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 857B91A1AB9; Wed, 22 Apr 2015 02:20:53 -0700 (PDT) Received: by iecrt8 with SMTP id rt8so32798859iec.0; Wed, 22 Apr 2015 02:20:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; bh=/3k8x5fEVEMAD65S9nN/oVbaAVWf6FBx4j7p17ZvtEg=; b=SClBBFyy7eGviYHGW46DoDrQBl0G2X/z0A1WEHFFIvhCW06GesSpKrHidps1ULUqMi IVkKieq132oqKSEBHUK+DummffMFQU8Rq9WyiYHe97FTepp/JVWiJFpJWlNxeoa+79eO +4aWA34Qav3RhyzmRh7rbnW+xa2evozWblfJZbWIX1Dq5GgolV0bUmxslc8UhiNphpIB 5sppZh+E7yXi91IFIVimBxEiMTDx9WUuTPZnVVI36q5FFv296yBe9JeiHQElCD42k4Qz g2mv5QgVJHiuwDFjJDsIQ3rQ4mDxa7NS2xR38My3j8sieAE/1w7QY0ZRBrHaxdqoc7C5 puVQ== MIME-Version: 1.0 X-Received: by 10.43.18.194 with SMTP id qh2mr2561387icb.36.1429694453006; Wed, 22 Apr 2015 02:20:53 -0700 (PDT) Received: by 10.36.77.15 with HTTP; Wed, 22 Apr 2015 02:20:52 -0700 (PDT) In-Reply-To: <553763FC.7000504@comodo.com> References: <553763FC.7000504@comodo.com> Date: Wed, 22 Apr 2015 05:20:52 -0400 Message-ID: From: Jeffrey Walton To: Rob Stradling Content-Type: text/plain; charset=UTF-8 Archived-At: X-Mailman-Approved-At: Wed, 22 Apr 2015 06:12:07 -0700 Cc: PKIX , "trans@ietf.org" Subject: Re: [Trans] [pkix] Certificate Transparency and user agent warnings X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: noloader@gmail.com List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2015 09:20:55 -0000 Hi Rob, Thanks. > If 2, then I suspect that this is out of scope for CT, since it seems likely > that most CT logs accepted by browsers will only issue SCTs for > (intermediate or end-entity) certs that chain to publicly-trusted roots. Yes, this is the case. Is there a call-out or spec somewhere that states SCT is required of public CAs; but not CAs for internal or private PKIs? I'm concerned with an in-house, private PKI and the warnings that have been showing up in Chrome. Jeff On Wed, Apr 22, 2015 at 5:03 AM, Rob Stradling wrote: > (Cross-posting to TRANS) > > Jeffrey, does "private PKI" mean... > > 1. A publicly-trusted root, a publicly-logged intermediate, and non-logged > end-entity certs. > or > 2. A non-publicly-trusted root, a non-logged intermediate, and non-logged > end-entity certs. > > If 1, then please take a look at the mechanism in 6962-bis [1] for logging a > name-constrained intermediate CA certificate in place of the end-entity > certs issued under it. > > If 2, then I suspect that this is out of scope for CT, since it seems likely > that most CT logs accepted by browsers will only issue SCTs for > (intermediate or end-entity) certs that chain to publicly-trusted roots. > > > [1] > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/?include_text=1 > > > On 22/04/15 00:59, Jeffrey Walton wrote: >> >> According to the CT FAQ at >> http://www.certificate-transparency.org/faq, there are three ways to >> avoid warnings in some user agents: >> >> * X509v3 Certificate Extension >> * TLS Extension >> * OCSP Stapling >> >> If a private PKI includes a subordinate in the chain that is name >> constrained, then can that be used in lieu of the three methods above? >> >> RFC 6962 does not discuss it (https://tools.ietf.org/html/rfc6962). >> But I feel like if the problem is issuing server certificates for >> domains *not* authorized to do so, then name constraints seems like a >> natural solution. >> >> Thanks in advance. From nobody Wed Apr 22 07:02:33 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CB711A916B for ; Wed, 22 Apr 2015 07:02:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.388 X-Spam-Level: X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17IpsjLCltml for ; Wed, 22 Apr 2015 07:02:30 -0700 (PDT) Received: from mail-oi0-x236.google.com (mail-oi0-x236.google.com [IPv6:2607:f8b0:4003:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0B261A916E for ; Wed, 22 Apr 2015 07:02:19 -0700 (PDT) Received: by oign205 with SMTP id n205so179865784oig.2 for ; Wed, 22 Apr 2015 07:02:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=jlVk+EeoISXN8Om4bMP6Xoo/HLmG6hsXklZGQbfSpVM=; b=WtFMvJXq9P51k45nXK4jik+ZKKJxmarh6WBtFNlc5aJUYprQbUnjnT4kl+0naStdrd du7oxmJpmSSLLhdAwjGuVo20XxU0fZnZIo5blYwSPAolOXlQkOtCGKUS9lVOdD9e44mr S8okNjj2Ns1FMNkmll9clHstm1d/WmSqLrMkvhpWj+qn0DBBtxnQrNnoLza+9tgSaSVq db7UPOCxlXmoSjH5FxO9Nwp+eM8eBlHyLhhoF+/CB80kLY91dh0tSVdszP0LMe2/hIa9 h9KlsXCPJQE7qa/BzFHs5WPPTTpe/g1ZG6/15pCzgf+RHaO9vYH/ai5GNoHGDOUaV4r0 1Qww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=jlVk+EeoISXN8Om4bMP6Xoo/HLmG6hsXklZGQbfSpVM=; b=G3klCY3A3BUlTBP0uarXq7KGLfq6wnvhIk/uqZjpkAUdKH7FZE/ZAiCko3capP9pHF 9BgUI9IfNeb0dYWzfMEpSvLCSH3YT9nkcpLiPC5+2m3kW40ej9cOPXEjZlhfUqeGQHRM vxgGUWxfmL4/eb4Fm/FUGCx6OZz+lqf333RQXLvIFMlGqwxXe/CXJPOPCs80VvoE9Phz dwS2Y6z7InKjzKUZ+BkQULZ07ij+oKxo+GwambfWKRjG/jNjwrJ+wZvpIpdHRjPtP3Kg hgsrfbsAQMNGJdIjPR1HJs9/fB9jFDh+ihKuQuzUY00iVhwp+0C6k7PZ9CKMC2V5HWKQ Z01Q== X-Gm-Message-State: ALoCoQm2fUD+J6XJMwzQF4M/zS/TWZVtLerM64vnZ69VifOCJcclL2afadsEq+r3gJ1CDdD19kk1 MIME-Version: 1.0 X-Received: by 10.182.165.4 with SMTP id yu4mr23419269obb.74.1429711339293; Wed, 22 Apr 2015 07:02:19 -0700 (PDT) Received: by 10.182.197.102 with HTTP; Wed, 22 Apr 2015 07:02:19 -0700 (PDT) In-Reply-To: References: <553763FC.7000504@comodo.com> Date: Wed, 22 Apr 2015 15:02:19 +0100 Message-ID: From: Eran Messeri To: noloader@gmail.com Content-Type: multipart/alternative; boundary=001a11c2ff8a82c2a90514509c31 Archived-At: Cc: PKIX , Rob Stradling , "trans@ietf.org" Subject: Re: [Trans] [pkix] Certificate Transparency and user agent warnings X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2015 14:02:32 -0000 --001a11c2ff8a82c2a90514509c31 Content-Type: text/plain; charset=UTF-8 On Wed, Apr 22, 2015 at 10:20 AM, Jeffrey Walton wrote: > Hi Rob, > > Thanks. > > > If 2, then I suspect that this is out of scope for CT, since it seems > likely > > that most CT logs accepted by browsers will only issue SCTs for > > (intermediate or end-entity) certs that chain to publicly-trusted roots. > > Yes, this is the case. > > Is there a call-out or spec somewhere that states SCT is required of > public CAs; but not CAs for internal or private PKIs? > > I'm concerned with an in-house, private PKI and the warnings that have > been showing up in Chrome. > File a bug with Chrome? Chrome treats local trust roots differently AFAIK and the Chromium issue tracker is the place to get authoritative answers about this behaviour. > > Jeff > > On Wed, Apr 22, 2015 at 5:03 AM, Rob Stradling > wrote: > > (Cross-posting to TRANS) > > > > Jeffrey, does "private PKI" mean... > > > > 1. A publicly-trusted root, a publicly-logged intermediate, and > non-logged > > end-entity certs. > > or > > 2. A non-publicly-trusted root, a non-logged intermediate, and non-logged > > end-entity certs. > > > > If 1, then please take a look at the mechanism in 6962-bis [1] for > logging a > > name-constrained intermediate CA certificate in place of the end-entity > > certs issued under it. > > > > If 2, then I suspect that this is out of scope for CT, since it seems > likely > > that most CT logs accepted by browsers will only issue SCTs for > > (intermediate or end-entity) certs that chain to publicly-trusted roots. > > > > > > [1] > > > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/?include_text=1 > > > > > > On 22/04/15 00:59, Jeffrey Walton wrote: > >> > >> According to the CT FAQ at > >> http://www.certificate-transparency.org/faq, there are three ways to > >> avoid warnings in some user agents: > >> > >> * X509v3 Certificate Extension > >> * TLS Extension > >> * OCSP Stapling > >> > >> If a private PKI includes a subordinate in the chain that is name > >> constrained, then can that be used in lieu of the three methods above? > >> > >> RFC 6962 does not discuss it (https://tools.ietf.org/html/rfc6962). > >> But I feel like if the problem is issuing server certificates for > >> domains *not* authorized to do so, then name constraints seems like a > >> natural solution. > >> > >> Thanks in advance. > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --001a11c2ff8a82c2a90514509c31 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Apr 22, 2015 at 10:20 AM, Jeffrey Walton <= noloader@gmail.com<= /a>> wrote:
Hi Rob,

Thanks.

> If 2, then I suspect that this is out of scope for CT, since it seems = likely
> that most CT logs accepted by browsers will only issue SCTs for
> (intermediate or end-entity) certs that chain to publicly-trusted root= s.

Yes, this is the case.

Is there a call-out or spec somewhere that states SCT is required of
public CAs; but not CAs for internal or private PKIs?

I'm concerned with an in-house, private PKI and the warnings that have<= br> been showing up in Chrome.
File a bug with Chrome? Chr= ome treats local trust roots differently AFAIK and the Chromium issue track= er is the place =C2=A0to get=C2=A0authoritative =C2=A0answers about this be= haviour.

Jeff

On Wed, Apr 22, 2015 at 5:03 AM, Rob Stradling <rob.stradling@comodo.com> wrote:
> (Cross-posting to TRANS)
>
> Jeffrey, does "private PKI" mean...
>
> 1. A publicly-trusted root, a publicly-logged intermediate, and non-lo= gged
> end-entity certs.
> or
> 2. A non-publicly-trusted root, a non-logged intermediate, and non-log= ged
> end-entity certs.
>
> If 1, then please take a look at the mechanism in 6962-bis [1] for log= ging a
> name-constrained intermediate CA certificate in place of the end-entit= y
> certs issued under it.
>
> If 2, then I suspect that this is out of scope for CT, since it seems = likely
> that most CT logs accepted by browsers will only issue SCTs for
> (intermediate or end-entity) certs that chain to publicly-trusted root= s.
>
>
> [1]
> https://datatracker.ietf.org/doc/dr= aft-ietf-trans-rfc6962-bis/?include_text=3D1
>
>
> On 22/04/15 00:59, Jeffrey Walton wrote:
>>
>> According to the CT FAQ at
>> http://www.certificate-transparency.org/faq, there are three wa= ys to
>> avoid warnings in some user agents:
>>
>>=C2=A0 =C2=A0 * X509v3 Certificate Extension
>>=C2=A0 =C2=A0 * TLS Extension
>>=C2=A0 =C2=A0 * OCSP Stapling
>>
>> If a private PKI includes a subordinate in the chain that is name<= br> >> constrained, then can that be used in lieu of the three methods ab= ove?
>>
>> RFC 6962 does not discuss it (https://tools.ietf.org/html/rfc6962).
>> But I feel like if the problem is issuing server certificates for<= br> >> domains *not* authorized to do so, then name constraints seems lik= e a
>> natural solution.
>>
>> Thanks in advance.

_____________________________= __________________
Trans mailing list
Trans@ietf.org
h= ttps://www.ietf.org/mailman/listinfo/trans

--001a11c2ff8a82c2a90514509c31-- From nobody Fri Apr 24 15:47:55 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 318EB1A017A for ; Fri, 24 Apr 2015 15:47:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iXQ4xjfoZoh7 for ; Fri, 24 Apr 2015 15:47:52 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 748851A8943 for ; Fri, 24 Apr 2015 15:47:52 -0700 (PDT) Received: from dhcp89-089-172.bbn.com ([128.89.89.172]:49183) by smtp.bbn.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1YlmNx-0001LJ-TD; Fri, 24 Apr 2015 18:47:49 -0400 Message-ID: <553AC811.80708@bbn.com> Date: Fri, 24 Apr 2015 18:47:45 -0400 From: Karen Seo User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: Paul Wouters , Trans References: In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Stephen Kent Subject: Re: [Trans] Threat Analysis for CT adopted by the working group X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2015 22:47:54 -0000 Hello, Paul, Melinda, Sorry -- should have sent this sooner. Steve's been on vacation since April 10. He'll be back the first week of May. Karen On 4/12/15 3:46 PM, Paul Wouters wrote: > > Hi, > > The call for adoption of a working group deliverable providing a threat > analysis has closed and there is a clear consensus for adoption. > > Steve, can you submit a document as draft-ietf-trans-threat-analysis ? > > It's also never to early to commit to reviewing a document, so if > you'd like to review this document, please let us now, and we will > send you reminders for your review. > > Thanks, > > Melinda & Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Fri Apr 24 16:05:26 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D0131A8AD0 for ; Fri, 24 Apr 2015 16:05:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vupFZQFYtUcw for ; Fri, 24 Apr 2015 16:05:23 -0700 (PDT) Received: from mail-ig0-x233.google.com (mail-ig0-x233.google.com [IPv6:2607:f8b0:4001:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B2771A8ACE for ; Fri, 24 Apr 2015 16:05:23 -0700 (PDT) Received: by igblo3 with SMTP id lo3so26506512igb.1 for ; Fri, 24 Apr 2015 16:05:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=/SQCayvWCwu1HuMDNc0WP6qOQr5HS9+CA3hPoFMGPdI=; b=g5EcLPK5E5Thh4lkQOOcNLQks4v/Hdxb6k0p2HdQtTKH3BXJUMhz/VgmuCoqGAG4JI /25WnR9bPQ2EEtrSNqgO0kGmahhotfA4/1mZN1RyGJTHv7GXEPc21t12EzNIl6DhGT8Y 7nuvkxy62MbDhbUwew9foqF1UmV7qAgXeW72QNyuTBz4VHi8SFOqPbsCm3QahdIgxa10 oFcANWVXkO633dPg9+FShuQGftO8CkxrhYVg3ilVIovYi/4Ha+Gql3GefQEevLzIbNpo dIY6OWuTDAeioa2BCSJnHZGw8LtG9Nc3nHU6648MBq/N2Xl41DBCaLyNxwPndITn77eP qBug== MIME-Version: 1.0 X-Received: by 10.50.78.199 with SMTP id d7mr414830igx.18.1429916722837; Fri, 24 Apr 2015 16:05:22 -0700 (PDT) Received: by 10.50.245.49 with HTTP; Fri, 24 Apr 2015 16:05:22 -0700 (PDT) Received: by 10.50.245.49 with HTTP; Fri, 24 Apr 2015 16:05:22 -0700 (PDT) In-Reply-To: <553AC811.80708@bbn.com> References: <553AC811.80708@bbn.com> Date: Fri, 24 Apr 2015 15:05:22 -0800 Message-ID: From: Melinda Shore To: Karen Seo Content-Type: multipart/alternative; boundary=089e013c6ee452bfef0514806e9f Archived-At: Cc: Paul Wouters , trans@ietf.org, Stephen Kent Subject: Re: [Trans] Threat Analysis for CT adopted by the working group X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2015 23:05:24 -0000 --089e013c6ee452bfef0514806e9f Content-Type: text/plain; charset=UTF-8 Thanks! I was wondering why we hadn't heard from him yet. When he's back we can work out a timeline etc. Melinda --089e013c6ee452bfef0514806e9f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Thanks!=C2=A0 I was wondering why we hadn't heard from h= im yet.=C2=A0=C2=A0 When he's back we can work out a timeline etc.

Melinda

--089e013c6ee452bfef0514806e9f-- From nobody Sat Apr 25 15:39:50 2015 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9B6C1ACD53 for ; Sat, 25 Apr 2015 15:39:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.311 X-Spam-Level: X-Spam-Status: No, score=-2.311 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9gcKORjj2_Gx for ; Sat, 25 Apr 2015 15:39:47 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A2F11ACD3C for ; Sat, 25 Apr 2015 15:39:47 -0700 (PDT) Received: from [128.89.254.182] (port=50441 helo=karen-seos-power-mac-g5.local) by smtp.bbn.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Ym8jb-0009Xu-1l; Sat, 25 Apr 2015 18:39:39 -0400 Message-ID: <553C17A7.5020102@bbn.com> Date: Sat, 25 Apr 2015 18:39:35 -0400 From: Karen Seo User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: Melinda Shore , Paul Wouters References: <553AC811.80708@bbn.com> In-Reply-To: Content-Type: multipart/alternative; boundary="------------090206030101060306050708" Archived-At: Cc: "kseo@bbn.com" , skent@bbn.comrbarnes, "trans@ietf.org" Subject: Re: [Trans] Threat Analysis for CT adopted by the working group X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Apr 2015 22:39:49 -0000 This is a multi-part message in MIME format. --------------090206030101060306050708 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sounds good. Thank you. On 4/24/15 7:05 PM, Melinda Shore wrote: > > Thanks! I was wondering why we hadn't heard from him yet. When he's > back we can work out a timeline etc. > > Melinda > > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans --------------090206030101060306050708 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
Sounds good.  Thank you.

On 4/24/15 7:05 PM, Melinda Shore wrote:

Thanks!  I was wondering why we hadn't heard from him yet.   When he's back we can work out a timeline etc.

Melinda



_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

--------------090206030101060306050708--