From nobody Mon Dec 5 03:05:27 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 347261299EB for ; Mon, 5 Dec 2016 03:05:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsfjSown1JCn for ; Mon, 5 Dec 2016 03:05:19 -0800 (PST) Received: from mail-wj0-x22e.google.com (mail-wj0-x22e.google.com [IPv6:2a00:1450:400c:c01::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E6E51299C4 for ; Mon, 5 Dec 2016 03:05:19 -0800 (PST) Received: by mail-wj0-x22e.google.com with SMTP id tg4so31380036wjb.1 for ; Mon, 05 Dec 2016 03:05:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=0mngVROGbak2wzBkudW/ivnynmf55kcazlP9YilnJEE=; b=NONRSiEv6xke4c7vkximCiUpbopKfON0ap7X3615Z1CBWnlOZLo3Nm9ze3VCTBEiwS SHEkVqNQBHampAgVUQdzyeRHC4XTMXCvwb8MspUk/riL331QwDo0TyhoOraNqzARA6ZF YJIjr1Ss7WlAYBRY79+P3w1HCotclgoB9rRRqrXGIH+OUECSbl8HYLgeVVh5cj5VHjml 5PwO/z/ZiY+oSnhpB5jVpgzPO5DSMjyPLF5DhnZR2SENp2JEGS0MWBkQ+IbA6Fn0ub/b TEZWQO4vIJeNd/UAO+yNwaubY2ytvhSkcMM714icLZr1aQjbb2tHx7czvbkouR3NEa+m k1fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=0mngVROGbak2wzBkudW/ivnynmf55kcazlP9YilnJEE=; b=FiA5xinIO2vE821f4EvYYg546kMyOEEj/CJeW6EAvMxw3mCQeqwLJpCRrUXLUsc/R4 CcUkkXpceAcNYiklKVRmidieWCOoWV/uGUVdur6P1SXBkuxU3y2QxISuJ/W9tXtpmTy7 AnQ+HZfzGMb8zUJDiEBC4n2EDxEqKnj14jXUk+pcBcc+nFTxg8Q4+9fd5AvP1gdD8ESZ 5HdQA9QX5gztRxy9ci7DYpW9hwhnYkRz9undqt0NaUlWquXEsH7LrG6bgCbTqGXH5VcK 6et1ZXYm8yiBENk9DmR3cSge1HOJZorY6hu+yQWPw1PhxmUrB5Us4pWUmChu6eK7QJ2q XRaQ== X-Gm-Message-State: AKaTC00lf+Qz2QaCSHtVqEHlCr9LMnvh48QxpKr5/4cO2HDsb9/3w3BsIa6EX7GMDq1cSCnQvDrGiRM+SF/gDIt/ X-Received: by 10.194.149.143 with SMTP id ua15mr58814495wjb.48.1480935917677; Mon, 05 Dec 2016 03:05:17 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Mon, 5 Dec 2016 03:04:46 -0800 (PST) From: Eran Messeri Date: Mon, 5 Dec 2016 11:04:46 +0000 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=089e0122897c4f54060542e7432e Archived-At: Subject: [Trans] Recent updates to draft 21 of 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 11:05:26 -0000 --089e0122897c4f54060542e7432e Content-Type: text/plain; charset=UTF-8 A few changes were made to draft 21 of 6962-bis to address Paul Wouters' comments as he was doing the shepherds write-up: * A few references to obsolete RFCs were replaced with the newer versions . * RFC6962-bis is explicitly deprecating RFC6962 . * Title has been changed to reflect this is Certificate Transparency V2 . * An outline of the differences from RFC6962 has been added to the introduction . * The IANA section was incomplete - particularly, missing repositories' names, which were added . Note: The act of committing text changes to the GitHub repo does not make them final - this is just the authors' workflow. Any issue with the draft should be filed on the trans issue tracker , we'll address it and the chairs will close if we have addressed the workgroup's concerns properly. Regards, Eran --089e0122897c4f54060542e7432e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
A few changes were made to draft 21 of 6962-bis to address= Paul Wouters' comments as he was doing the shepherds write-up:
* A= few references to obsolete RFCs were replaced with the newer versions.
* RFC6962-bis is explic= itly deprecating RFC6962.
* Title has been changed to reflect this is Certificate Transparency V2.
* An outline of = the differences from RFC6962 has been added to the introduction.
* The IANA section was incomplete - particularly, missing repositorie= s' names, which were added.

Note: T= he act of committing text changes to the GitHub repo does not make them fin= al - this is just the authors' workflow. Any issue with the draft shoul= d be filed on the trans= issue tracker,=C2=A0we'll address it and the chairs will close if = we have addressed the workgroup's concerns properly.
Regards,
Eran
--089e0122897c4f54060542e7432e-- From nobody Mon Dec 5 05:56:29 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C208E1294D0 for ; Mon, 5 Dec 2016 05:56:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JIAEZfVagHxU for ; Mon, 5 Dec 2016 05:56:26 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3E5F129489 for ; Mon, 5 Dec 2016 05:56:25 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3tXRBD4TndzpD; Mon, 5 Dec 2016 14:56:20 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1480946180; bh=MahC+q0izlgzSio1Vk2ksAyqEBTd7MVy37ujGCszWMQ=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Sp44GIPfZhw38ZaMgih81TXoZT45PYAmLzkh72eifehOB9wG7Ex8wJvKCnD6yqYln LTsMY82FBUOU57C4aupCCzeJUJFWikCdu4rxEK0ngLjkOxMwMPJt8CyaLD/L9P/2GY N0VdNn9HqrciJ8O+iDwKihsAimc9Wb883vyJAoVk= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id VQnzGwRoQRBs; Mon, 5 Dec 2016 14:56:19 +0100 (CET) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 5 Dec 2016 14:56:19 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id E57C9506F8E; Mon, 5 Dec 2016 08:56:17 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca E57C9506F8E Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id CD91040D7281; Mon, 5 Dec 2016 08:56:17 -0500 (EST) Date: Mon, 5 Dec 2016 08:56:17 -0500 (EST) From: Paul Wouters To: Eran Messeri In-Reply-To: Message-ID: References: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Recent updates to draft 21 of 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 13:56:28 -0000 On Mon, 5 Dec 2016, Eran Messeri wrote: > A few changes were made to draft 21 of 6962-bis to address Paul Wouters' comments as he was doing the shepherds write-up:* A few references > to obsolete RFCs were replaced with the newer versions. > * RFC6962-bis is explicitly deprecating RFC6962. > * Title has been changed to reflect this is Certificate Transparency V2. > * An outline of the differences from RFC6962 has been added to the introduction. > * The IANA section was incomplete - particularly, missing repositories' names, which were added. Thanks for making the changes! > Note: The act of committing text changes to the GitHub repo does not make them final - this is just the authors' workflow. Any issue with > the draft should be filed on the trans issue tracker, we'll address it and the chairs will close if we have addressed the workgroup's > concerns properly. Or you can of course discuss it on the trans list itself. Paul From nobody Thu Dec 8 01:38:10 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 820FB129CB0 for ; Thu, 8 Dec 2016 01:38:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.197 X-Spam-Level: X-Spam-Status: No, score=-7.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBRm70bJlrkQ for ; Thu, 8 Dec 2016 01:38:06 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F24FE1293F4 for ; Thu, 8 Dec 2016 01:38:05 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id E80EFBE2C for ; Thu, 8 Dec 2016 09:38:01 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TtdrbLWKjN6V for ; Thu, 8 Dec 2016 09:37:56 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 0FEB6BE2E for ; Thu, 8 Dec 2016 09:37:56 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1481189876; bh=jUcbc33mo/6Xgr9P1uvQPuMpX7qxM7KW1lG2emIWx9U=; h=Subject:References:To:From:Date:In-Reply-To:From; b=G/gJL3krqhUbP4Wq1raFuqcehjbS2FEEQsX0hmw50bVhzxi5vVOe9xJyO8UXknr5R Gs/B6xCFGWUhDKwqLd6hBKYR6+bhD5AfU+sBYNqPOg3p0z+Llv+IS1ka9DZ4oYviPM TEOjek6tOfQUwC42bEC5mI8kDcqjH/yIxa0lUg40= References: <6B6FE4E1-D020-44B1-9F45-07202552E606@mnot.net> To: "trans@ietf.org" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= X-Forwarded-Message-Id: <6B6FE4E1-D020-44B1-9F45-07202552E606@mnot.net> Message-ID: <5719e3f0-ba76-e880-6ab6-1331fa8218c9@cs.tcd.ie> Date: Thu, 8 Dec 2016 09:37:56 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <6B6FE4E1-D020-44B1-9F45-07202552E606@mnot.net> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms040008060407070801020602" Archived-At: Subject: [Trans] Fwd: Call for Adoption: Expect-CT X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2016 09:38:08 -0000 This is a cryptographically signed message in MIME format. --------------ms040008060407070801020602 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable FYI. The HTTP folks are considering an HTTP header field that allows signalling host's expectations for CT in the web. If interested, please comment on the HTTP WG list [1] Cheers, S. [1] https://lists.w3.org/Archives/Public/ietf-http-wg/ -------- Forwarded Message -------- Subject: Call for Adoption: Expect-CT Resent-Date: Thu, 08 Dec 2016 04:06:06 +0000 Resent-From: ietf-http-wg@w3.org Date: Thu, 8 Dec 2016 15:05:27 +1100 From: Mark Nottingham To: HTTP Working Group CC: Patrick McManus Again, there seemed to be strong support in Seoul, and now on the list, for adopting this draft: Please comment / express support on list. Regards, -- Mark Nottingham https://www.mnot.net/ --------------ms040008060407070801020602 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMDgw OTM3NTZaMC8GCSqGSIb3DQEJBDEiBCBbb22JZTopKci4jwdtWhUii1lnA/ZaFcr/kHQOmapd PjBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAvYK+mHlHHggIFe80eQys8TzB/jr6YYGJjXah19ns2pfRjr8n0m1Cs 1f8UnCHyrnRSYNVqgLbfd7rdR8QDGYG0JRjUiatfBm1D+dsacqW+dtH0FTLwYNfRg6ZP3XMr Jt+0+cP1ShEav4smGSR3hgqH0+i+XE8osLf+08clgUqDw91KZx6HHvfibAJs2sBMBlQqx3kr mhpuzkretWaV2XOEG3ANYn9KsRQyj1XKsGEw3wkcqJNDKzGkfkkQSoz9Zkym+oxxmHJx8Lw0 nwUaXHOpID3ItOKUFDXONwVCZdUQNHwAdtGWc1Cru+8f19iJokehkFDGETI+qWKfjZ71MldC AAAAAAAA --------------ms040008060407070801020602-- From nobody Mon Dec 12 07:45:17 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7DA7129C9E for ; Mon, 12 Dec 2016 07:45:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f90BZIUw_8Eu for ; Mon, 12 Dec 2016 07:45:14 -0800 (PST) Received: from mail-wm0-x229.google.com (mail-wm0-x229.google.com [IPv6:2a00:1450:400c:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C6AA129C8D for ; Mon, 12 Dec 2016 07:45:01 -0800 (PST) Received: by mail-wm0-x229.google.com with SMTP id f82so74153618wmf.1 for ; Mon, 12 Dec 2016 07:45:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=1zH+Mg0Y7hVxvv6lemEgKeyP2bvxKWlttmXm+hsJL0g=; b=XcPuPGqtsqzgTah66TqNCEjYXycCPgkI7ZBcl8DizEoSZhIRdn4qcHq8LAMU+XtFst nwkxTgIMQQ/DVHuORPEHijpZTwDmzPRT4N1knB9Id/VR93AruYaWg+32lcTb8/PJfdOr 9BmecQpIy9Y3CiexiskoRc2F8/mGUXM2fp36XJjpI+lzAJPEKo0iyz6nt/nTq1FHLfl6 Gu6nayR8yyaqtv7g6XBazJ6UFMdTQ0ezIzyeMpaPVuiPl+QGC6MS0VVSccTbxrXCsmlC yVS/m0yT89KHMrwNsGXqEv0xXhvJDt3fyEGgdKebEudu97MjmcPHcGytOg7IdDFzJAKO hL4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=1zH+Mg0Y7hVxvv6lemEgKeyP2bvxKWlttmXm+hsJL0g=; b=A/VuS1eByMPsWhHlktvbYIVrKjFpyUgImZjso2FvVbaxpQ06g2n8G/l49ieZtthXCQ OdXESTVQWFqBfnGuGpnTeGwOwg7Bm3homKr9FwLnyDMEFPQpr32GT4PSqmFRZLjMg+23 hNXHRDPlWthwqY9EpwqydjuRZxOxAkFbmPYu3cZnSXduEhJWP2jrSUuyHLjMf8WRBNhg 2WLCiVuKN3+3rn2ajVSFBe1TQtyLYTqV3LaFkb1AzbdhRwBVWuOhddEDeVZ6RUgxWars Zlrr3/p4Mls9A0qF2IoQhH9bm0/d/jVm1hp498T5aW5QpWual++yrUQzvtTTiqAxeeDP l6SQ== X-Gm-Message-State: AKaTC03+WIiWbOQyzehocrtMJTug9ZfAyuk48NQlafdb1zqQhsK1ZmQ4VNBw5iRE0UlZ0SpovRSgt9Z2L21+6QtZ X-Received: by 10.28.7.130 with SMTP id 124mr17390673wmh.18.1481557499328; Mon, 12 Dec 2016 07:44:59 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Mon, 12 Dec 2016 07:44:28 -0800 (PST) From: Eran Messeri Date: Mon, 12 Dec 2016 15:44:28 +0000 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=001a1144267a781475054377fc3f Archived-At: Subject: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 15:45:16 -0000 --001a1144267a781475054377fc3f Content-Type: text/plain; charset=UTF-8 No policy has been specified in 6962-bis for adding values to the IANA registries requested. In https://github.com/google/certificate-transparency-rfcs/pull/215 I propose the following policies, all based on definitions in RFC5226: * Hash algorithms and Signature algorithms: Expert Review * SCT extensions and STH extensions: Specification Required * Log ID 1, Log ID 2: First Come First Served. Feedback welcome, since, as far as I recall, this topic was not discussed on the list previously. Eran --001a1144267a781475054377fc3f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
No policy has been specified in 6962-bis for adding v= alues to the IANA registries requested.

In https= ://github.com/google/certificate-transparency-rfcs/pull/215 I propose t= he following policies, all based on definitions in RFC5226:
*= Hash algorithms and Signature algorithms: Expert Review
* SCT ex= tensions and STH extensions: Specification Required
* Log ID 1, L= og ID 2: First Come First Served.

Feedback welcome= , since, as far as I recall, this topic was not discussed on the list previ= ously.

Eran
--001a1144267a781475054377fc3f-- From nobody Mon Dec 12 07:48:18 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7D31129432 for ; Mon, 12 Dec 2016 07:48:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.597 X-Spam-Level: X-Spam-Status: No, score=-5.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xw_4ptSlaK4F for ; Mon, 12 Dec 2016 07:48:14 -0800 (PST) Received: from prod-mail-xrelay05.akamai.com (prod-mail-xrelay05.akamai.com [23.79.238.179]) by ietfa.amsl.com (Postfix) with ESMTP id 79C21129C69 for ; Mon, 12 Dec 2016 07:47:59 -0800 (PST) Received: from prod-mail-xrelay05.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id EB8ED43340B; Mon, 12 Dec 2016 15:47:58 +0000 (GMT) Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay05.akamai.com (Postfix) with ESMTP id D4DCB433402; Mon, 12 Dec 2016 15:47:58 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1481557678; bh=x9D2eLHtDKGO4hGVqz34c4j+W+tpyJhHQQqpogKRoiI=; l=222; h=From:To:Date:References:In-Reply-To:From; b=aw/p6I2DWloD3vI7y8494IpwergAdfcqVnf28IV1pgvTC/SnLDLJiSnJqIanUDKN1 NHjvCokOenhB/GeoYwLxi9MuEy9D89WVuSuTEAFrSPkDaD+XNoNs2FBM3+M7MnZwUq IeqOK0hBLH1/xg9zS7XoPkNQKMfnA/S2oX6dRPUE= Received: from email.msg.corp.akamai.com (usma1ex-cas3.msg.corp.akamai.com [172.27.123.32]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id D1BD81FC98; Mon, 12 Dec 2016 15:47:58 +0000 (GMT) Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Mon, 12 Dec 2016 10:47:58 -0500 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Mon, 12 Dec 2016 10:47:58 -0500 From: "Salz, Rich" To: Eran Messeri , "trans@ietf.org" Thread-Topic: [Trans] Policy for adding to IANA registries requested in 6962-bis Thread-Index: AQHSVI7ADU1FevbqpkiNSo/b2luXv6EEdQrg Date: Mon, 12 Dec 2016 15:47:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.32.252] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 15:48:17 -0000 PiBJbiBodHRwczovL2dpdGh1Yi5jb20vZ29vZ2xlL2NlcnRpZmljYXRlLXRyYW5zcGFyZW5jeS1y ZmNzL3B1bGwvMjE1IEkgcHJvcG9zZSB0aGUgZm9sbG93aW5nIHBvbGljaWVzLCBhbGwgYmFzZWQg b24gZGVmaW5pdGlvbnMgaW4gUkZDNTIyNjoNCg0KKzEgZm9yIGFsbC4NCg0KDQo= From nobody Mon Dec 12 07:55:02 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EA70129CB3 for ; Mon, 12 Dec 2016 07:55:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4raU870Uvmul for ; Mon, 12 Dec 2016 07:54:59 -0800 (PST) Received: from mail-wm0-x229.google.com (mail-wm0-x229.google.com [IPv6:2a00:1450:400c:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18687129CB6 for ; Mon, 12 Dec 2016 07:54:37 -0800 (PST) Received: by mail-wm0-x229.google.com with SMTP id g23so67650837wme.1 for ; Mon, 12 Dec 2016 07:54:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=sJoi2U9FjlPMAz0x9Symh6moItFFJknhQwT0l9uW4jw=; b=oqUicNc0xTDqcrjeaAxYdHFHev6P27+xjA+wubHojwh+4pzHOYptYhUVWDSxUEbj/E hAFuNfDjCO33GbsYiSgQD+VqNFFwFhNV2569RGsyN5Z+bnvENxZKaTP1VsaCZaN/Ffbp C+5Kkc+BxS0gVOLMQRVqdCGU0ZN/t2PtOJDer5wg+/OuR939kdTbHrT6kekDeXvo9N2y qhsxt4rGmJhjttTamt4Zj1XI4vHnnUIDXSlOl6ck+lNy7z55Q2jfrIlgyPVpdC6b6tpG sHvpm1ZebtqehUjnjSr6ekqqxMkm+O0aM1ofzdzLyDSxaMxV+yIIhnM++ePZhqtO56SP WSiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=sJoi2U9FjlPMAz0x9Symh6moItFFJknhQwT0l9uW4jw=; b=emaG7VOKEK7pPDXhN9ouzeaWEHmhf/bqA63uUeAgEOlzSTBQToailqI6qMpa6A7el4 BMzbk1zm0jydaUQlXVy9bh4mlkoQOjyJEnVL57/9bHQAcqNdQP6qqIye5zt8JtWS/yzJ hh2iGJdl8Px2qHhWn392rRyn3AZYRYVKqPFCIHoAK8RiBZpBC8ToR+sPPqtbs3xmuajj MEgtfeaMzc674ENZOzwOyTnqsxVnd3m/YlPPkAudIzzySftbyn+f1j06Nm8mHMx1sWJ1 i2Kd10JiqB7DHNnFV4vo+vDrPzjCwzGRBrbhSBc1LeWicNdtF93fVpKt/pdkOn1/HHMR IU0A== X-Gm-Message-State: AKaTC00N2uXWuCUD7KOkk6jnCoylwO81lHWoQK/va6Fo8oJbjkR7z2UrcjSW0GInz68D2/XMx1rU3TrgD/J6xtGG X-Received: by 10.28.96.4 with SMTP id u4mr10735212wmb.86.1481558075262; Mon, 12 Dec 2016 07:54:35 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Mon, 12 Dec 2016 07:54:03 -0800 (PST) In-Reply-To: References: From: Eran Messeri Date: Mon, 12 Dec 2016 15:54:03 +0000 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=001a1148e998cab0900543781e45 Archived-At: Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 15:55:01 -0000 --001a1148e998cab0900543781e45 Content-Type: text/plain; charset=UTF-8 Some background as to why I propose each of the policies: * Expert Review for Hash algorithm and Signature algorithm: The algorithm selection does not affect the behaviour of the protocol. However, an expect should make sure proposed additions are suitable (for example, that a proposed hash algorithm does not suffer from known preimage attacks). * Specification requirement for SCT & STH extensions: new values for these extensions are meaningless without specifying what they do - how should clients behave when encountering them. * First-come-first-served for Log IDs: I can't see how an expect review could be meaningful, given log operators requesting those IDs can't really prove competence to "own" log IDs, so requiring a "minimal amount of clerical information" seems enough. Eran On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri wrote: > No policy has been specified in 6962-bis for adding values to the IANA > registries requested. > > In https://github.com/google/certificate-transparency-rfcs/pull/215 I > propose the following policies, all based on definitions in RFC5226: > * Hash algorithms and Signature algorithms: Expert Review > * SCT extensions and STH extensions: Specification Required > * Log ID 1, Log ID 2: First Come First Served. > > Feedback welcome, since, as far as I recall, this topic was not discussed > on the list previously. > > Eran > --001a1148e998cab0900543781e45 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Some background as to why I propose each of the policies:<= div>* Expert Review for Hash algorithm and Signature algorithm: The algorit= hm selection does not affect the behaviour of the protocol. However, an exp= ect should make sure proposed additions are suitable (for example, that a p= roposed hash algorithm does not suffer from known preimage attacks).
<= div>* Specification requirement for SCT & STH extensions: new values fo= r these extensions are meaningless without specifying what they do - how sh= ould clients behave when encountering them.
* First-come-first-se= rved for Log IDs: I can't see how an expect review could be meaningful,= given log operators requesting those IDs can't really prove competence= to "own" log IDs, so requiring a "minimal amount of clerica= l information" seems enough.

Eran
=

On Mon, Dec 12, 2= 016 at 3:44 PM, Eran Messeri <eranm@google.com> wrote:
No policy has been specif= ied in 6962-bis for adding values to the IANA registries requested.

In https://github.com/google/cer= tificate-transparency-rfcs/pull/215 I propose the following polici= es, all based on definitions in RFC5226:
* Hash algorithms an= d Signature algorithms: Expert Review
* SCT extensions and STH ex= tensions: Specification Required
* Log ID 1, Log ID 2: First Come= First Served.

Feedback welcome, since, as far as = I recall, this topic was not discussed on the list previously.

Eran

--001a1148e998cab0900543781e45-- From nobody Mon Dec 12 09:30:25 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1719129D85 for ; Mon, 12 Dec 2016 09:30:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.097 X-Spam-Level: X-Spam-Status: No, score=-7.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s46ercHfooEz for ; Mon, 12 Dec 2016 09:30:22 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68161129D70 for ; Mon, 12 Dec 2016 09:30:22 -0800 (PST) From: Jeremy Rowley Authentication-Results: mail.digicert.com; dkim=permerror (bad message/signature format) To: "trans@ietf.org" Thread-Topic: Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60Q== Date: Mon, 12 Dec 2016 17:30:20 +0000 Message-ID: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [67.137.52.7] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0137_01D25462.BCA9D2A0" MIME-Version: 1.0 Archived-At: Subject: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 17:30:24 -0000 ------=_NextPart_000_0137_01D25462.BCA9D2A0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0138_01D25462.BCA9D2A0" ------=_NextPart_001_0138_01D25462.BCA9D2A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit We've been conducting short surveys of key customers to find out whether redaction is of interest to server operators, what form of redaction they'd like most, and why they are concerned about redaction. Here are the results so far: About 70% of customers surveyed were concerned about logging all server certs into a CT log, primarily because of privacy concerns (100% of respondents). Security concerns were lower (20%). Offering redaction satisfied 100% of the respondents concerns. 100% of the concerned respondents wanted to support redaction of the left most label in the DNS. 50% wanted to support redaction of all subject information. 50% thought a technically constrained intermediate would work. The 50% who wanted to support redaction of the subject information were not the same as the technically constrained intermediate proponents. Jeremy ------=_NextPart_001_0138_01D25462.BCA9D2A0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

We’ve been conducting short surveys of key = customers to find out whether redaction is of interest to server = operators, what form of redaction they’d like most, and why they = are concerned about redaction. Here are the results so = far:

 

About 70% of customers surveyed were concerned about = logging all server certs into a CT log, primarily because of privacy = concerns (100% of respondents). Security concerns were lower (20%). =  Offering redaction satisfied 100% of the respondents concerns. =  100% of the concerned respondents wanted to support redaction of = the left most label in the DNS. 50% wanted to support redaction of all = subject information.  50% thought a technically constrained = intermediate would work.  The 50% who wanted to support redaction = of the subject information were not the same as the technically = constrained intermediate proponents.

 

Jeremy

------=_NextPart_001_0138_01D25462.BCA9D2A0-- ------=_NextPart_000_0137_01D25462.BCA9D2A0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPdzCCA7cw ggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShY YAz4gNqpFZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g 1x/isdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm+qTZ 1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusIXxh3TwID AQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SS y4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTT PYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mzXeuy CSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTrQrf6jB7dYvG+UGe3 bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVt bI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCyp/oKRS+i8PIwggVmMIIETqADAgECAhALgHcH Lzs1YGO/amtK2gTIMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNI QTIgQXNzdXJlZCBJRCBDQTAeFw0xNTEwMTMwMDAwMDBaFw0xOTAxMTAxMjAwMDBaMIGBMQswCQYD VQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNlcnQx FjAUBgNVBAMTDUplcmVteSBSb3dsZXkxKTAnBgkqhkiG9w0BCQEWGmplcmVteS5yb3dsZXlAZGln aWNlcnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8kPdqjF+ljW5h8W7mQpM jaGlZ9YDLYTtUzcQjl71vRI4M6WSiZiUfbueAgupsQnxvl8By0BdwVmXnOIAUvqpFqzZhNIc8DGH M+uvXgT4+aoQvn9qPlt04CN5hzE/GFVvqs3neWgGfkzp1Z5H6RiqNoTOzdDWyr09Q8Gzm1jW9lTq sX0cxqooYtk29ooq12BvbVz0Jjgtt4Erdp27bTth11CaulJUDRT39YLLAwiR0bw3eMu8DCyuXAwV D68Ux33UbgYU9uvyFxBhJ83ST+1aw0r4E6iYTlQnKtYjEoNwlifhkwm4xS+lQHuTirpJGRFV42hd l9AtWQKRGuCUBL5EdwIDAQABo4IB8zCCAe8wHwYDVR0jBBgwFoAU5wIjgABP2Ne8lAvZP3Q5STI8 inkwHQYDVR0OBBYEFPEtLfkj2twAoaYEb8gixWV8QW8HMAwGA1UdEwEB/wQCMAAwJQYDVR0RBB4w HIEaamVyZW15LnJvd2xleUBkaWdpY2VydC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG CCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCGSAGG/WwEAQIwKjAoBggrBgEFBQcC ARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBiAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmwwPaA7oDmG N2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmww eQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYI KwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVk SURDQS5jcnQwDQYJKoZIhvcNAQELBQADggEBAKy4O+nfR40jBgIFlaomX723rsDsnP/MT7xA9waf /K/JSqkfi97389rH0IXxwcEG/ne664wDmq4tZ9EfFkT2cGv0+itbcCDETeeu9bqOj6/LbXiYj9EB zyRFTcZih4NBIVEpTEcEIZfFfNWn3yDocY6K9wZFaM4UKLAqsnN0xYEKCNkSFsWv1Ol/8J3p363A f+PrswxqzejMiYvsi0nFYPFUMby901Crme/n4xpIJ57mLWy28YshNFip8sIOmCdVJcJ9KU65YljF 5D0cWyFk4xslKhHz6x3LKwqQmpedxWG3zYJVcaqLuTyZSqaewzJ5q8qH+usnmkmb+tcF/SDFD7Aw ggZOMIIFNqADAgECAhAErnlgZmaQGrnFf6ZsW9zNMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xMzExMDUxMjAwMDBaFw0yODEx MDUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANz4ESM/arXvwCd5Gy0Fh6IQQzHfDtQVG093 pCLOPoxw8L4Hjt0nKrwBHbYsCsrdaVgfQe1qBR/aY3hZHiIsK/i6fsk1O1bxH3xCfiWwIxnGRTjX PUT5IHxgrhywWhgEvo8796nwlJqmDGNJtkEXU0AyvU/mUHpQHyVF6PGJr83/Xv9Q8/AXEf+9xYn1 vWK52PuORQSFbZnNxUhN/SarAjZF6jbXX2riGoJBCtzp2fWRF47GIa04PBPmHn9mnNVN2Uba9s9S p307JMO0wVE1xpvr1O9+5HsD4US9egs34E/LgooNcRjkpuCJLBvzsnM8wbCSnhh9vat9xX0IoSzC n3MCAwEAAaOCAvgwggL0MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsG AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMIGBBgNVHR8E ejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290 Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDCCAbMGA1UdIASCAaowggGm MIIBogYKYIZIAYb9bAACBDCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNv bS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBz ACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMA ZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQ AFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUA ZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABh AG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIA eQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFOcCI4AAT9jXvJQL2T90OUkyPIp5MB8G A1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQBO1Iknuf0d h3d+DygFkPEKL8k7Pr2TnJDGr/qRUYcyVGvoysFxUVyZjrX64GIZmaYHmnwTJ9vlAqKEEtkV9gpE V8Q0j21zHzrWoAE93uOC5EVrsusl/YBeHTmQvltC9s6RYOP5oFYMSBDOM2h7zZOr8GrLT1gPuXtd GwSBnqci4ldJJ+6Skwi+aQhTAjouXcgZ9FCATgLZsF2RtJOH+ZaWgVVAjmbtgti7KF/tTGHtBlgo GVMRRLxHICmyBGzYiVSZO3XbZ3gsHpJ4xlU9WBIRMm69QwxNNNt7xkLb7L6rm2FMBpLjjt8hKlBX BMBgojXVJJ5mNwlJz9X4ZbPg4m7CMYIDrzCCA6sCAQEweTBlMQswCQYDVQQGEwJVUzEVMBMGA1UE ChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdp Q2VydCBTSEEyIEFzc3VyZWQgSUQgQ0ECEAuAdwcvOzVgY79qa0raBMgwCQYFKw4DAhoFAKCCAgsw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEyMTczMDE5WjAj BgkqhkiG9w0BCQQxFgQU7cqYyvTRbzS13hMff48ns6Xymg8wgYgGCSsGAQQBgjcQBDF7MHkwZTEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0 LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK 2gTIMIGKBgsqhkiG9w0BCRACCzF7oHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0 IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK2gTIMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZI AWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwIC AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJ YIZIAWUDBAIBMA0GCSqGSIb3DQEBAQUABIIBAKrI9xz/7op2IapYy0kHSciGVBwjfECbsN4A/R+n ItV0F+3M06G9LG6/3qEDwsNQPHk5ZmdiiU9T2uuNf41/j0/mhpAWl9qJPkeb2r3t41nNOMsUHjHr e31jeP7ugDdEoMQrxbZ/KS+Sekb64SwFknHog9ob+gskdffP4c7dnO00aziXB3wjp4xYqr+3S7OQ pvAYh0+BAkYmUcfdbUHuBZM1OKTOKrA6NpkJONrmGiNmemSd/YaBivEiVCsKuG4eEeIHRw/01oow M/cR2rECGzT1e3KVpO+vBYK8GLLBQRWMzADH4RHJkQMc9iJOzgw/SUvfCBRgL72/5S82+O+MaS0A AAAAAAA= ------=_NextPart_000_0137_01D25462.BCA9D2A0-- From nobody Mon Dec 12 14:21:46 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66E7D12951E for ; Mon, 12 Dec 2016 14:21:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASThv_KmKBui for ; Mon, 12 Dec 2016 14:21:43 -0800 (PST) Received: from mail.hezmatt.org (erdhenne.tobermorytech.com [178.63.85.14]) by ietfa.amsl.com (Postfix) with ESMTP id 5098E1294BB for ; Mon, 12 Dec 2016 14:21:43 -0800 (PST) Received: from mistress.home.hezmatt.org (unknown [59.167.200.111]) by mail.hezmatt.org (Postfix) with ESMTPSA id A1B29A70BC for ; Mon, 12 Dec 2016 22:21:41 +0000 (UTC) Received: by mistress.home.hezmatt.org (Postfix, from userid 1000) id 60F849FF58; Tue, 13 Dec 2016 09:21:34 +1100 (AEDT) Date: Tue, 13 Dec 2016 09:21:34 +1100 From: Matt Palmer To: trans@ietf.org Message-ID: <20161212222134.GM11153@hezmatt.org> References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 22:21:45 -0000 On Mon, Dec 12, 2016 at 05:30:20PM +0000, Jeremy Rowley wrote: > We've been conducting short surveys of key customers to find out whether > redaction is of interest to server operators, what form of redaction they'd > like most, and why they are concerned about redaction. Here are the results > so far: Can you share the sample size, respondent size, survey methodology, and (anonymised, if necessary) raw result data? Summaries of response data are far less enlightening than the actual responses data points. - Matt From nobody Mon Dec 12 15:04:52 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D236129E59 for ; Mon, 12 Dec 2016 15:04:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.617 X-Spam-Level: X-Spam-Status: No, score=-6.617 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lczwAi_R8u0I for ; Mon, 12 Dec 2016 15:04:48 -0800 (PST) Received: from asbsmtoutape02.symantec.com (asbsmtoutape02.symantec.com [155.64.138.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2860A129EBA for ; Mon, 12 Dec 2016 15:02:41 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat1.net.symantec.com [10.90.75.1]) by asbsmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id F9.F1.03942.F8C2F485; Mon, 12 Dec 2016 23:02:40 +0000 (GMT) X-AuditID: 0a5af81a-f796d9a000000f66-49-584f2c8f4423 Received: from ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat5.net.symantec.com [10.90.75.5]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id DB.B6.04050.F8C2F485; Mon, 12 Dec 2016 23:02:39 +0000 (GMT) Received: from ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (10.90.223.21) by ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (10.90.223.21) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 12 Dec 2016 15:02:38 -0800 Received: from NAM03-CO1-obe.outbound.protection.outlook.com (10.90.74.8) by ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (10.90.223.21) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Mon, 12 Dec 2016 15:02:38 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VA1+uw48+TGTnyDZw9cAkNgmzZuczzA2vNF7Nw6CjOI=; b=VBVE4oh2Id3lllZVyAXEa43kWd90PQvKN6BY0OD4Fgd3p9n9N+l1kcMuqGD5JNstXxXFULdkKEAbM5hQm36h4tqEaOFAl7i4+lvgAGMeoImbASbTNN51FbjzxVRpaKFEHW/pooLV1i2cA99mGjLvM7svGlFWAKkbAI6hdOsCgss= Received: from BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) by BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Mon, 12 Dec 2016 23:02:31 +0000 Received: from BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) by BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) with mapi id 15.01.0771.014; Mon, 12 Dec 2016 23:02:31 +0000 From: Steve Medin To: Matt Palmer , "trans@ietf.org" Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAL810AAAFHujA= Date: Mon, 12 Dec 2016 23:02:31 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: <20161212222134.GM11153@hezmatt.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Steve_Medin@symantec.com; x-originating-ip: [155.64.138.28] x-ms-office365-filtering-correlation-id: 406dd360-3e1e-4a19-04e1-08d422e2f3c8 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:BLUPR16MB0449; x-microsoft-exchange-diagnostics: 1; BLUPR16MB0449; 7:DWxfL5ivRUnxiIUf9/hfJf3vqI7N+/6XApjllA92U3zoIF3Rb94/mX3sJ+Xcn1nGRDSaMiAZtkJFRRTmjOKtsEjd4RYh9qldfKbBQIslfIo6SNOcr2qUyAoLSbMujaN8pM2qsoZBLBvaTV5vSEraDRTCjWa5j2ci6nSBpyKxpm41fAUGfxUSdrWVLrhrKZhTU20GYRy61yms+rPxJOF0VvaI0ZeAg281cX23zy6PxYbDbOVwg/Ol/+ah0J02BxPju3+Bfa/j00kP0ULP5VRyDzTZ0/xaOIHySMxGCAaZsfafROHRpbrfQTpimNJMg98uRKpdQ1aUYYlP6NkR4/hds7XYavTbBujEZ9h6bPrTYCMeNr1nFsb4yldtKz2M/MyPTFg5+GEqwn1JkrXFBBpB61VKYljmVDkfH7rAcHpw2rAHeq9mxn4w9XbGD5Qk8J3XZJPPuE+XgwcXLWXWcrxP8g== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558021)(6072148); SRVR:BLUPR16MB0449; BCL:0; PCL:0; RULEID:; SRVR:BLUPR16MB0449; x-forefront-prvs: 0154C61618 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(6009001)(7916002)(39830400002)(39410400002)(39450400003)(199003)(377454003)(189002)(13464003)(24454002)(2950100002)(10290500002)(38730400001)(68736007)(7696004)(9686002)(76576001)(2900100001)(86362001)(66066001)(2906002)(8936002)(102836003)(3846002)(6506006)(80792005)(6116002)(92566002)(6436002)(77096006)(2501003)(8676002)(105586002)(99286002)(5001770100001)(81156014)(81166006)(97736004)(5660300001)(7736002)(122556002)(54356999)(76176999)(3280700002)(74316002)(3660700001)(189998001)(229853002)(101416001)(50986999)(305945005)(99936001)(33656002)(106356001)(107886002)(9010500006)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR16MB0449; H:BLUPR16MB0449.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_00CE_01D254A1.E7275C70" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Dec 2016 23:02:31.2656 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR16MB0449 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLKsWRmVeSWpSXmKPExsXCFeXNqDtBxz/C4OpjJoue1qtMFmsfX2Rx YPKY9v4Ym8eSJT+ZApiiuGxSUnMyy1KL9O0SuDIWHZnCVnDPo6L57gbGBsbVrl2MnBwSAiYS nWsaWEFsIYGPjBKHDufDxLfvXwYU5wKKf2OUeP3vDjuEc4xR4t3EtYwQzgtGiUddX1hAHBaB TmaJU10zmCEyk5kk9k9aAeUcYZTonDGRGWQym4COxO4djWwgtoiAh8TG5vlgtrCAnMTcm9uZ IeLyEhf2TmOCsK0kjndtArNZBFQlTvdPZgSxeQViJL5uOc0OcXm2ROOldWA2p4ChxMLbr8A+ YhQQk/h+ag1YL7OAuMStJ/OZIL4TkXh48TQbhC0q8fLxP6j6aImOHeuB3uEAiitK7D1dCVHi K/Hq6i5mGPvsqa1sIH9JCPSwSFyfeogdIpEtsfHuJ6iZ1hIrX31ghShayiRxfdJOqISMxO6N L5kgElvZJCb9OcMygVFnFpIDIeyFjBL7HrHMAntUUOLkzCdANgdQXE+ibSMjRIm8xPa3c5gh bGuJGb8OskHYihJTuh+yQ9imEq+PfmRcwMixilEhsTipOLckv7QksSDVwEivuDI3GUQkApNV sl5yfu4mRnDC+iG1g/HJHZ9DjAIcjEo8vDcl/SOEWBPLgCoPMaoAjXy0YfUFRimWvPy8VCUR 3pnaQGnelMTKqtSi/Pii0pzU4kOM0hwsSuK8CyLdIoQE0hNLUrNTUwtSi2CyTBycUg2MNjfF M46180YsyGL7/aC7puEzW/kiNrW/TTIK9w7bLTk4ocNfsyxR5tcs386W36pXtWo/FFyMbNki +2VH1fpy5zpPn7VRvi2397FpXGzk+r1GWUnuRvHh6bGMW9TMLxfMmz7h/CZRy9UBXVduhp1Q nMcw4fyJ/IsBN1ZZ+JtvFrYwSHxcJ9KjxFKckWioxVxUnAgATJ8VvWADAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA02SfyzUYRzH93y/3/v63s2tr/Prk4rcmFUSLcvS0tqqaxX9Wkmt+sY3DMfu ROqPyEqOTRx27EoaIokjuyuTMVQO0ZhKml+1MFJTTRnd3cPWP89en8/7/Xye5/3sYUhJp8CJ iZTH8wo5Fy2lRZQo5KBgc5ZnULC3emq7X+bNfsKvaqyX2k3I8r+107KSknniCBEi2hnGR0cm 8Iotuy6IIh605tJxn2RXUodqUDKq3KtCQgbYbaBvKhOokIiRsL8QTC1+tMJFO4KZ7CqEi68I RlVzlLmg2HQSOlQaEitqAppyypeLVgTpmmzSPJlmPaHBkEKb2Y6VgS61yMK2rDPcfa8ncd8F ehrzCcw74KWq1sIU6w7GLDUys5g9Cz+fGq3MLGGjIOXtEwsLWR8oHpwUmBmxDvC747FlL8k6 wofxIgKns4ORXiON2R4mxhaX/WfgtqHaFIcx9V2h0ZiELYdhsv85ucJdHfW0ORewmRQM5LVY YSEKdEM/lmf6Q8XkrACbSgkYyHm2LKyFBt0EgYV6GnIWOi2nSVge9BoP/BBOMNSXju6gDYX/ 3RtzMYIXo1ShJb8NvC4YNzFj6nvBLR3CFhfQT2tJzP6g+dNMY3aF3IwRK8y+MNX2Hd1HzCO0 nlNeVMbEx8RzXFyk91YvZVJMqHnhTL8q1Cs0NqYWWf7VX0cD6l441IJYBkmtxcPrgoIlAi7B 5GxBbqaRozWVPciJksfKeamduGCTSRaHcUlXeUXsecXlaF7ZgtYwlNRRbKtbOiVhw7l4Porn 43jFikowQqdkVBw2kWhvLdMI5SNZdoHd4T7zcgEd+Or4tdMKaVb1XJlD+ZzHqrSHhqMdN74c WDoRIEua3tNHNjdql9zUdRXuqun0Y/calmYSmon2/doK7Web622y3H0jb2YTjarVVPi76IzB tFL1yZCgQBvnujLZXE7EsO+ooetcnnXKJUlJeICUUkZwPhtJhZL7B1HCARNfAwAA Archived-At: Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 23:04:50 -0000 ------=_NextPart_000_00CE_01D254A1.E7275C70 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Yea, I'm stunned that 50% of respondents can operate in the strait jacket of TCSC, although I can see that working for Plex's customer IP address privacy concern. > -----Original Message----- > From: Trans [mailto:trans-bounces@ietf.org] On Behalf Of Matt Palmer > Sent: Monday, December 12, 2016 5:22 PM > To: trans@ietf.org > Subject: Re: [Trans] Redaction > > On Mon, Dec 12, 2016 at 05:30:20PM +0000, Jeremy Rowley wrote: > > We've been conducting short surveys of key customers to find out > > whether redaction is of interest to server operators, what form of > > redaction they'd like most, and why they are concerned about > > redaction. Here are the results so far: > > Can you share the sample size, respondent size, survey methodology, and > (anonymised, if necessary) raw result data? Summaries of response data are > far less enlightening than the actual responses data points. > > - Matt > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans ------=_NextPart_000_00CE_01D254A1.E7275C70 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEYYw ggQZMIIDAQIQYXDLSYxfmEUp57Cm2VBbejANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMx FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3Jr MTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv bmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRp b24gQXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkG A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp emVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCvCg3C1SzbZ7kt5ZQn3aW+4LBNj7NhVjzWfMP0zT6Gy6KI4uHYpGnFteK/waZHUF5GOYvVlrq1 bxS/EM4nE54FR5sxehPYH9nTAjeLrSxH8I6BBqcNMAzr9zwPIB3cckbupQLIW8PJVmlMxRjBkXsL 1RMAm7zvw0g+RmAghSrVkLbNi6DMMt23/UBVslAcVq7MjXdNxyBNpzF272iSipAeCIFWsq1po1LQ yxzEIz0fmf5M6BZjjsYIjvYx9tL65XbdtRySo0nNzQHNaM2pabqj6x0NnKQgpsGgxdFGTBdt0qxm P5aM4ITUNv8iWcX5EWCoXwR98hr2JUJhD8RKuD6JAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADQm FTzAjU1DSR296SGS12act97FuNDkXV92IsAm+YQ6OvmMtfvsYPHozgSwyN2nA48w85jfpOakMd/T HAtG3HIgP67uBTykMz8LOaxweHNLmSvfMMJUsKg7VaH+FijNQr10boDbJ0SnzkRd1BuQmA0eQpSx ACwE0HSjAgUiY2PNg7X7wW1ia2l1/V1wQbn1v3zfvsEycyIhi1iBexWRerrjZEiwf/s2JdqV0PEk FBfdGIBrRiM5VPWOYgkEHZSQppvmJeJCRaq4kK2+CI+pC0IYlM9yOeGxQ+Aoz7fnWmwTa0mz/+MY fImLM12sM9en+do6VclYEPmq71q2z0tL3yowggZMMIIFNKADAgECAhAcNy3LuXA+a7c+8/rRC0IG MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4x HzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlT aWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENs YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTAx MDYwMDAwMDBaFw0yNTAxMDUyMzU5NTlaMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50 ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsT LENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQDEyFT eW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw ggEKAoIBAQC21/RXe57fcFE+yEhkaEDBiW4/BJJK7Rx0JyDaOM9Skzy50VrHFy0+aE5haQuybmh5 9AJ2CvjSbrYbfntLxrVP2r34SQ4Cz+ytamfrzgR5vYTM85ojBNbPQj9JzpYn6ySuYdk0uWZ6vIOJ HxiUwGrAec5n4zVQiaJsde44X/H7ma7zF0gbFg8ZejRqIWZaFIMRQMKwntDbg87fBPIyQoMOZXsL Ko5ZZXgbyWwsTl4XLjL4yuv4pTQtVo5GiJU1l8mq2hkADD5tp7GRA+PmgTUTF/OeQJrZOcwKCoda HiIje9mGj1ZoiCDnhiqmNAd0WE2O3JsYFOEQOcYCgNy3jCD9AgMBAAGjggJEMIICQDASBgNVHRMB Af8ECDAGAQH/AgEAMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0 cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9ycGEwDgYDVR0PAQH/BAQDAgEGMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwud3Mu c3ltYW50ZWMuY29tL3BjYTItZzMuY3JsMCgGA1UdEQQhMB+kHTAbMRkwFwYDVQQDExBTeW1hbnRl Y1BLSS0yLTIzMB0GA1UdDgQWBBSkM6+ww0aHq+V4SbK04kaf6gn8FTCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejAN BgkqhkiG9w0BAQsFAAOCAQEAobYafeqzznZLxBH6OMpOEPGrh3+S6lCVJcA3aAL7gq2AyzPUzEMw sEVn+yKYhjzAFZ3XRY9qIYl922HdLZGqso3wyQ7WUCvWIDeRg9EUztoB0tDxzjsiQUgyeRtLpuDS 6H4ZAYfUahBN5gRevERnuE3u2eUk/qb4KhswvL/9sQxGXApV4XIfIDVO5rhZdfGHV/YFleeAXE49 JaPRPff9h1QjweUAMxYR6oB4w5xE6cOUtyZaSkxDF8qmlnf+flaPiA/o3edR0vgUtbtg4Lr/hb4C DU1a6yDtcphIeS91zOIEKwoA+8moz0X/wSI8hf8cy/zjVKMXfHtYEfxNTffKMjCCBxUwggX9oAMC AQICEDztlWuklUUR25LYiQfCRmEwDQYJKoZIhvcNAQELBQAwgbAxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0Ex KjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzAeFw0xNjA3MjAwMDAw MDBaFw0xNzA3MjAyMzU5NTlaMFgxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMSAwHgYD VQQLDBdTeW1hbnRlYyBFbXBsb3llZSBFbWFpbDEVMBMGA1UEAwwMU3RldmVuIE1lZGluMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvq01EJSDIsFS5i9XiwbGjdpqIA4wQ7syWfq4Ma68 tG7Rnpbowe06isw9AMe4jg+vfiD+YQ1ZTvzNEB0qc7XDtS9CGdWvbDZh2oWB/dk2K6nsxAqT9mlV vs+VrSDXzpKCua6vDLghmoaTnb3F4IXqMcsUEuu9JM42jJQkyHjy61FNtw/wH2JtdcWKtFQLPYa3 eNkYwciUGtAUpR78gYMjEGXNbeuuGGoWhY1Vo6kwFdhRBmDaowrJoyHuMFnsZ/qeg94GraI2yqDW Y3yTMWoD/RMik9pU2XG5KawZClRi9S1z5s8TILqLCqj4k/1On3+dnD0xP+toKOFLz3dCs64G3wID AQABo4IDgDCCA3wwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYI KwYBBQUHAwQwHQYDVR0OBBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCMGA1UdEQQcMBqBGFN0ZXZl X01lZGluQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQG CCsGAQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNv bTCCASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNE JTIwU3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1Ul MjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmli ZXIlMjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBP JTIwJTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRp ZmljYXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNv bS9jYV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1Ud IARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNv bS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcN AQkPBDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQB KjArBgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhF ARAFBCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3 DQEBCwUAA4IBAQAkFsvRsGAuybrzzBuilyhaw5EDCzYTHBL/dOMyrPgokGbHe0cQz7dEwbfkA7Q3 RI7J1JSOFXGSrbeHlx5vl9MkIIGU+76C64wf6sGmWiI9WIH8dDN0/MD1gyFVf6Hn136R9A11haNv FQUZse4UpTyBxMxpTyOqhMPJMDZpCDNKdEyUFkavYVWF0a8mGfH11S7aVPRGid+vyuHlZCTu9gbt LVFS2dG7w80ipCNRpFm9k2mKWw0yWtnfkNLJmGH+Pz2bDd/QZzw72t0PBYsjawMvNIaLblWGaS96 a0Uopc6gaBn9iejPNnXrTocaF+g2707Y4ge9H/4jJUT0+ouWnlVtMYIEqDCCBKQCAQEwgcUwgbAx CzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3lt YW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlk dWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0Eg LSBHMwIQPO2Va6SVRRHbktiJB8JGYTANBglghkgBZQMEAgEFAKCCArMwGAYJKoZIhvcNAQkDMQsG CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEyMjMwMjI5WjAvBgkqhkiG9w0BCQQxIgQg EwFDf6u5qT2AM/MLZ37yDnkBiJ5+McoAe7XFrn6Om8MwgZMGCSqGSIb3DQEJDzGBhTCBgjALBglg hkgBZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0D AgICAIAwDQYIKoZIhvcNAwICAUAwCwYJYIZIAWUDBAIBMAsGCWCGSAFlAwQCAzALBglghkgBZQME AgIwBwYFKw4DAhowgdYGCSsGAQQBgjcQBDGByDCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZh MIHYBgsqhkiG9w0BCRACCzGByKCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYDVQQLEyxD bGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgGA1UEAxMhU3lt YW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZhMA0GCSqGSIb3 DQEBAQUABIIBADJ6UnbjGt6n9uHMUxe47t0zavwkVtyTagsEmwJBckpM4SWC0lucCJ49C/q9+5i1 i1k5hyzHIRt7NDacgodyXN+1Qx585kd9Rf4cFLLkZmqyCWy3YBN/keYG+dTomspPCO6CLLypHoOf alFczs5eoLMNnfNlA08AM+JejUxdWAknRYwuy7LqUHaOjb5gaSAX+Vy7fpG+sg8rowq5kHJ+xhyY NgEUsIPYz5c7vB1wwL7Aai/HzYa9b09xZSFXjDwCJbtjv6CBkWlNLy1dNH4R/V29BFg5hfWmEkiX fJj+nYsmLrX5b2i6U4T3FXluP3KarwqyuvSTFENe+qj8ayESneMAAAAAAAA= ------=_NextPart_000_00CE_01D254A1.E7275C70-- From nobody Mon Dec 12 15:12:00 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB270129CBF for ; Mon, 12 Dec 2016 15:11:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8GiFVKU1M3we for ; Mon, 12 Dec 2016 15:11:57 -0800 (PST) Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D73F129F68 for ; Mon, 12 Dec 2016 15:08:41 -0800 (PST) Received: by mail-io0-x232.google.com with SMTP id p42so26100463ioo.1 for ; Mon, 12 Dec 2016 15:08:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=zeKsPGwQjxeyak1Z3kNWUCeGn8EuepV2uDE4aWoWBII=; b=aIGrgPfbyNljZWGvSLqrVcrwHEgszBRjdItve7OMgnbUSrjXBt8is2bWPt6lbY2r8P Hzx69xoMH0P/csR43L6t1AbHNam23DGcCvE8WsxqOEkOOWq8DXAz8sY1TP+Yx4VwQlL6 lYOObNJb6LGEAZzHcV1W5L+od7PYPnxmcPo4MsNG/Aw3crfErfoyvMohMMPXu03BHB3h Nz0zXt0nTFTpu9elXtnoO/3m0kUTF3BYd7v0L7hpfPvCq37inAXu4KcLcIDWfauDAMjO cGtx8FJTlCY43hNPElD22ZvXDhh2CprGvP8EW9bb/N6vX3pNh0G5wa/VtOxS+bwut0LP OAMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=zeKsPGwQjxeyak1Z3kNWUCeGn8EuepV2uDE4aWoWBII=; b=VsZGLEhGB19RibvzgKEdyThVdTC0iz9/gXFblTsfFfz2lMkEgvrDZLrCrx463kISYB NT/HsFEfMtDxGYWB4uNepdU6TcFGDWJY/VToQjWeS2wMSK1fnmEgXyZ5JRNd4z3UPTuu q7Ti2EH/X6PXug/YhatRks85vT3mQegoKFkm5gsx1ZWOZhveQw1+1KZWSSEPCZlm4ajG fOu/jQ+mcV+z5b8WOH0AlKiHv3Lt54StJyKnL6sItiCImtdAXlBxUcXQ3MBki4WfVD9g yeB/otV8L7C+cOqhoX9Y7vcFgaGpTfl47HRtBYw/v//kNxM+PWeOev29O2XAWXuU+fO8 1wZg== X-Gm-Message-State: AKaTC00IKTldgFd6K9mGR2KcAjKtPbEcMiwwffeuCB8AatgpBBlKFKvj/vSJ/Ukoh8bCHEA1ZME/lUwiVsFIog== X-Received: by 10.107.184.214 with SMTP id i205mr77503231iof.167.1481584120414; Mon, 12 Dec 2016 15:08:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.2.137 with HTTP; Mon, 12 Dec 2016 15:08:39 -0800 (PST) In-Reply-To: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> From: Peter Bowen Date: Mon, 12 Dec 2016 15:08:39 -0800 Message-ID: To: Steve Medin Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Matt Palmer , "trans@ietf.org" Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 23:11:59 -0000 On Mon, Dec 12, 2016 at 3:02 PM, Steve Medin wrote: > Yea, I'm stunned that 50% of respondents can operate in the strait jacket of > TCSC, although I can see that working for Plex's customer IP address privacy > concern. TCSC aligns with split-horizon DNS perfectly, so I'm not at all surprised at this result. From nobody Mon Dec 12 15:16:22 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9068C129EA4 for ; Mon, 12 Dec 2016 15:16:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.098 X-Spam-Level: X-Spam-Status: No, score=-7.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 752mOADVYOQ7 for ; Mon, 12 Dec 2016 15:16:19 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7E49129E68 for ; Mon, 12 Dec 2016 15:15:06 -0800 (PST) From: Jeremy Rowley Authentication-Results: mail.digicert.com; dkim=permerror (bad message/signature format) To: Steve Medin , Matt Palmer , "trans@ietf.org" Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAannQAAAFuH4AADpBY4A== Date: Mon, 12 Dec 2016 23:15:04 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [67.137.52.7] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_028D_01D25492.E58B8490" MIME-Version: 1.0 Archived-At: Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 23:16:20 -0000 ------=_NextPart_000_028D_01D25492.E58B8490 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit The survey is ongoing and informal, targeting our enterprise clients (over SMB). I wanted to get some data in place (even if informal) so there was some information about the need redaction. Although the survey is anonymous, we allowed participants to opt-out of the privacy, which means I should have real names to provide at the end of the survey. The list of questions: 1) Are you concerned about the Google requirement to log each certificate issued in a public database? 2) If yes, why are you concerned? 3) Would having a way to redact information from certificates alleviate your concern? 4) If yes, which proposal would you like DigiCert to support (select all): Hide the DNS label, Hid the subject information, issue under a technically constrained intermediate. 5) Any additional comments? 6) Do you plan on using CAA? Jeremy -----Original Message----- From: Trans [mailto:trans-bounces@ietf.org] On Behalf Of Steve Medin Sent: Monday, December 12, 2016 4:03 PM To: Matt Palmer ; trans@ietf.org Subject: Re: [Trans] Redaction Yea, I'm stunned that 50% of respondents can operate in the strait jacket of TCSC, although I can see that working for Plex's customer IP address privacy concern. > -----Original Message----- > From: Trans [mailto:trans-bounces@ietf.org] On Behalf Of Matt Palmer > Sent: Monday, December 12, 2016 5:22 PM > To: trans@ietf.org > Subject: Re: [Trans] Redaction > > On Mon, Dec 12, 2016 at 05:30:20PM +0000, Jeremy Rowley wrote: > > We've been conducting short surveys of key customers to find out > > whether redaction is of interest to server operators, what form of > > redaction they'd like most, and why they are concerned about > > redaction. Here are the results so far: > > Can you share the sample size, respondent size, survey methodology, > and (anonymised, if necessary) raw result data? Summaries of response > data are > far less enlightening than the actual responses data points. > > - Matt > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans ------=_NextPart_000_028D_01D25492.E58B8490 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPdzCCA7cw ggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShY YAz4gNqpFZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g 1x/isdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm+qTZ 1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusIXxh3TwID AQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SS y4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTT PYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mzXeuy CSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTrQrf6jB7dYvG+UGe3 bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVt bI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCyp/oKRS+i8PIwggVmMIIETqADAgECAhALgHcH Lzs1YGO/amtK2gTIMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNI QTIgQXNzdXJlZCBJRCBDQTAeFw0xNTEwMTMwMDAwMDBaFw0xOTAxMTAxMjAwMDBaMIGBMQswCQYD VQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNlcnQx FjAUBgNVBAMTDUplcmVteSBSb3dsZXkxKTAnBgkqhkiG9w0BCQEWGmplcmVteS5yb3dsZXlAZGln aWNlcnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8kPdqjF+ljW5h8W7mQpM jaGlZ9YDLYTtUzcQjl71vRI4M6WSiZiUfbueAgupsQnxvl8By0BdwVmXnOIAUvqpFqzZhNIc8DGH M+uvXgT4+aoQvn9qPlt04CN5hzE/GFVvqs3neWgGfkzp1Z5H6RiqNoTOzdDWyr09Q8Gzm1jW9lTq sX0cxqooYtk29ooq12BvbVz0Jjgtt4Erdp27bTth11CaulJUDRT39YLLAwiR0bw3eMu8DCyuXAwV D68Ux33UbgYU9uvyFxBhJ83ST+1aw0r4E6iYTlQnKtYjEoNwlifhkwm4xS+lQHuTirpJGRFV42hd l9AtWQKRGuCUBL5EdwIDAQABo4IB8zCCAe8wHwYDVR0jBBgwFoAU5wIjgABP2Ne8lAvZP3Q5STI8 inkwHQYDVR0OBBYEFPEtLfkj2twAoaYEb8gixWV8QW8HMAwGA1UdEwEB/wQCMAAwJQYDVR0RBB4w HIEaamVyZW15LnJvd2xleUBkaWdpY2VydC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG CCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCGSAGG/WwEAQIwKjAoBggrBgEFBQcC ARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBiAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmwwPaA7oDmG N2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmww eQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYI KwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVk SURDQS5jcnQwDQYJKoZIhvcNAQELBQADggEBAKy4O+nfR40jBgIFlaomX723rsDsnP/MT7xA9waf /K/JSqkfi97389rH0IXxwcEG/ne664wDmq4tZ9EfFkT2cGv0+itbcCDETeeu9bqOj6/LbXiYj9EB zyRFTcZih4NBIVEpTEcEIZfFfNWn3yDocY6K9wZFaM4UKLAqsnN0xYEKCNkSFsWv1Ol/8J3p363A f+PrswxqzejMiYvsi0nFYPFUMby901Crme/n4xpIJ57mLWy28YshNFip8sIOmCdVJcJ9KU65YljF 5D0cWyFk4xslKhHz6x3LKwqQmpedxWG3zYJVcaqLuTyZSqaewzJ5q8qH+usnmkmb+tcF/SDFD7Aw ggZOMIIFNqADAgECAhAErnlgZmaQGrnFf6ZsW9zNMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xMzExMDUxMjAwMDBaFw0yODEx MDUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANz4ESM/arXvwCd5Gy0Fh6IQQzHfDtQVG093 pCLOPoxw8L4Hjt0nKrwBHbYsCsrdaVgfQe1qBR/aY3hZHiIsK/i6fsk1O1bxH3xCfiWwIxnGRTjX PUT5IHxgrhywWhgEvo8796nwlJqmDGNJtkEXU0AyvU/mUHpQHyVF6PGJr83/Xv9Q8/AXEf+9xYn1 vWK52PuORQSFbZnNxUhN/SarAjZF6jbXX2riGoJBCtzp2fWRF47GIa04PBPmHn9mnNVN2Uba9s9S p307JMO0wVE1xpvr1O9+5HsD4US9egs34E/LgooNcRjkpuCJLBvzsnM8wbCSnhh9vat9xX0IoSzC n3MCAwEAAaOCAvgwggL0MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsG AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMIGBBgNVHR8E ejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290 Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDCCAbMGA1UdIASCAaowggGm MIIBogYKYIZIAYb9bAACBDCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNv bS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBz ACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMA ZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQ AFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUA ZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABh AG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIA eQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFOcCI4AAT9jXvJQL2T90OUkyPIp5MB8G A1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQBO1Iknuf0d h3d+DygFkPEKL8k7Pr2TnJDGr/qRUYcyVGvoysFxUVyZjrX64GIZmaYHmnwTJ9vlAqKEEtkV9gpE V8Q0j21zHzrWoAE93uOC5EVrsusl/YBeHTmQvltC9s6RYOP5oFYMSBDOM2h7zZOr8GrLT1gPuXtd GwSBnqci4ldJJ+6Skwi+aQhTAjouXcgZ9FCATgLZsF2RtJOH+ZaWgVVAjmbtgti7KF/tTGHtBlgo GVMRRLxHICmyBGzYiVSZO3XbZ3gsHpJ4xlU9WBIRMm69QwxNNNt7xkLb7L6rm2FMBpLjjt8hKlBX BMBgojXVJJ5mNwlJz9X4ZbPg4m7CMYIDrzCCA6sCAQEweTBlMQswCQYDVQQGEwJVUzEVMBMGA1UE ChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdp Q2VydCBTSEEyIEFzc3VyZWQgSUQgQ0ECEAuAdwcvOzVgY79qa0raBMgwCQYFKw4DAhoFAKCCAgsw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEyMjMxNTA0WjAj BgkqhkiG9w0BCQQxFgQUOmVKETI9NfdO065AXMD4dLLVf2EwgYgGCSsGAQQBgjcQBDF7MHkwZTEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0 LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK 2gTIMIGKBgsqhkiG9w0BCRACCzF7oHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0 IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK2gTIMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZI AWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwIC AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJ YIZIAWUDBAIBMA0GCSqGSIb3DQEBAQUABIIBACnHPSUx5qSIVlpvHzO3xcXYjInKCryCJrS50VOc +Ow3ayaKJ7uxKGuMABIZ9V56WHjUrlwMA+ZQfnvlOh+Q/uOXdA2NqbgUhcOwjDMLUzYvkdzlSlTS 3PGykGiT0eJcmtplk8o3tN3yG0R9ZKUBgFIXdxgXpGSxlMDv+aZhsBp3zjviH8GjL+E58zPTilcW M2t9TIQzRt7boc7jvC+zKr21Mr2300x+hEcjQKTuSTpVIVHtZkOqoBQ4HPmmKqjbOWTRJO/SDwEn 1TA7MU+T6kp0oz/ear3tGkKU//y3qzV/ycyN4Gq9oZ1e52fBXRUKiL4eVqYdF5jkWyVqYqBDwmwA AAAAAAA= ------=_NextPart_000_028D_01D25492.E58B8490-- From nobody Mon Dec 12 16:53:33 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 191B9129FD5 for ; Mon, 12 Dec 2016 16:53:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JfE82SiAFnnm for ; Mon, 12 Dec 2016 16:53:28 -0800 (PST) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F36F129FAD for ; Mon, 12 Dec 2016 16:53:28 -0800 (PST) Received: (qmail 31485 invoked by uid 1004); 13 Dec 2016 00:53:26 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Tue, 13 Dec 2016 00:53:26 +0000 Received: (qmail 3341 invoked by uid 1000); 13 Dec 2016 00:53:26 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Tue, 13 Dec 2016 00:53:26 +0000 To: Eran Messeri , "trans@ietf.org" References: From: Rob Stradling Message-ID: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> Date: Tue, 13 Dec 2016 00:53:25 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 00:53:32 -0000 On 12/12/16 15:54, Eran Messeri wrote: > Some background as to why I propose each of the policies: > * Expert Review for Hash algorithm and Signature algorithm: The > algorithm selection does not affect the behaviour of the protocol. > However, an expect should make sure proposed additions are suitable (for > example, that a proposed hash algorithm does not suffer from known > preimage attacks). https://tools.ietf.org/html/rfc5226 section 4.1 says (emphasis mine): "Expert Review (or Designated Expert) - approval by a Designated Expert is required. The *required documentation* and review criteria for use by the Designated Expert should be provided when defining the registry." So I think we should specify both Expert Review and Specification Required, just as (for example) https://tools.ietf.org/html/rfc6844 section 7.2 does: "Addition of tag identifiers requires a public specification and Expert Review as set out in..." Separately, should we reserve some values in either or both of these registries for Private Use or for Experimental Use? > * Specification requirement for SCT & STH extensions: new values for > these extensions are meaningless without specifying what they do - how > should clients behave when encountering them. +1 (and for the VersionedTransType registry we just added too) Separately, should we reserve some values in any of these registries for Private Use or for Experimental Use? > * First-come-first-served for Log IDs: I can't see how an expect review > could be meaningful, given log operators requesting those IDs can't > really prove competence to "own" log IDs, so requiring a "minimal amount > of clerical information" seems enough. +1 > Eran > > On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri > wrote: > > No policy has been specified in 6962-bis for adding values to the > IANA registries requested. > > In https://github.com/google/certificate-transparency-rfcs/pull/215 > I > propose the following policies, all based on definitions in RFC5226: > * Hash algorithms and Signature algorithms: Expert Review > * SCT extensions and STH extensions: Specification Required > * Log ID 1, Log ID 2: First Come First Served. > > Feedback welcome, since, as far as I recall, this topic was not > discussed on the list previously. > > Eran > > > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online Office Tel: +44.(0)1274.730505 Office Fax: +44.(0)1274.730909 www.comodo.com COMODO CA Limited, Registered in England No. 04058690 Registered Office: 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Manchester M5 3EQ This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software. From nobody Mon Dec 12 17:39:26 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13C1912A009 for ; Mon, 12 Dec 2016 17:39:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OBS4qb2bNqHR for ; Mon, 12 Dec 2016 17:39:22 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A55A712A01C for ; Mon, 12 Dec 2016 17:39:21 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3td2S65Fhjz1Kk; Tue, 13 Dec 2016 02:39:18 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1481593158; bh=LtmkZz4gtd9j6aMRtr/xj7B+CK75y9pgTSDz7uVS18U=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=SS2ntqI8z26xNnFRsEC+3Q3/r6wKiGUkUTTODCSvpDJWlHeHkz2L/1YyDxqazeFBj gaAtSmUmBJDgUnbE+1Y1KHjdGv4Yl+YqAX8It1eJNr0o8BvtHJ9og3Dmle/6AitvnH 8LRvgFLM5L0CQ1B8Q1wweLb+/Z9xfPzm8TY9OxRE= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id c2DFhKqve47G; Tue, 13 Dec 2016 02:39:16 +0100 (CET) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 13 Dec 2016 02:39:16 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id B42A74A2E3F; Mon, 12 Dec 2016 20:39:05 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca B42A74A2E3F Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id A28D041CCC88; Mon, 12 Dec 2016 20:39:05 -0500 (EST) Date: Mon, 12 Dec 2016 20:39:05 -0500 (EST) From: Paul Wouters To: Rob Stradling In-Reply-To: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> Message-ID: References: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Cc: Eran Messeri , "trans@ietf.org" , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 01:39:25 -0000 On Tue, 13 Dec 2016, Rob Stradling wrote: > https://tools.ietf.org/html/rfc5226 section 4.1 says (emphasis mine): > "Expert Review (or Designated Expert) - approval by a Designated > Expert is required. The *required documentation* and review > criteria for use by the Designated Expert should be provided > when defining the registry." > > So I think we should specify both Expert Review and Specification Required, > just as (for example) https://tools.ietf.org/html/rfc6844 section 7.2 does: > "Addition of tag identifiers requires a public specification and > Expert Review as set out in..." Sounds good. > Separately, should we reserve some values in either or both of these > registries for Private Use or for Experimental Use? Yes please. >> * Specification requirement for SCT & STH extensions: new values for >> these extensions are meaningless without specifying what they do - how >> should clients behave when encountering them. > > +1 (and for the VersionedTransType registry we just added too) > > Separately, should we reserve some values in any of these registries for > Private Use or for Experimental Use? Yes. >> * First-come-first-served for Log IDs: I can't see how an expect review >> could be meaningful, given log operators requesting those IDs can't >> really prove competence to "own" log IDs, so requiring a "minimal amount >> of clerical information" seems enough. > > +1 It would be nice to have some kind of rules or documentation, and at least have an Expert around to block strange or excessive requests? Stephen: how would you see this happening? Paul >> Eran >> >> On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri > > wrote: >> >> No policy has been specified in 6962-bis for adding values to the >> IANA registries requested. >> >> In https://github.com/google/certificate-transparency-rfcs/pull/215 >> I >> propose the following policies, all based on definitions in RFC5226: >> * Hash algorithms and Signature algorithms: Expert Review >> * SCT extensions and STH extensions: Specification Required >> * Log ID 1, Log ID 2: First Come First Served. >> >> Feedback welcome, since, as far as I recall, this topic was not >> discussed on the list previously. >> >> Eran >> >> >> >> >> _______________________________________________ >> Trans mailing list >> Trans@ietf.org >> https://www.ietf.org/mailman/listinfo/trans >> > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > Office Tel: +44.(0)1274.730505 > Office Fax: +44.(0)1274.730909 > www.comodo.com > > COMODO CA Limited, Registered in England No. 04058690 > Registered Office: > 3rd Floor, 26 Office Village, Exchange Quay, > Trafford Road, Salford, Manchester M5 3EQ > > This e-mail and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the sender by replying > to the e-mail containing this attachment. Replies to this email may be > monitored by COMODO for operational or business reasons. Whilst every > endeavour is taken to ensure that e-mails are free from viruses, no liability > can be accepted and the recipient is requested to use their own virus > checking software. > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > > From nobody Mon Dec 12 19:10:51 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4536B12A058 for ; Mon, 12 Dec 2016 19:10:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.117 X-Spam-Level: X-Spam-Status: No, score=-7.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PIrjuUZftvHE for ; Mon, 12 Dec 2016 19:10:46 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F35512A056 for ; Mon, 12 Dec 2016 19:10:46 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat6.net.symantec.com [10.90.75.6]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id AA.88.03942.2B66F485; Tue, 13 Dec 2016 03:10:44 +0000 (GMT) X-AuditID: 0a5af819-dcd5b9a000000f66-67-584f66b42f02 Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat4.net.symantec.com [10.90.75.4]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id DC.6C.04050.FA66F485; Tue, 13 Dec 2016 03:10:42 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 12 Dec 2016 19:10:38 -0800 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (10.44.128.6) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Mon, 12 Dec 2016 19:10:38 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=boJ7X3/qZy0mD96oZoI9fMLkBBbxaovJXYvuBO91ljg=; b=LoQdKrBHLnQ4Ocv6qLs1mHSyeetextx+iKay+FhTz7Fkowz68GTA2PyV8D54UjMWnLwyS6a6BG+WZfb94SWnkMi3awcKp9vNVprO5ImmdO2BCc1eVnRGBX9cH2odLbWTVpMnuR9y3qMmQSrlWblr7AHeTnlVbu68T2SzdYbUGCA= Received: from BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) by BLUPR16MB0450.namprd16.prod.outlook.com (10.164.16.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.761.9; Tue, 13 Dec 2016 03:10:36 +0000 Received: from BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) by BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) with mapi id 15.01.0771.014; Tue, 13 Dec 2016 03:10:35 +0000 From: Steve Medin To: Peter Bowen Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAL810AAAFHujAAAF07gAAHr5cw Date: Tue, 13 Dec 2016 03:10:35 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Steve_Medin@symantec.com; x-originating-ip: [155.64.138.28] x-ms-office365-filtering-correlation-id: 3578a6aa-488f-4c3d-f971-08d423059b99 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:BLUPR16MB0450; x-microsoft-exchange-diagnostics: 1; BLUPR16MB0450; 7:ZsJc5BUQeGb9ThzCFQ6h1cwo9S69aS3magRVZWbEyazCZAlIdn62Rrt3e8dNozeAPR1wLHih07DqOXcDvgL4IGEPk2bJcpVW4aEpOOml1S7EwZHKk6YY+fKPXJnBuxiz7MP1Ld2O9cnvSpl4PScC8fCAVibyUjDLtMgQM5wq/RTHzLbykXi62JZKFuVdvN9Dfm9N2jBXw5EkqtpN8niS34Ff9Od8AXqs0wAw5MpjUZ3rESwIy39UTcNfwiQ7AdviqzJqNoEtC/wsdrNS0LEKYcdbVr+PjXQcFiLYE6JrujVBIqMHpZKQyRUwEAqt0d+fIXmqE8MqkYobuG7KHiRt/5ZePTgoKBCzLIB/oObuUSbDrzKpk4thEeYEY4E83NL87zrxlQBDw0QWc3Cm6QZ8OEnWRGbJBqDAFtAAapmCM36rtuVtS4sHpjG6KyocFOj7wn4qS+W2gEXOxYpxRgoDxA== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123560025)(6072148); SRVR:BLUPR16MB0450; BCL:0; PCL:0; RULEID:; SRVR:BLUPR16MB0450; x-forefront-prvs: 01559F388D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(7916002)(39830400002)(39410400002)(39450400003)(13464003)(24454002)(377454003)(189002)(199003)(76176999)(74316002)(99936001)(68736007)(106356001)(6506006)(80792005)(50986999)(54356999)(122556002)(105586002)(8936002)(99286002)(97736004)(101416001)(77096006)(38730400001)(5660300001)(39060400001)(110136003)(33656002)(6916009)(93886004)(2950100002)(229853002)(7696004)(3660700001)(76576001)(3280700002)(9686002)(6436002)(7736002)(86362001)(305945005)(8676002)(4326007)(2906002)(66066001)(2900100001)(1411001)(92566002)(189998001)(81156014)(10290500002)(81166006)(102836003)(3846002)(6116002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR16MB0450; H:BLUPR16MB0449.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_020F_01D254C4.8EB05650" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2016 03:10:35.6088 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR16MB0450 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrBKsWRmVeSWpSXmKPExsXCFeXNprslzT/C4NdVS4ue1qtMFv8fvGSx WPv4IosDs8fOWXfZPaa9P8bmsWTJT6YA5igum5TUnMyy1CJ9uwSujK+X1zEXXPKqmHHgKVMD 4xu3LkZODgkBE4njy7+zdzFycQgJfGSU2LBlHpDDAZZYeMIdIv6NUeLptn2sEM4RRolnxycz QjgvGCVmdmxkBnFYBDqZJVb0fIAqm8wksWrRFCa4ntmN/1lBNrIJ6Ejs3tHIBmKLCChL/GxY CLaQWcBDYupBOZCwsICcxNyb25khSuQlLuydxgRhu0nMa3kGFmcRUJVY8WApmM0rECOxd+dD qCdamSQ2vWthB0lwCgRKbO/eCLaXUUBM4vupNWCDmAXEJW49mc8ECQERiYcXT7NB2KISLx// g6qPlujYsZ4FEhiKEntPV0KU+Epc2LSZEcb+c+cY2F4JgR4Wibm/L0DNyZZYvvQaVJGWRMeR WUwQRVOZJI7OWsYMkZCR2DxvJ9sERt1ZSG6aBVTHLLCQUWJJz3/2WWDfCUqcnPmEBaJIW+Lp zadQtrzE9rdzmCFsa4kZvw6yQdiKElO6H7JD2KYSr49+ZFzAyLGKUSGxOKk4tyS/tCSxINXA UK+4MjcZRCQCU1iyXnJ+7iZGcBr7IbmD8cgJn0OMAhyMSjy802L8I4RYE8uAKg8xqgCNfLRh 9QVGKZa8/LxUJRFe5yigNG9KYmVValF+fFFpTmrxIUZpDhYlcd4FkW4RQgLpiSWp2ampBalF MFkmDk6pBsazflWTn3hEfFM+5yjfcKN5VWRL8fRrcpP8Jog5KlfMfTNnkkbQOcU/Pplqd3b0 Xdz6VDc6lU1R5919Wa9/TWd2aMQlHu7/rPprrXtGZLO3Xd3aUq5ZSb6BriG3XtyPupIgZxUi ap82O/gO85qlqRwvphSwzapKkbtTbeklpdP35mpluhnXfiWW4oxEQy3mouJEAIh5yaFrAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrOKsWRmVeSWpSXmKPExsXCFeXNorspzT/CYMNJLYue1qtMFv8fvGSx WPv4IosDs8fOWXfZPaa9P8bmsWTJT6YA5igum5TUnMyy1CJ9uwSujK+X1zEXXPKqmHHgKVMD 4xu3LkYODgkBE4mFJ9y7GLk4hAS+MUo83baPFcI5wijx7PhkRgjnBaPEzI6NzCAOi0Ans8SK ng9QZZOZJFYtmsIE1zO78T9QhpODTUBHYveORjYQW0RAWeJnw0J2kIXMAh4SUw/KgYSFBeQk 5t7czgxRIi9xYe80JgjbTWJeyzOwOIuAqsSKB0vBbF6BGIm9Ox+yQ+xqZZLY9K6FHSTBKRAo sb17I9heRgExie+n1oANYhYQl7j1ZD6YLSEgIvHw4mk2CFtU4uXjf1D10RIdO9azQAJDUWLv 6UqIEl+JC5s2M8LYf+4cA9srIdDDIjH39wWoOdkSy5degyrSkug4MosJomgqk8TRWcuYIRIy Epvn7WSDSMxlkzjS8pQRZJuQQKrE9hnqExi1ZiG5dRZQGbPAQkaJJT3/2WeBfS0ocXLmExaI Im2JpzefQtnyEtvfzmGGsK0lZvw6yAZhK0pM6X7IDmGbSrw++pFxASPHKkaFxOKk4tyS3JLE xIJMAyO94srcZBCRCExgyXrJ+bmbGMFJ7Lf4DsZzf3wOMQpwMCrx8D6Q9Y8QYk0sA6o8xKgC NPLRhtUXGKVY8vLzUpVEeJ2jgNK8KYmVValF+fFFpTmpxYcYpTlYlMR5hTf+DxcSSE8sSc1O TS1ILYLJMnFwSjUwqoUydhrw7IjN+bRkS+OW3rfuMhuFrBQe7ouLs6lzWKfyKqM15lYde3nu Gv21CY/zPiYZxP0VUFI7nfjsktk/6RmvMrpED4mddK5cIrrne1Wt4/HPG7urA/SuZGUwy+hn 2y65flSt5BZ7yZG5zf39Kye38u7/xdB701NzFrviZ43VAUwp+S5KLMUZiYZazEXFiQDfsNrS agMAAA== Archived-At: Cc: Matt Palmer , "trans@ietf.org" Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 03:10:48 -0000 ------=_NextPart_000_020F_01D254C4.8EB05650 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Yea, but when I talk about the Plex Pass certs, I'm not on the internal network privacy concern that split-horizon suits, I'm talking about how TCSC fits customers with static and limited domain ownership. The concern I saw in my recent past was needing to frequently add names to a name constraint extension, and managing N generations of intermediate CAs as they are expanded with new public domain realty present in external DNS and directory names that represent localized global brand presence and expansion. In that same past, I produced a 23kb TCSC as an interim to a dynamically modified managed service and enterprise RA. Fortunately, it broke zero browsers. > -----Original Message----- > From: Peter Bowen [mailto:pzbowen@gmail.com] > Sent: Monday, December 12, 2016 6:09 PM > To: Steve Medin > Cc: Matt Palmer ; trans@ietf.org > Subject: Re: [Trans] Redaction > > On Mon, Dec 12, 2016 at 3:02 PM, Steve Medin > wrote: > > Yea, I'm stunned that 50% of respondents can operate in the strait > > jacket of TCSC, although I can see that working for Plex's customer IP > > address privacy concern. > > TCSC aligns with split-horizon DNS perfectly, so I'm not at all surprised at > this > result. ------=_NextPart_000_020F_01D254C4.8EB05650 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEYYw ggQZMIIDAQIQYXDLSYxfmEUp57Cm2VBbejANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMx FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3Jr MTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv bmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRp b24gQXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkG A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp emVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCvCg3C1SzbZ7kt5ZQn3aW+4LBNj7NhVjzWfMP0zT6Gy6KI4uHYpGnFteK/waZHUF5GOYvVlrq1 bxS/EM4nE54FR5sxehPYH9nTAjeLrSxH8I6BBqcNMAzr9zwPIB3cckbupQLIW8PJVmlMxRjBkXsL 1RMAm7zvw0g+RmAghSrVkLbNi6DMMt23/UBVslAcVq7MjXdNxyBNpzF272iSipAeCIFWsq1po1LQ yxzEIz0fmf5M6BZjjsYIjvYx9tL65XbdtRySo0nNzQHNaM2pabqj6x0NnKQgpsGgxdFGTBdt0qxm P5aM4ITUNv8iWcX5EWCoXwR98hr2JUJhD8RKuD6JAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADQm FTzAjU1DSR296SGS12act97FuNDkXV92IsAm+YQ6OvmMtfvsYPHozgSwyN2nA48w85jfpOakMd/T HAtG3HIgP67uBTykMz8LOaxweHNLmSvfMMJUsKg7VaH+FijNQr10boDbJ0SnzkRd1BuQmA0eQpSx ACwE0HSjAgUiY2PNg7X7wW1ia2l1/V1wQbn1v3zfvsEycyIhi1iBexWRerrjZEiwf/s2JdqV0PEk FBfdGIBrRiM5VPWOYgkEHZSQppvmJeJCRaq4kK2+CI+pC0IYlM9yOeGxQ+Aoz7fnWmwTa0mz/+MY fImLM12sM9en+do6VclYEPmq71q2z0tL3yowggZMMIIFNKADAgECAhAcNy3LuXA+a7c+8/rRC0IG MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4x HzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlT aWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENs YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTAx MDYwMDAwMDBaFw0yNTAxMDUyMzU5NTlaMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50 ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsT LENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQDEyFT eW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw ggEKAoIBAQC21/RXe57fcFE+yEhkaEDBiW4/BJJK7Rx0JyDaOM9Skzy50VrHFy0+aE5haQuybmh5 9AJ2CvjSbrYbfntLxrVP2r34SQ4Cz+ytamfrzgR5vYTM85ojBNbPQj9JzpYn6ySuYdk0uWZ6vIOJ HxiUwGrAec5n4zVQiaJsde44X/H7ma7zF0gbFg8ZejRqIWZaFIMRQMKwntDbg87fBPIyQoMOZXsL Ko5ZZXgbyWwsTl4XLjL4yuv4pTQtVo5GiJU1l8mq2hkADD5tp7GRA+PmgTUTF/OeQJrZOcwKCoda HiIje9mGj1ZoiCDnhiqmNAd0WE2O3JsYFOEQOcYCgNy3jCD9AgMBAAGjggJEMIICQDASBgNVHRMB Af8ECDAGAQH/AgEAMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0 cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9ycGEwDgYDVR0PAQH/BAQDAgEGMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwud3Mu c3ltYW50ZWMuY29tL3BjYTItZzMuY3JsMCgGA1UdEQQhMB+kHTAbMRkwFwYDVQQDExBTeW1hbnRl Y1BLSS0yLTIzMB0GA1UdDgQWBBSkM6+ww0aHq+V4SbK04kaf6gn8FTCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejAN BgkqhkiG9w0BAQsFAAOCAQEAobYafeqzznZLxBH6OMpOEPGrh3+S6lCVJcA3aAL7gq2AyzPUzEMw sEVn+yKYhjzAFZ3XRY9qIYl922HdLZGqso3wyQ7WUCvWIDeRg9EUztoB0tDxzjsiQUgyeRtLpuDS 6H4ZAYfUahBN5gRevERnuE3u2eUk/qb4KhswvL/9sQxGXApV4XIfIDVO5rhZdfGHV/YFleeAXE49 JaPRPff9h1QjweUAMxYR6oB4w5xE6cOUtyZaSkxDF8qmlnf+flaPiA/o3edR0vgUtbtg4Lr/hb4C DU1a6yDtcphIeS91zOIEKwoA+8moz0X/wSI8hf8cy/zjVKMXfHtYEfxNTffKMjCCBxUwggX9oAMC AQICEDztlWuklUUR25LYiQfCRmEwDQYJKoZIhvcNAQELBQAwgbAxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0Ex KjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzAeFw0xNjA3MjAwMDAw MDBaFw0xNzA3MjAyMzU5NTlaMFgxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMSAwHgYD VQQLDBdTeW1hbnRlYyBFbXBsb3llZSBFbWFpbDEVMBMGA1UEAwwMU3RldmVuIE1lZGluMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvq01EJSDIsFS5i9XiwbGjdpqIA4wQ7syWfq4Ma68 tG7Rnpbowe06isw9AMe4jg+vfiD+YQ1ZTvzNEB0qc7XDtS9CGdWvbDZh2oWB/dk2K6nsxAqT9mlV vs+VrSDXzpKCua6vDLghmoaTnb3F4IXqMcsUEuu9JM42jJQkyHjy61FNtw/wH2JtdcWKtFQLPYa3 eNkYwciUGtAUpR78gYMjEGXNbeuuGGoWhY1Vo6kwFdhRBmDaowrJoyHuMFnsZ/qeg94GraI2yqDW Y3yTMWoD/RMik9pU2XG5KawZClRi9S1z5s8TILqLCqj4k/1On3+dnD0xP+toKOFLz3dCs64G3wID AQABo4IDgDCCA3wwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYI KwYBBQUHAwQwHQYDVR0OBBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCMGA1UdEQQcMBqBGFN0ZXZl X01lZGluQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQG CCsGAQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNv bTCCASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNE JTIwU3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1Ul MjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmli ZXIlMjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBP JTIwJTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRp ZmljYXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNv bS9jYV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1Ud IARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNv bS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcN AQkPBDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQB KjArBgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhF ARAFBCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3 DQEBCwUAA4IBAQAkFsvRsGAuybrzzBuilyhaw5EDCzYTHBL/dOMyrPgokGbHe0cQz7dEwbfkA7Q3 RI7J1JSOFXGSrbeHlx5vl9MkIIGU+76C64wf6sGmWiI9WIH8dDN0/MD1gyFVf6Hn136R9A11haNv FQUZse4UpTyBxMxpTyOqhMPJMDZpCDNKdEyUFkavYVWF0a8mGfH11S7aVPRGid+vyuHlZCTu9gbt LVFS2dG7w80ipCNRpFm9k2mKWw0yWtnfkNLJmGH+Pz2bDd/QZzw72t0PBYsjawMvNIaLblWGaS96 a0Uopc6gaBn9iejPNnXrTocaF+g2707Y4ge9H/4jJUT0+ouWnlVtMYIEqDCCBKQCAQEwgcUwgbAx CzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3lt YW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlk dWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0Eg LSBHMwIQPO2Va6SVRRHbktiJB8JGYTANBglghkgBZQMEAgEFAKCCArMwGAYJKoZIhvcNAQkDMQsG CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEzMDMxMDMzWjAvBgkqhkiG9w0BCQQxIgQg f/HtAhOIDTIcc+snRy/Nd0bIvCQJPAgGOnBgcsAYfHEwgZMGCSqGSIb3DQEJDzGBhTCBgjALBglg hkgBZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0D AgICAIAwDQYIKoZIhvcNAwICAUAwCwYJYIZIAWUDBAIBMAsGCWCGSAFlAwQCAzALBglghkgBZQME AgIwBwYFKw4DAhowgdYGCSsGAQQBgjcQBDGByDCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZh MIHYBgsqhkiG9w0BCRACCzGByKCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYDVQQLEyxD bGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgGA1UEAxMhU3lt YW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZhMA0GCSqGSIb3 DQEBAQUABIIBAA32roQewGtPv1gtOdcfVHBOkvKWGQRZvk0RQiK2QqFEA3R4e6u6ajx6+Xwx3yMw aXvmFoSgTIR+T6fvRtugPVkR7BL3bjWvJFExfcMeOPDpgualS/A078dBC0lLOQitjQihqOg34B02 hdPSqMvgdeHgtYhC+gZd2uo1VmqMkeReHlXbOpi7odryy+G2487ptXkfX2nmH2K5zpjAu7CezGMj MLKKbscmHUvB9eo3JzAdENumTvYcY3zSmmCwWOvRTOnnk7MiBL3TMNErlw+/rfFwtMiZjlZqqmSe 7up63aPiUpfksd4bpt00najUoBSa+HagzoaDcpVFTOmXgN/L9OEAAAAAAAA= ------=_NextPart_000_020F_01D254C4.8EB05650-- From nobody Mon Dec 12 19:47:54 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EE00129578 for ; Mon, 12 Dec 2016 19:47:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.501 X-Spam-Level: X-Spam-Status: No, score=-1.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ojM8YT_GMS94 for ; Mon, 12 Dec 2016 19:47:46 -0800 (PST) Received: from homiemail-a108.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 961DC129577 for ; Mon, 12 Dec 2016 19:47:46 -0800 (PST) Received: from homiemail-a108.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a108.g.dreamhost.com (Postfix) with ESMTP id 685722004760B for ; Mon, 12 Dec 2016 19:47:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=5rmPdxvy5V0KCVsBmE7ejdfdWUw=; b= IcZhnEBpqFesPt3fmnwh+sJBKdaKJIUx2+UYPddl8ANaUmE8ycsZFTOPc2BvajVk j7mnu4l3U4WinVnfXp0MOaWQ5wq0VmT8DDKnGjkcJOMMd75TtU2rLd4aytkKfY3l /DzGGCozTyDvYhSmQ255ohMkNRCUn/AMQmFZMVnESbw= Received: from mail-io0-f169.google.com (mail-io0-f169.google.com [209.85.223.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a108.g.dreamhost.com (Postfix) with ESMTPSA id 56EB820047601 for ; Mon, 12 Dec 2016 19:47:46 -0800 (PST) Received: by mail-io0-f169.google.com with SMTP id h30so207399952iod.2 for ; Mon, 12 Dec 2016 19:47:46 -0800 (PST) X-Gm-Message-State: AKaTC036t+MuRjk/kVJZ0ud+GKgEYvav3E2ILUtc1tzJ6eLATbm/TtKr4fEBdi7OY4Ok+DVWgtUaUE4ybmT95Q== X-Received: by 10.36.159.3 with SMTP id c3mr792830ite.50.1481600865841; Mon, 12 Dec 2016 19:47:45 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Mon, 12 Dec 2016 19:47:45 -0800 (PST) In-Reply-To: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> From: Ryan Sleevi Date: Mon, 12 Dec 2016 19:47:45 -0800 X-Gmail-Original-Message-ID: Message-ID: To: Steve Medin Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Peter Bowen Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 03:47:52 -0000 On Mon, Dec 12, 2016 at 7:10 PM, Steve Medin wrote: > Yea, but when I talk about the Plex Pass certs, I'm not on the internal > network privacy concern that split-horizon suits, I'm talking about how TCSC > fits customers with static and limited domain ownership. Can you expand on what use case for redaction doesn't fit into that model? I don't believe we've heard such a use case articulated. That is, while it's possible to imagine foo.corp.example.com as part of a domain hierarchy, or even impendingmerger.example.com (to use Peter Bowen's example), are you suggesting that you believe it to be routine and normal that such certificate holders need impendingmerger.example.com impendingmerger.example.net impendingmerger.example.org impendingmerger.example impendingmerger.pretend-the-next-word-is-a-cctld.example impendingmerger.some-other-brand-name.example (etc)? Otherwise, the discussion of the limitations of TCSC to branding don't really seem to fit to the topic of the redaction use cases discussed so far, but it's possible you're imagining a yet undiscovered case? From nobody Mon Dec 12 19:52:48 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAAFE1294E7 for ; Mon, 12 Dec 2016 19:52:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.501 X-Spam-Level: X-Spam-Status: No, score=-1.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AmgHLE5lHkum for ; Mon, 12 Dec 2016 19:52:46 -0800 (PST) Received: from homiemail-a106.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E6F41294D8 for ; Mon, 12 Dec 2016 19:52:46 -0800 (PST) Received: from homiemail-a106.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a106.g.dreamhost.com (Postfix) with ESMTP id 9AC1F30002922 for ; Mon, 12 Dec 2016 19:52:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=hUccBebTrcqqx9qUj7cE45G8Q30=; b= bHdobiBuP1e5U6+mX7FGEkIA+OPGcSmlqy0kkUCvEqMZyC+AywzFxpcT9BsVMIhW 80rxYaQszG//DJv8g+ReWvpIuaB8BsO7fZwBCO5Ez39nE13URJnBbN/+gbnCHRaD GxvsdoMuyj/J9P8MdtRsxLFxZx0A2WrGHAlB3OdY+J0= Received: from mail-io0-f179.google.com (mail-io0-f179.google.com [209.85.223.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a106.g.dreamhost.com (Postfix) with ESMTPSA id 895143000291E for ; Mon, 12 Dec 2016 19:52:45 -0800 (PST) Received: by mail-io0-f179.google.com with SMTP id p42so35322356ioo.1 for ; Mon, 12 Dec 2016 19:52:45 -0800 (PST) X-Gm-Message-State: AKaTC013Z8suUv0LzLjF8HqlnPkfMUP3VgCkkoeZMy3O2OF6vb3Y4c+67yQ8SuTUUCxqxtoFrW9DQnlBjUIXGg== X-Received: by 10.36.66.76 with SMTP id i73mr773079itb.50.1481601164988; Mon, 12 Dec 2016 19:52:44 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Mon, 12 Dec 2016 19:52:44 -0800 (PST) In-Reply-To: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> From: Ryan Sleevi Date: Mon, 12 Dec 2016 19:52:44 -0800 X-Gmail-Original-Message-ID: Message-ID: To: Jeremy Rowley Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Steve Medin Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 03:52:47 -0000 Out of curiousity, did you expand on what "Hide the DNS Label" means? In your original message, you suggested "100% of the concerned respondents wanted to support redaction of the left most label in the DNS." - but wildcards (which, in practice and as implemented by sane and astute readers of RFC 6125, is limited to the leftmost label) already accomplish this. I guess I'm trying to distinguish between whether, based on your survey, 100% of your customers are satisfied with ?.example.com Or if they are also imagining ?.?.example.com Arguably, it's much easier both in policy and in tech to restrict to ?.example.com, but it may be useful to confirm that was what you meant. From nobody Tue Dec 13 06:33:53 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 322811299DF for ; Tue, 13 Dec 2016 06:33:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KIKkk7DWHZ8Q for ; Tue, 13 Dec 2016 06:33:49 -0800 (PST) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com [IPv6:2a00:1450:400c:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE79F12998C for ; Tue, 13 Dec 2016 06:32:36 -0800 (PST) Received: by mail-wm0-x22a.google.com with SMTP id g23so111861750wme.1 for ; Tue, 13 Dec 2016 06:32:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Ow3989s/d3yqjCWIXGAfgXP24865X6Ojqy3HIdbJCTo=; b=OOpO0p+MpusF++sBMAEb8YkPiVkCZyvq5PiKL/SpAb8jPFO0E4vgiwCPJElzag1tWY Zo4M5VkkylRbd70IZErdgFblQzg1DtCVHP0sBucEvwwF/kU4keROATFA8V0GND2I2QTh YiG1g+IEE4eGa6G1Z/G6nm0VLedfJN6l1wgC0eCSHQ9gEROKHipYlSIgb/iFdf+u/WhS v/UBZbyZ2JC4opYOBld2P8A7p7pdMGAQPm9Kdso79Arl6hSAI4Gw3JNpemEAXA7+vD7p w79VfXkYaKHMxemMRGFpwAYe43k9IzhoCQXzg3tP7cJ653yhnIUYo3TOhWR+R+1LUalj /EKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Ow3989s/d3yqjCWIXGAfgXP24865X6Ojqy3HIdbJCTo=; b=mrdbFlI6a7u0FohGhYqHnlnhaN2ITVrK48Xm1y9ru0bey6+5a0a29dJCD+JR1YWjBZ TVDtC0sNHT2C2POJagjYFitVblrcJx0HFb0fwDnqeWcYdYleSIOyBCo3u9+4Dd8z8nbF Nk4dxPkNxZF6ou6MAgzbW+UzZx1e9q/+NdO9lZ9ZsVFqoqQkKsXaR+xvJE9DdZ4Qv3Pz /eQ6HO3r91TGKSAOP5Q0g0v6QEX2DESB/4SEFfSMUH+L76aBoyOz60KyEp2J1u2UNLmq YgRrmRzsRYz+GBK2iS2D5nqiXohP7VH3w8WFeU5uioKHbl9ItRgnHqGYQjikUGCeZkK9 2Aag== X-Gm-Message-State: AKaTC01nuPiK0k7IgQSUeF5DVvLEpqPixwqXf9K30rzezBPr2xwgkwGJXvkgsXffBdIZ+wUEc/oV8yeMsM2qyM5s X-Received: by 10.28.96.4 with SMTP id u4mr3157368wmb.86.1481639555137; Tue, 13 Dec 2016 06:32:35 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Tue, 13 Dec 2016 06:32:04 -0800 (PST) In-Reply-To: References: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> From: Eran Messeri Date: Tue, 13 Dec 2016 14:32:04 +0000 Message-ID: To: Paul Wouters Content-Type: multipart/alternative; boundary=001a1148e9985ec54105438b176c Archived-At: Cc: Rob Stradling , "trans@ietf.org" , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 14:33:52 -0000 --001a1148e9985ec54105438b176c Content-Type: text/plain; charset=UTF-8 Rob and I had a chat, we have the following proposals (which Rob may correct in case I got something wrong): * For Hash Algorithm repository, specify "Expert Review" guiding the Expert to make sure the proposed hash algorithm has public specification and does not suffer from known preimage attacks. * For the Signature Algorithm repository, specify "Expert Review" guiding the Expert to make sure the proposed signature algorithm has public specification and can generate signatures deterministically. * For the STH extensions, SCT extensions and VersionedTransType: Require a public specification that accompanies the proposed additional values and an expert review of the public specification, to ensure the public specification is detailed enough for interoperable implementations. * For the Log ID 2 repository: First-Come-First-Served, only requirement is to fill in a template that contains the log metadata. * For the Log ID 1 repository: Require Expert Review, guiding the Expert to make sure the requester is requesting the OID in good faith with the intention of running a CT log (since that's a limited resource). The log metadata is still required. On Tue, Dec 13, 2016 at 1:39 AM, Paul Wouters wrote: > On Tue, 13 Dec 2016, Rob Stradling wrote: > > https://tools.ietf.org/html/rfc5226 section 4.1 says (emphasis mine): >> "Expert Review (or Designated Expert) - approval by a Designated >> Expert is required. The *required documentation* and review >> criteria for use by the Designated Expert should be provided >> when defining the registry." >> >> So I think we should specify both Expert Review and Specification >> Required, just as (for example) https://tools.ietf.org/html/rfc6844 >> section 7.2 does: >> "Addition of tag identifiers requires a public specification and >> Expert Review as set out in..." >> > > Sounds good. > > Separately, should we reserve some values in either or both of these >> registries for Private Use or for Experimental Use? >> > > Yes please. > > * Specification requirement for SCT & STH extensions: new values for >>> these extensions are meaningless without specifying what they do - how >>> should clients behave when encountering them. >>> >> >> +1 (and for the VersionedTransType registry we just added too) >> >> Separately, should we reserve some values in any of these registries for >> Private Use or for Experimental Use? >> > > Yes. > > * First-come-first-served for Log IDs: I can't see how an expect review >>> could be meaningful, given log operators requesting those IDs can't >>> really prove competence to "own" log IDs, so requiring a "minimal amount >>> of clerical information" seems enough. >>> >> >> +1 >> > > It would be nice to have some kind of rules or documentation, and at > least have an Expert around to block strange or excessive requests? > > Stephen: how would you see this happening? > > Paul > > > Eran >>> >>> On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri >> > wrote: >>> >>> No policy has been specified in 6962-bis for adding values to the >>> IANA registries requested. >>> >>> In https://github.com/google/certificate-transparency-rfcs/pull/215 >>> >>> I >>> propose the following policies, all based on definitions in RFC5226: >>> * Hash algorithms and Signature algorithms: Expert Review >>> * SCT extensions and STH extensions: Specification Required >>> * Log ID 1, Log ID 2: First Come First Served. >>> >>> Feedback welcome, since, as far as I recall, this topic was not >>> discussed on the list previously. >>> >>> Eran >>> >>> >>> >>> >>> _______________________________________________ >>> Trans mailing list >>> Trans@ietf.org >>> https://www.ietf.org/mailman/listinfo/trans >>> >>> >> -- >> Rob Stradling >> Senior Research & Development Scientist >> COMODO - Creating Trust Online >> Office Tel: +44.(0)1274.730505 >> Office Fax: +44.(0)1274.730909 >> www.comodo.com >> >> COMODO CA Limited, Registered in England No. 04058690 >> Registered Office: >> 3rd Floor, 26 Office Village, Exchange Quay, >> Trafford Road, Salford, Manchester M5 3EQ >> >> This e-mail and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they are >> addressed. If you have received this email in error please notify the >> sender by replying to the e-mail containing this attachment. Replies to >> this email may be monitored by COMODO for operational or business reasons. >> Whilst every endeavour is taken to ensure that e-mails are free from >> viruses, no liability can be accepted and the recipient is requested to use >> their own virus checking software. >> >> _______________________________________________ >> Trans mailing list >> Trans@ietf.org >> https://www.ietf.org/mailman/listinfo/trans >> >> >> --001a1148e9985ec54105438b176c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Rob and I had a chat, we have the following proposals (whi= ch Rob may correct in case I got something wrong):

* For Hash = Algorithm repository, specify "Expert Review" guiding the Expert = to make sure the proposed hash algorithm has public specification and does = not suffer from known preimage attacks.

* For the = Signature Algorithm repository,=C2=A0specify "Expert Review" guid= ing the Expert to make sure the proposed signature algorithm has public spe= cification and can generate signatures deterministically.

* For the STH extensions, SCT extensions and VersionedTransType: Re= quire a public specification that accompanies the proposed additional value= s and an expert review of the public specification, to ensure the public sp= ecification is detailed enough for interoperable implementations.

* For the Log ID 2 repository: First-Come-First-Served, onl= y requirement is to fill in a template that contains the log metadata.
<= /div>

* For the Log ID 1 repository: Require Expert Revi= ew, guiding the Expert to make sure the requester is requesting the OID in = good faith with the intention of running a CT log (since that's a limit= ed resource). The log metadata is still required.


On Tue, De= c 13, 2016 at 1:39 AM, Paul Wouters <paul@nohats.ca> wrote:
=
On Tue, 13 Dec 2016, Rob St= radling wrote:

https://tools.ietf.org/html/rfc5226 section 4.1 says (= emphasis mine):
=C2=A0 "Expert Review (or Designated Expert) - approval by a Designate= d
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expert is required.=C2=A0 The *required d= ocumentation* and review
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0criteria for use by the Designated Expert= should be provided
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0when defining the registry."

So I think we should specify both Expert Review and Specification Required,= just as (for example) https://tools.ietf.org/html/rfc6844<= /a> section 7.2 does:
=C2=A0 "Addition of tag identifiers requires a public specification an= d
=C2=A0 =C2=A0Expert Review as set out in..."

 Sounds good.

Separately, should we reserve some values in either or both of these regist= ries for Private Use or for Experimental Use?

 Yes please.

=C2=A0* Specification requirement for SCT & STH extensions: new values = for
=C2=A0these extensions are meaningless without specifying what they do - ho= w
=C2=A0should clients behave when encountering them.

+1 (and for the VersionedTransType registry we just added too)

Separately, should we reserve some values in any of these registries for Pr= ivate Use or for Experimental Use?

 Yes.

=C2=A0* First-come-first-served for Log IDs: I can't see how an expect = review
=C2=A0could be meaningful, given log operators requesting those IDs can'= ;t
=C2=A0really prove competence to "own" log IDs, so requiring a &q= uot;minimal amount
=C2=A0of clerical information" seems enough.

+1

 It would be nice to have some kind of rules or documentation, and at
least have an Expert around to block strange or excessive requests?

Stephen: how would you see this happening?

Paul


=C2=A0Eran

=C2=A0On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri <eranm@google.com
=C2=A0<mailto:eran= m@google.com>> wrote:

=C2=A0 =C2=A0 =C2=A0No policy has been specified in 6962-bis for adding val= ues to the
=C2=A0 =C2=A0 =C2=A0IANA registries requested.

=C2=A0 =C2=A0 =C2=A0In https://githu= b.com/google/certificate-transparency-rfcs/pull/215
=C2=A0 =C2=A0 =C2=A0<https://gith= ub.com/google/certificate-transparency-rfcs/pull/215> I =C2=A0 =C2=A0 =C2=A0propose the following policies, all based on definition= s in RFC5226:
=C2=A0 =C2=A0 =C2=A0* Hash algorithms and Signature algorithms: Expert Revi= ew
=C2=A0 =C2=A0 =C2=A0* SCT extensions and STH extensions: Specification Requ= ired
=C2=A0 =C2=A0 =C2=A0* Log ID 1, Log ID 2: First Come First Served.

=C2=A0 =C2=A0 =C2=A0Feedback welcome, since, as far as I recall, this topic= was not
=C2=A0 =C2=A0 =C2=A0discussed on the list previously.

=C2=A0 =C2=A0 =C2=A0Eran




=C2=A0_______________________________________________
=C2=A0Trans mailing list
=C2=A0Trans@ietf.org
=C2=A0https://www.ietf.org/mailman/listinfo/trans


--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.= comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
=C2=A0 3rd Floor, 26 Office Village, Exchange Quay,
=C2=A0 Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and intended= solely for the use of the individual or entity to whom they are addressed.= If you have received this email in error please notify the sender by reply= ing to the e-mail containing this attachment. Replies to this email may be = monitored by COMODO for operational or business reasons. Whilst every endea= vour is taken to ensure that e-mails are free from viruses, no liability ca= n be accepted and the recipient is requested to use their own virus checkin= g software.

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans



--001a1148e9985ec54105438b176c-- From nobody Tue Dec 13 07:46:19 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE03D129411 for ; Tue, 13 Dec 2016 07:46:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JX55P3KX0pnb for ; Tue, 13 Dec 2016 07:46:14 -0800 (PST) Received: from mail-wj0-x22e.google.com (mail-wj0-x22e.google.com [IPv6:2a00:1450:400c:c01::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A299129404 for ; Tue, 13 Dec 2016 07:46:14 -0800 (PST) Received: by mail-wj0-x22e.google.com with SMTP id tg4so104312561wjb.1 for ; Tue, 13 Dec 2016 07:46:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=D2d8b82/dEMLr8iiO6pOwK5d+NDEw+2zyv+gvFbcYvc=; b=deP4n6s/3cukwYTZuqW4skLr4Kn2D971XdpvbRX4TENb/Y0sa8u1gTn0hpaTfAIld/ /zRCzCTwrCopuR45R0Zvl0f5vgMz05mpNiddrXxLFz7q9rRD9CKJ21KuCR0JI/GquHkW OHf78FbFfV2aIUcGgI1IFKD1StgeIRRPj+m+ii0O+EYJvnlN6sFLQAsz1jlWkXgFZ/oT GFZqPCjMVPIj7JAKIvjwllDFUMQMdrVRjnoh3IDksZnogqRpJjjhumFarR4yZs3djL1F SbBvAkh7BtLQqfPQOrwUnNOnRZWmw0lRiF1bijwTh5JWfs2GSwG2pP+VMZE47N+j+49T JQzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=D2d8b82/dEMLr8iiO6pOwK5d+NDEw+2zyv+gvFbcYvc=; b=B1X8Qsf5JjZvhGXo8W59eMYBivDgzdTrWQz7uJMnu/ckU6Ga47GVmMq5iIgr9I0Ma6 Zh7fuNwlEZve+/ehdjmPCebll06aBRfMF/1+6ZeHIRJtmz5Okxjr3Q2IEI06VxHoEpcm JWRO/LlH+2nob1P6m+9RlySdsU2kMDwXwlnabSFGtERNEITwgG5W/LsubJXySAA0XUXf tLDDTQIqS/kSYJzF0sdp46p/JOxypxJbLXA1EGIkSc7IllM4vd61SmJn+2yJz49KWFbn wsVScZgRkQFc1qfE55H+Q8UObxJzo3aOiRkCsJ+mfijdpEW/r7DmgD9MnGzk3CURTvlz VNjQ== X-Gm-Message-State: AKaTC02N9oRTQ3nTq9rGLG6vuLNLLrPMnYP10qpRPRnsz1BqQps9PHvBm8Zm9aZD1zw2SEm7G3AcFTgU+lCPpS2n X-Received: by 10.194.149.143 with SMTP id ua15mr101307972wjb.48.1481643972602; Tue, 13 Dec 2016 07:46:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Tue, 13 Dec 2016 07:45:41 -0800 (PST) In-Reply-To: References: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> From: Eran Messeri Date: Tue, 13 Dec 2016 15:45:41 +0000 Message-ID: To: Paul Wouters Content-Type: multipart/alternative; boundary=089e0122897cac374405438c1eb9 Archived-At: Cc: Rob Stradling , "trans@ietf.org" , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 15:46:18 -0000 --089e0122897cac374405438c1eb9 Content-Type: text/plain; charset=UTF-8 Text to describe the policies and expert reviews was added in: https://github.com/google/certificate-transparency-rfcs/commit/615a8c3be0acfc6461f6d3043d19ecc863f3888b On Tue, Dec 13, 2016 at 2:32 PM, Eran Messeri wrote: > Rob and I had a chat, we have the following proposals (which Rob may > correct in case I got something wrong): > > * For Hash Algorithm repository, specify "Expert Review" guiding the > Expert to make sure the proposed hash algorithm has public specification > and does not suffer from known preimage attacks. > > * For the Signature Algorithm repository, specify "Expert Review" guiding > the Expert to make sure the proposed signature algorithm has public > specification and can generate signatures deterministically. > > * For the STH extensions, SCT extensions and VersionedTransType: Require a > public specification that accompanies the proposed additional values and an > expert review of the public specification, to ensure the public > specification is detailed enough for interoperable implementations. > > * For the Log ID 2 repository: First-Come-First-Served, only requirement > is to fill in a template that contains the log metadata. > > * For the Log ID 1 repository: Require Expert Review, guiding the Expert > to make sure the requester is requesting the OID in good faith with the > intention of running a CT log (since that's a limited resource). The log > metadata is still required. > > > On Tue, Dec 13, 2016 at 1:39 AM, Paul Wouters wrote: > >> On Tue, 13 Dec 2016, Rob Stradling wrote: >> >> https://tools.ietf.org/html/rfc5226 section 4.1 says (emphasis mine): >>> "Expert Review (or Designated Expert) - approval by a Designated >>> Expert is required. The *required documentation* and review >>> criteria for use by the Designated Expert should be provided >>> when defining the registry." >>> >>> So I think we should specify both Expert Review and Specification >>> Required, just as (for example) https://tools.ietf.org/html/rfc6844 >>> section 7.2 does: >>> "Addition of tag identifiers requires a public specification and >>> Expert Review as set out in..." >>> >> >> Sounds good. >> >> Separately, should we reserve some values in either or both of these >>> registries for Private Use or for Experimental Use? >>> >> >> Yes please. >> >> * Specification requirement for SCT & STH extensions: new values for >>>> these extensions are meaningless without specifying what they do - how >>>> should clients behave when encountering them. >>>> >>> >>> +1 (and for the VersionedTransType registry we just added too) >>> >>> Separately, should we reserve some values in any of these registries for >>> Private Use or for Experimental Use? >>> >> >> Yes. >> >> * First-come-first-served for Log IDs: I can't see how an expect review >>>> could be meaningful, given log operators requesting those IDs can't >>>> really prove competence to "own" log IDs, so requiring a "minimal >>>> amount >>>> of clerical information" seems enough. >>>> >>> >>> +1 >>> >> >> It would be nice to have some kind of rules or documentation, and at >> least have an Expert around to block strange or excessive requests? >> >> Stephen: how would you see this happening? >> >> Paul >> >> >> Eran >>>> >>>> On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri >>> > wrote: >>>> >>>> No policy has been specified in 6962-bis for adding values to the >>>> IANA registries requested. >>>> >>>> In https://github.com/google/certificate-transparency-rfcs/pull >>>> /215 >>>> >>>> I >>>> propose the following policies, all based on definitions in >>>> RFC5226: >>>> * Hash algorithms and Signature algorithms: Expert Review >>>> * SCT extensions and STH extensions: Specification Required >>>> * Log ID 1, Log ID 2: First Come First Served. >>>> >>>> Feedback welcome, since, as far as I recall, this topic was not >>>> discussed on the list previously. >>>> >>>> Eran >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Trans mailing list >>>> Trans@ietf.org >>>> https://www.ietf.org/mailman/listinfo/trans >>>> >>>> >>> -- >>> Rob Stradling >>> Senior Research & Development Scientist >>> COMODO - Creating Trust Online >>> Office Tel: +44.(0)1274.730505 >>> Office Fax: +44.(0)1274.730909 >>> www.comodo.com >>> >>> COMODO CA Limited, Registered in England No. 04058690 >>> Registered Office: >>> 3rd Floor, 26 Office Village, Exchange Quay, >>> Trafford Road, Salford, Manchester M5 3EQ >>> >>> This e-mail and any files transmitted with it are confidential and >>> intended solely for the use of the individual or entity to whom they are >>> addressed. If you have received this email in error please notify the >>> sender by replying to the e-mail containing this attachment. Replies to >>> this email may be monitored by COMODO for operational or business reasons. >>> Whilst every endeavour is taken to ensure that e-mails are free from >>> viruses, no liability can be accepted and the recipient is requested to use >>> their own virus checking software. >>> >>> _______________________________________________ >>> Trans mailing list >>> Trans@ietf.org >>> https://www.ietf.org/mailman/listinfo/trans >>> >>> >>> > --089e0122897cac374405438c1eb9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Tue, Dec 13, 2016 at 2:32 PM, Eran Messeri <eranm@g= oogle.com> wrote:
Rob and I had a chat, we have the following proposals (which Rob m= ay correct in case I got something wrong):

* For Hash Algorith= m repository, specify "Expert Review" guiding the Expert to make = sure the proposed hash algorithm has public specification and does not suff= er from known preimage attacks.

* For the Signatur= e Algorithm repository,=C2=A0specify "Expert Review" guiding the = Expert to make sure the proposed signature algorithm has public specificati= on and can generate signatures deterministically.

= * For the STH extensions, SCT extensions and VersionedTransType: Require a = public specification that accompanies the proposed additional values and an= expert review of the public specification, to ensure the public specificat= ion is detailed enough for interoperable implementations.

* For the Log ID 2 repository: First-Come-First-Served, only requir= ement is to fill in a template that contains the log metadata.

* For the Log ID 1 repository: Require Expert Review, guid= ing the Expert to make sure the requester is requesting the OID in good fai= th with the intention of running a CT log (since that's a limited resou= rce). The log metadata is still required.

<= div class=3D"HOEnZb">

On Tue, Dec 13, 2016 at 1:39 AM, Paul Wouters <paul@noh= ats.ca> wrote:
On Tue= , 13 Dec 2016, Rob Stradling wrote:

https://tools.ietf.org/html/rfc5226 section 4.1 says (= emphasis mine):
=C2=A0 "Expert Review (or Designated Expert) - approval by a Designate= d
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expert is required.=C2=A0 The *required d= ocumentation* and review
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0criteria for use by the Designated Expert= should be provided
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0when defining the registry."

So I think we should specify both Expert Review and Specification Required,= just as (for example) https://tools.ietf.org/html/rfc6844<= /a> section 7.2 does:
=C2=A0 "Addition of tag identifiers requires a public specification an= d
=C2=A0 =C2=A0Expert Review as set out in..."

 Sounds good.

Separately, should we reserve some values in either or both of these regist= ries for Private Use or for Experimental Use?

 Yes please.

=C2=A0* Specification requirement for SCT & STH extensions: new values = for
=C2=A0these extensions are meaningless without specifying what they do - ho= w
=C2=A0should clients behave when encountering them.

+1 (and for the VersionedTransType registry we just added too)

Separately, should we reserve some values in any of these registries for Pr= ivate Use or for Experimental Use?

 Yes.

=C2=A0* First-come-first-served for Log IDs: I can't see how an expect = review
=C2=A0could be meaningful, given log operators requesting those IDs can'= ;t
=C2=A0really prove competence to "own" log IDs, so requiring a &q= uot;minimal amount
=C2=A0of clerical information" seems enough.

+1

 It would be nice to have some kind of rules or documentation, and at
least have an Expert around to block strange or excessive requests?

Stephen: how would you see this happening?

Paul


=C2=A0Eran

=C2=A0On Mon, Dec 12, 2016 at 3:44 PM, Eran Messeri <eranm@google.com
=C2=A0<mailto:eran= m@google.com>> wrote:

=C2=A0 =C2=A0 =C2=A0No policy has been specified in 6962-bis for adding val= ues to the
=C2=A0 =C2=A0 =C2=A0IANA registries requested.

=C2=A0 =C2=A0 =C2=A0In https://githu= b.com/google/certificate-transparency-rfcs/pull/215
=C2=A0 =C2=A0 =C2=A0<https://gith= ub.com/google/certificate-transparency-rfcs/pull/215> I =C2=A0 =C2=A0 =C2=A0propose the following policies, all based on definition= s in RFC5226:
=C2=A0 =C2=A0 =C2=A0* Hash algorithms and Signature algorithms: Expert Revi= ew
=C2=A0 =C2=A0 =C2=A0* SCT extensions and STH extensions: Specification Requ= ired
=C2=A0 =C2=A0 =C2=A0* Log ID 1, Log ID 2: First Come First Served.

=C2=A0 =C2=A0 =C2=A0Feedback welcome, since, as far as I recall, this topic= was not
=C2=A0 =C2=A0 =C2=A0discussed on the list previously.

=C2=A0 =C2=A0 =C2=A0Eran




=C2=A0_______________________________________________
=C2=A0Trans mailing list
=C2=A0Trans@ietf.org
=C2=A0https://www.ietf.org/mailman/listinfo/trans


--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.= comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
=C2=A0 3rd Floor, 26 Office Village, Exchange Quay,
=C2=A0 Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and intended= solely for the use of the individual or entity to whom they are addressed.= If you have received this email in error please notify the sender by reply= ing to the e-mail containing this attachment. Replies to this email may be = monitored by COMODO for operational or business reasons. Whilst every endea= vour is taken to ensure that e-mails are free from viruses, no liability ca= n be accepted and the recipient is requested to use their own virus checkin= g software.

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans




--089e0122897cac374405438c1eb9-- From nobody Tue Dec 13 10:49:59 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66FE21296E5 for ; Tue, 13 Dec 2016 10:49:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.117 X-Spam-Level: X-Spam-Status: No, score=-7.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LZcimcVMYGX2 for ; Tue, 13 Dec 2016 10:49:55 -0800 (PST) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AECAD129492 for ; Tue, 13 Dec 2016 10:49:55 -0800 (PST) Received: from tussmtmtaapi01.symc.symantec.com (tus3-f5-symc-ext-prd-snat7.net.symantec.com [10.44.130.7]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 91.FE.03943.2D240585; Tue, 13 Dec 2016 18:49:55 +0000 (GMT) X-AuditID: 0a2c7e31-1b4839a000000f67-03-585042d3b08f Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat2.net.symantec.com [10.44.130.2]) by tussmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 8C.E7.04151.0D240585; Tue, 13 Dec 2016 18:49:54 +0000 (GMT) Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 13 Dec 2016 18:49:52 +0000 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.128.3) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Tue, 13 Dec 2016 10:49:52 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=QDC4ScEvNBz2oXg66vgO6o2iQf1YivYI7N6WK2mOGfc=; b=0uAp+E+Z0rP8e3SYjutYHDOiAGYPjqC9gFH49F7DU6SxCMq8Ngt6+1djsRcrTuNOcBNwaPPK657/BRNSNdG33MEhP0lQBrdVJdJQe4dC482Rl0NOr27NLfqyu0jGUKRB59Sgih5r8U5Ylw9FUmm8o2/NmqbdoVcYH9mN9RXRmZo= Received: from BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) by BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Tue, 13 Dec 2016 18:49:45 +0000 Received: from BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) by BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) with mapi id 15.01.0771.014; Tue, 13 Dec 2016 18:49:45 +0000 From: Steve Medin To: Ryan Sleevi Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAL810AAAFHujAAAF07gAAHr5cwAAIPwoAAHtH3sA== Date: Tue, 13 Dec 2016 18:49:44 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Steve_Medin@symantec.com; x-originating-ip: [155.64.138.28] x-ms-office365-filtering-correlation-id: 8d0aeb41-a820-4d5c-db21-08d42388ce5d x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:BLUPR16MB0449; x-microsoft-exchange-diagnostics: 1; BLUPR16MB0449; 7:DRVnhz0WQcQeTa8F97UoNxMk2NC/AzklNPjTjYTS3EGsnIG3yqyjYPO3Kj9PBuZSDRhdl3ifkvf19W8QjehC2F35GKvh8gd2BqdMvjqwNXxqgs9/0xijXpWh2juDvupyzlPNkiIGxolK/XKxewxxRRE9YPElI8fqMf2l4wacY9zxwjSkMOPAxZhK/BSG9oajjBqDcG/O/msB8kmap6/9fNp5X3kF+gzkC/6S1JHV9oaacweF6d8MsqmURCq+9dgzaj/oT4Sx4LN/qi8OmJ0Cs1ElD9mz6ppW/AsFQS7JGqUBiFI5QNNfu+bL1tKqETecQSljaVDryRXLj2Lowq90HJhJ/GHSFFa+QGJPNJa9vutqHgK5Ywep052uk+9434pRkaRCY7IXpdcg3BvMj3yCKlB/NrsOuJWXmikn4rtJrVHL/rCX3BIIozt25M/Ed6KYL8xg/V7m1meN86n5JqRbRA== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123558021)(20161123564025)(6072148); SRVR:BLUPR16MB0449; BCL:0; PCL:0; RULEID:; SRVR:BLUPR16MB0449; x-forefront-prvs: 01559F388D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(7916002)(39450400003)(189002)(24454002)(13464003)(199003)(377454003)(97736004)(81166006)(81156014)(5660300001)(99286002)(105586002)(8676002)(106356001)(33656002)(54356999)(7736002)(3660700001)(76176999)(122556002)(3280700002)(189998001)(229853002)(74316002)(305945005)(99936001)(101416001)(50986999)(76576001)(110136003)(9686002)(7696004)(68736007)(6916009)(93886004)(66066001)(38730400001)(2950100002)(39060400001)(3846002)(8936002)(2906002)(102836003)(6116002)(6436002)(92566002)(77096006)(80792005)(2900100001)(86362001)(6506006)(4326007)(10290500002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR16MB0449; H:BLUPR16MB0449.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0645_01D25547.BF5651F0" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2016 18:49:44.9122 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR16MB0449 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrHKsWRmVeSWpSXmKPExsXCpdPErnvZKSDC4PMzPoue1qtMFv8fvGSx mHR/LqPF2scXWRxYPHbOusvuMe39MTaPJUt+Mnk0797NEsASxWWTkpqTWZZapG+XwJVx8N9E 1oJV4RUXt9U2MM4J7GLk4JAQMJF4ctqpi5GLQ0jgE6PEmc425i5GTrD40b1fWEBsIYEfjBJb rwtAFB1llOhbc5oJwnnBKNF1czaYwyLQySzR+OktM0RmMpPEu7e72SH6jzBKrFrjAmKzCehI 7N7RyAZiiwioSTycfoYV5A5mgWyJM4f9QMLCAnISc29uZ4YokZe4sHcaE0iJiECYxLm98iBh FgFViadd18Gu4xWIkfjV940NYu18Zomf2/eD9XIKBEq8v3OMEcRmFBCT+H5qDROIzSwgLnHr yXwmiDdFJB5ePM0GYYtKvHz8jxWiPlqiY8d6FkgQKUrsPV0JUeIrsfXsQnYY++yprWB7JQR6 WCQavjyAmpktseHrAmgwWkusfPWBFaJoKZPEgbZlUN0yEpvn7WSbwKg7C8lNs4DqmAUWMkpc W7SRfRbYd4ISJ2c+YYEo0pZ4evMplC0vsf3tHGYI21pixq+DbBC2osSU7ofsELapxOujHxkX MHKsYlQoKS0uzi3JLy1JLEg1MNQrrsxNBhGJwHSWrJecn7uJEZzS6gx3MD7a4HOIUYCDUYmH 969hQIQQa2IZUOUhRhWgkY82rL7AKMWSl5+XqiTCu80BKM2bklhZlVqUH19UmpNafIhRmoNF SZyXx9ktQkggPbEkNTs1tSC1CCbLxMEp1cDIWqDx7t3t+hqbH1+79z/S7m2z+ONQstRivtrF 1gNB118/NFl3/cSNxg9X7V+sXRNjc27ycnZm/sSn994mmjm8rEuvkVkX5XN2xtJ6Jw1pjydf Ti7kjWMuc+jiu/tV/qDmX9Fnc61TV/K1Sa7a+Mn48fF93y6z3ElzV14v6ij+pU+XO8f7pd16 JZbijERDLeai4kQARgtOQ3EDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0hTcRTH+d17t92NFr/Wcof1sEYWmJWSpaVUVH9Imcx/SnpQF72mzM2x TdMg0t6tMq0o85EP1MqsVkO3GrOyHOUjtCibJGlqZTF7aaWUtrur0D8/Pr9zvud8z4FDk7Iu gZJO1plYg45JUQkllCToILH4+Tp1XPBNz/LwU0deEuHj3QNU+Nm3xSj8Rm87tZaKulvQJYq6 8MUljKqoGCGiDjkclJraJolMYFOS01nD0tW7JUkPx/IE+uqtGe11+7NQUawZiWnAodDoHKI4 luHfCGo7sBlJvNyIIKemmeA/HxGY3YW+D4VPkJD93UPymXMEDHocIr7+MYLqmg0cC3EQOOzZ Qo7leAH0XGwRmBFNk1gDLY9iuPB0PAeK3TaSl/hDm/MCwUnkeAs8c/pzYQoHQL+5wzedFO+A 0ZyfQt62hIQR231frRjHwpc3LsQxwn7wq6mG4JjECujsKyH4NeXQ094s5HkGDPSOCXj9djhu v0VxvoDngbM5k5dshtrWMtEktzbV+nwBn6Iga6h7oqcGLMOlJM8RcO3TVwEvqiTgwdGqiepZ YL18d8J4VACnPRmcmQyzYMtfmIsCC/4btcBbTuIyBK/Kb4sKfEtPg6eX+ihetAj63f0T7A82 TxHJcwTkjz4U8jwPzp/sEfG8HD43fkOliK5Gc01pRqPWpDUxjD45OGSJMVMbzz2M98zil8Sn au8g36GtBzuq/xPdgDCNVFOkaj91nEzApHuVDWi+t+U7y/U2pKR0qTpWJZfWrfWmpQlM5j7W kLrLkJbCGhvQTJpSKaRfLeNbZXgPY2I1LKtnDZNZghYrs1DAULqi0lRXJQ+LDL14xrrmwGC5 8nVCwNUnwViDvh1WZFiHp79fmrhtZfF43+J7VZH2HcTeGHfEx5N3Xog75sYMrOh8O5IX9PNP YO6xv1Zlqis6pSm59AOrl3RNba23XIHb4rOVmyKGn7o8zl11q/7Gbgy7mjhbW5Fd+COnadnK nXEqypjEhASSBiPzDwreY/lwAwAA Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Peter Bowen Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 18:49:57 -0000 ------=_NextPart_000_0645_01D25547.BF5651F0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit What the 23kb TCSC I created taught me was that there are orgs that need: .. And .. And all the permutations thereof, as well as the directory names of 80 data centers owing to a legacy of inserting the place of operation in the DN rather than corporate global or regional HQ. Brand is also deep, not only through acquisition but some orgs have a web presence of hundreds of microsites that are FQDN rather than query path. When a TCSC is created, it has to envelope a legacy of naming that received certificates in another manner. That means a lot of decisions that were made without DNS name and directory name constraints need to be accounted for in the extension. Once the TCSC is created, unless IT has an overbearing role in domain/brand approval, the deep branded organization is going to put a new name in the second/third level domain for every launch. That's another key ceremony, a new intermediate on the AIA CA Issuers URI, and ALL CAPS in the certificate issuance email reminding the server admin to rip out the old intermediate and add the new one. Ten brand launches later, 11 different TCSCs, wait, which one do I install? I don't intend to offend server admins, this isn't a matter of competence, it's a matter of the number and variety of tasks carried by the typical admin in the type of organization I describe. > -----Original Message----- > From: Ryan Sleevi [mailto:ryan-ietf@sleevi.com] > Sent: Monday, December 12, 2016 10:48 PM > To: Steve Medin > Cc: Peter Bowen ; Matt Palmer > ; trans@ietf.org > Subject: Re: [Trans] Redaction > > On Mon, Dec 12, 2016 at 7:10 PM, Steve Medin > wrote: > > Yea, but when I talk about the Plex Pass certs, I'm not on the > > internal network privacy concern that split-horizon suits, I'm talking > > about how TCSC fits customers with static and limited domain ownership. > > Can you expand on what use case for redaction doesn't fit into that model? I > don't believe we've heard such a use case articulated. > > That is, while it's possible to imagine foo.corp.example.com as part of a > domain hierarchy, or even impendingmerger.example.com (to use Peter > Bowen's example), are you suggesting that you believe it to be routine and > normal that such certificate holders need > > impendingmerger.example.com > impendingmerger.example.net > impendingmerger.example.org > impendingmerger.example > impendingmerger.pretend-the-next-word-is-a-cctld.example > impendingmerger.some-other-brand-name.example > (etc)? > > Otherwise, the discussion of the limitations of TCSC to branding don't > really > seem to fit to the topic of the redaction use cases discussed so far, but > it's > possible you're imagining a yet undiscovered case? ------=_NextPart_000_0645_01D25547.BF5651F0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEYYw ggQZMIIDAQIQYXDLSYxfmEUp57Cm2VBbejANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMx FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3Jr MTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv bmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRp b24gQXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkG A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp emVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCvCg3C1SzbZ7kt5ZQn3aW+4LBNj7NhVjzWfMP0zT6Gy6KI4uHYpGnFteK/waZHUF5GOYvVlrq1 bxS/EM4nE54FR5sxehPYH9nTAjeLrSxH8I6BBqcNMAzr9zwPIB3cckbupQLIW8PJVmlMxRjBkXsL 1RMAm7zvw0g+RmAghSrVkLbNi6DMMt23/UBVslAcVq7MjXdNxyBNpzF272iSipAeCIFWsq1po1LQ yxzEIz0fmf5M6BZjjsYIjvYx9tL65XbdtRySo0nNzQHNaM2pabqj6x0NnKQgpsGgxdFGTBdt0qxm P5aM4ITUNv8iWcX5EWCoXwR98hr2JUJhD8RKuD6JAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADQm FTzAjU1DSR296SGS12act97FuNDkXV92IsAm+YQ6OvmMtfvsYPHozgSwyN2nA48w85jfpOakMd/T HAtG3HIgP67uBTykMz8LOaxweHNLmSvfMMJUsKg7VaH+FijNQr10boDbJ0SnzkRd1BuQmA0eQpSx ACwE0HSjAgUiY2PNg7X7wW1ia2l1/V1wQbn1v3zfvsEycyIhi1iBexWRerrjZEiwf/s2JdqV0PEk FBfdGIBrRiM5VPWOYgkEHZSQppvmJeJCRaq4kK2+CI+pC0IYlM9yOeGxQ+Aoz7fnWmwTa0mz/+MY fImLM12sM9en+do6VclYEPmq71q2z0tL3yowggZMMIIFNKADAgECAhAcNy3LuXA+a7c+8/rRC0IG MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4x HzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlT aWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENs YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTAx MDYwMDAwMDBaFw0yNTAxMDUyMzU5NTlaMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50 ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsT LENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQDEyFT eW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw ggEKAoIBAQC21/RXe57fcFE+yEhkaEDBiW4/BJJK7Rx0JyDaOM9Skzy50VrHFy0+aE5haQuybmh5 9AJ2CvjSbrYbfntLxrVP2r34SQ4Cz+ytamfrzgR5vYTM85ojBNbPQj9JzpYn6ySuYdk0uWZ6vIOJ HxiUwGrAec5n4zVQiaJsde44X/H7ma7zF0gbFg8ZejRqIWZaFIMRQMKwntDbg87fBPIyQoMOZXsL Ko5ZZXgbyWwsTl4XLjL4yuv4pTQtVo5GiJU1l8mq2hkADD5tp7GRA+PmgTUTF/OeQJrZOcwKCoda HiIje9mGj1ZoiCDnhiqmNAd0WE2O3JsYFOEQOcYCgNy3jCD9AgMBAAGjggJEMIICQDASBgNVHRMB Af8ECDAGAQH/AgEAMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0 cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9ycGEwDgYDVR0PAQH/BAQDAgEGMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwud3Mu c3ltYW50ZWMuY29tL3BjYTItZzMuY3JsMCgGA1UdEQQhMB+kHTAbMRkwFwYDVQQDExBTeW1hbnRl Y1BLSS0yLTIzMB0GA1UdDgQWBBSkM6+ww0aHq+V4SbK04kaf6gn8FTCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejAN BgkqhkiG9w0BAQsFAAOCAQEAobYafeqzznZLxBH6OMpOEPGrh3+S6lCVJcA3aAL7gq2AyzPUzEMw sEVn+yKYhjzAFZ3XRY9qIYl922HdLZGqso3wyQ7WUCvWIDeRg9EUztoB0tDxzjsiQUgyeRtLpuDS 6H4ZAYfUahBN5gRevERnuE3u2eUk/qb4KhswvL/9sQxGXApV4XIfIDVO5rhZdfGHV/YFleeAXE49 JaPRPff9h1QjweUAMxYR6oB4w5xE6cOUtyZaSkxDF8qmlnf+flaPiA/o3edR0vgUtbtg4Lr/hb4C DU1a6yDtcphIeS91zOIEKwoA+8moz0X/wSI8hf8cy/zjVKMXfHtYEfxNTffKMjCCBxUwggX9oAMC AQICEDztlWuklUUR25LYiQfCRmEwDQYJKoZIhvcNAQELBQAwgbAxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0Ex KjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzAeFw0xNjA3MjAwMDAw MDBaFw0xNzA3MjAyMzU5NTlaMFgxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMSAwHgYD VQQLDBdTeW1hbnRlYyBFbXBsb3llZSBFbWFpbDEVMBMGA1UEAwwMU3RldmVuIE1lZGluMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvq01EJSDIsFS5i9XiwbGjdpqIA4wQ7syWfq4Ma68 tG7Rnpbowe06isw9AMe4jg+vfiD+YQ1ZTvzNEB0qc7XDtS9CGdWvbDZh2oWB/dk2K6nsxAqT9mlV vs+VrSDXzpKCua6vDLghmoaTnb3F4IXqMcsUEuu9JM42jJQkyHjy61FNtw/wH2JtdcWKtFQLPYa3 eNkYwciUGtAUpR78gYMjEGXNbeuuGGoWhY1Vo6kwFdhRBmDaowrJoyHuMFnsZ/qeg94GraI2yqDW Y3yTMWoD/RMik9pU2XG5KawZClRi9S1z5s8TILqLCqj4k/1On3+dnD0xP+toKOFLz3dCs64G3wID AQABo4IDgDCCA3wwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYI KwYBBQUHAwQwHQYDVR0OBBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCMGA1UdEQQcMBqBGFN0ZXZl X01lZGluQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQG CCsGAQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNv bTCCASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNE JTIwU3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1Ul MjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmli ZXIlMjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBP JTIwJTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRp ZmljYXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNv bS9jYV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1Ud IARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNv bS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcN AQkPBDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQB KjArBgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhF ARAFBCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3 DQEBCwUAA4IBAQAkFsvRsGAuybrzzBuilyhaw5EDCzYTHBL/dOMyrPgokGbHe0cQz7dEwbfkA7Q3 RI7J1JSOFXGSrbeHlx5vl9MkIIGU+76C64wf6sGmWiI9WIH8dDN0/MD1gyFVf6Hn136R9A11haNv FQUZse4UpTyBxMxpTyOqhMPJMDZpCDNKdEyUFkavYVWF0a8mGfH11S7aVPRGid+vyuHlZCTu9gbt LVFS2dG7w80ipCNRpFm9k2mKWw0yWtnfkNLJmGH+Pz2bDd/QZzw72t0PBYsjawMvNIaLblWGaS96 a0Uopc6gaBn9iejPNnXrTocaF+g2707Y4ge9H/4jJUT0+ouWnlVtMYIEqDCCBKQCAQEwgcUwgbAx CzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3lt YW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlk dWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0Eg LSBHMwIQPO2Va6SVRRHbktiJB8JGYTANBglghkgBZQMEAgEFAKCCArMwGAYJKoZIhvcNAQkDMQsG CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEzMTg0OTM4WjAvBgkqhkiG9w0BCQQxIgQg Lv3Kx5ODjSi1bd/MSLSprjyhC2dnP9a0Hrj7w0qSMyAwgZMGCSqGSIb3DQEJDzGBhTCBgjALBglg hkgBZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0D AgICAIAwDQYIKoZIhvcNAwICAUAwCwYJYIZIAWUDBAIBMAsGCWCGSAFlAwQCAzALBglghkgBZQME AgIwBwYFKw4DAhowgdYGCSsGAQQBgjcQBDGByDCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZh MIHYBgsqhkiG9w0BCRACCzGByKCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYDVQQLEyxD bGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgGA1UEAxMhU3lt YW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZhMA0GCSqGSIb3 DQEBAQUABIIBAK6kbsH97pzvrCC5hd3gMi5qBsjt4nw/oIRWvNnXDeijIjEaSY3nPceI/Hj5cscK 17t5OSfWAiVLhBtS3DjvJjMJrPZDeCzhPkZYwilpKQZUZtzcBq7U0eFO2HUR3RnWrb55XxfBCoJV yQfOIPNcDdjHKfZGYcoCMfJqlmKWukEntFbwkrpKb2Ld2drwEvVg4VjwE8zobI81zsqrpP6duzwK eLIDZJvYNn02B9kvUaFrOLCcx4Mn4aQDAN2TGONPihZkGTVuNjhVDRVjvPYFRnwtAR2t/VgoOqAS MTorVnatVtlSZGaUP/NvPUSwl0I78aHonj7ebqSHy0gslmHtULAAAAAAAAA= ------=_NextPart_000_0645_01D25547.BF5651F0-- From nobody Tue Dec 13 10:51:29 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21293129472 for ; Tue, 13 Dec 2016 10:51:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.597 X-Spam-Level: X-Spam-Status: No, score=-5.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QCizexA-0YSH for ; Tue, 13 Dec 2016 10:51:26 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id B84CA129492 for ; Tue, 13 Dec 2016 10:51:26 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 0D15E433416; Tue, 13 Dec 2016 18:51:16 +0000 (GMT) Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id E8E944DC05; Tue, 13 Dec 2016 18:51:15 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1481655075; bh=Q0mlgXfP7eQJKVEyBLYt2DfGJfsAyqgxBeEpXvwZWcs=; l=182; h=From:To:CC:Date:References:In-Reply-To:From; b=lbkSAL2Bwc4krDRWxba5nRE8nDBnYsiwgs7t9TrpTJBcopBlc3lDn+F2ErA9R6uOz UDrLHW4WH0v/rS5CqAiW3sVLf7r/uRU9jJAvTafEd52bbs4U+rIv7/gpqnePg8xbtF 7TLhMnF3rS6hdWnI/P/mvXZVfvsU2YfJz2abXYUc= Received: from email.msg.corp.akamai.com (usma1ex-casadmn.msg.corp.akamai.com [172.27.123.33]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id E57231FC8E; Tue, 13 Dec 2016 18:51:15 +0000 (GMT) Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 13 Dec 2016 10:51:15 -0800 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Tue, 13 Dec 2016 13:51:15 -0500 From: "Salz, Rich" To: Steve Medin , Ryan Sleevi Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAWbZIAAAFuH4AAADbWgAAIcw6AAAFMTIAAH4BcAAAKbv4g Date: Tue, 13 Dec 2016 18:51:15 +0000 Message-ID: <6956750e79f5447d83e59580a92e62e4@usma1ex-dag1mb1.msg.corp.akamai.com> References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.45.185] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Peter Bowen Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 18:51:28 -0000 DQo+IFdoYXQgdGhlIDIza2IgVENTQyBJIGNyZWF0ZWQgdGF1Z2h0IG1lIHdhcyB0aGF0IHRoZXJl IGFyZSBvcmdzIHRoYXQgbmVlZDoNCg0KVENTQyBtZWFucyBhIHN1Yi1DQSB3aXRoIGEgbmFtZUNv bnN0cmFpbnRzIGZpZWxkPw0K From nobody Tue Dec 13 10:54:01 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32FB31294A7 for ; Tue, 13 Dec 2016 10:54:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.117 X-Spam-Level: X-Spam-Status: No, score=-7.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9s_OKbVnRKJg for ; Tue, 13 Dec 2016 10:53:58 -0800 (PST) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 518E312948F for ; Tue, 13 Dec 2016 10:53:58 -0800 (PST) Received: from tussmtmtaapi01.symc.symantec.com (tus3-f5-symc-ext-prd-snat3.net.symantec.com [10.44.130.3]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 85.1F.03943.5C340585; Tue, 13 Dec 2016 18:53:57 +0000 (GMT) X-AuditID: 0a2c7e31-1b4839a000000f67-0f-585043c5e499 Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat5.net.symantec.com [10.44.130.5]) by tussmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 3A.68.04151.4C340585; Tue, 13 Dec 2016 18:53:57 +0000 (GMT) Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 13 Dec 2016 10:53:55 -0800 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.128.7) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Tue, 13 Dec 2016 18:53:55 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=bqQBBnGrS84dQgkw0kRQIBMfl6+Rm57+B+CrT85z4dk=; b=ifh14jDebqhfePAlImIYk5xFvvh6EOBMQK67W1HPq8EJi3LKhOdyDudcE1btvBdjl18C4kyPdGA3BPJNh7uxw2kEEf9swYSNthrtulBe2ZSnEsxiyL0/ZOc8CjRv2eFAkzgp5/uyUN6KtWIBIqXa3T+OX2qjWZOUgQFcuZ31vkY= Received: from BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) by BLUPR16MB0449.namprd16.prod.outlook.com (10.164.16.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Tue, 13 Dec 2016 18:53:48 +0000 Received: from BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) by BLUPR16MB0449.namprd16.prod.outlook.com ([10.164.16.19]) with mapi id 15.01.0771.014; Tue, 13 Dec 2016 18:53:48 +0000 From: Steve Medin To: "Salz, Rich" , Ryan Sleevi Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAL810AAAFHujAAAF07gAAHr5cwAAIPwoAAHtH3sAAAu/SAAAAH9YA= Date: Tue, 13 Dec 2016 18:53:48 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> <6956750e79f5447d83e59580a92e62e4@usma1ex-dag1mb1.msg.corp.akamai.com> In-Reply-To: <6956750e79f5447d83e59580a92e62e4@usma1ex-dag1mb1.msg.corp.akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Steve_Medin@symantec.com; x-originating-ip: [155.64.138.28] x-ms-office365-filtering-correlation-id: 83d37103-e079-4352-e9c2-08d423895f4e x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:BLUPR16MB0449; x-microsoft-exchange-diagnostics: 1; BLUPR16MB0449; 7:rz0Mu4G6wzTMCJEEf47ZJLNrNJVctRNWAVL+i6sp3BT/ok8hKgBM9Zvi+OznuklJxykNJyHByoWzRR0US092RN3l4DdfR0dOg/TOxv/Eaa3MhsxfHFZ+s1tLWQpLtXNftA/lTof25fIW5uyLjeUYZ/ty3X/Wzm8zLblpYiwvmOLoTheaIKdSCCNaa4H6XJULEHgGda2Cr33+WgKNVvLYlWYtxK0CvUK24wSOUsbdMck790anJu6mTG7s+fWM3KqR/LEcfTiHMKiR7RdQRJJB3hcwIjnk5wyVX2I/egO0DbB2ydSAJgllQ08VfppgIHnx6jmnyG9jjOkWF02VtKcL1B3A0i7mjITq/AAnC24n4T+oj42H9tbVThLdNcK9Igwy80yrQSFS3H1vhfLBqDKgyGym0Tr3S5YyD4+PtnQ+HJGciGsdHOE16Eo/LOG4hmqTMXfQZhx8VLaxQKQoHCMH7g== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123558021)(20161123564025)(6072148); SRVR:BLUPR16MB0449; BCL:0; PCL:0; RULEID:; SRVR:BLUPR16MB0449; x-forefront-prvs: 01559F388D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(7916002)(39450400003)(189002)(13464003)(199003)(377454003)(97736004)(5001770100001)(81166006)(81156014)(5660300001)(99286002)(105586002)(8676002)(106356001)(33656002)(54356999)(7736002)(3660700001)(76176999)(122556002)(3280700002)(189998001)(229853002)(74316002)(305945005)(99936001)(101416001)(50986999)(76576001)(9686002)(7696004)(68736007)(93886004)(66066001)(38730400001)(2950100002)(39060400001)(3846002)(8936002)(2906002)(102836003)(6116002)(6436002)(92566002)(77096006)(80792005)(2900100001)(86362001)(6506006)(4326007)(10290500002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR16MB0449; H:BLUPR16MB0449.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0656_01D25548.515F6BE0" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2016 18:53:48.0389 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR16MB0449 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNKsWRmVeSWpSXmKPExsXCpdPErHvUOSDCoPWqjUVP61Umi/8PXrJY /N/SyWIx6f5cRou1jy+yOLB6TD6ygNlj56y77B7T3h9j81iy5CeTR/Pu3SwBrFFcNimpOZll qUX6dglcGdc/HWUsuOJacfbhTMYGxvdOXYycHBICJhLr5zSzdTFycQgJfGKUeDFlERtMYtvW l6wQie+MEj83LYSqOsoo8WPbSxYI5yWjxNf798DKWAQ6mSVuPrkIVTaZSeL6/DlQzhGgsqMn WEAmswnoSOze0Qi2RUTAXWLl/71gNrNAtsTJ5ztZQWxhATmJuTe3M0PUyEtc2DuNCcJOkuib /IO9i5EDaJ2qxIFbqSBhXoEYiRPvrzFD7NrNItFw+h7YTE6BYIkTrbfB9jIKiEl8P7WGCWKX uMStJ/OZID4VkXh48TTU16ISLx//Y4Woj5bo2LGeBWSXhICixN7TlRAlvhJvNi5kh7HPntoK 1drDIrHrAQuEnS0x59llqPHWEitffQCHkITAUiaJA23LoJplJDbP28k2gVF3FpKTIOyFjBKX P7jOAvtNUOLkzCcsEHFtiac3n0LZ8hLb385hhrCtJWb8OsgGYStKTOl+yA5hm0q8PvqRcQEj xypGhZLS4uLckvzSksSCVANDveLK3GQQkQhMdMl6yfm5mxjBya7OcAfjow0+hxgFOBiVeHj/ GgZECLEmlgFVHmJUARr5aMPqC4xSLHn5ealKIrzbHIDSvCmJlVWpRfnxRaU5qcWHGKU5WJTE eXmc3SKEBNITS1KzU1MLUotgskwcnFINjNpuv9b8fWfZu0dlbnSAdEHX9nXP7x/RD7X1X75B qkv7b7h4t05ZVbrznhqt07vENG6vU72jmyC4euFWN8ZXk9Py9jYeOCbmuyfjq2eC11UFiW9z /he7q+W78L6tX7HkXJX1td87E5+usirJlEvczbGPu7xp3VseJUFdgQf2zX0aTULdT0+VKbEU ZyQaajEXFScCANgXhK1+AwAA X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUiTURTHu9t9tsfh4DpNDxpZyzAsTbFgaEQm0j4USUFJBvmkD2lzatsy F0VmFGUR0UqWaCmZoBaZzrfWLIerqZialWhlmVpMCy0os7e17U7oy+V3zvnf87/nclihbIoJ ZrNydLwmh8uWiyRYsqaIibQlJqdEX3kYo7hw+oVA4XznwAqn6RxWXH5bjhR3xgfwJkZp6KwQ KttK34iVJTOPRcqqqnmB8pTZjJOZPZINGXx2Vj6vWbsxTZI59NWG8p4nFfSOXUOFaGZzMfJh gayD5iYHU4wkrIzMIZhvqBTRwIbgR7MD08CB4NvbUY8Mk3NCGJ4Y8MoMAhi6UeYNOl0ymx27 O4vIGjC3nhS5OYBsgRqnxcNCooKuj22Mm/3JUigfbhFSTSj0W0oElPfDRcMPcTFiXXYr4dEI 705LyV6wz7wUUi8zhsKeUU9PH7IT7KdfeXwRCYS57tsC6hUEIxM3BHTSABgb6BFRXgyO8b8M 1afC2da72O0FZDlYevRUsg0+3asUL3Bvd5P36gUM999hyioo+zDobR8PNVOznh8CcksAj85U ey8vgcbrbSJamGbAXvbMM5iM8NBiDL+EIkr/eyrlSgSDs0mlnpn9oOvaBKb51TA5POnlUGj5 XCakHA/Gnx0iysvhyvkxMeX1MG37gioQW4uW6Q5rtWqdWsdxeVnRMVFavTrdfXCunUuPSs9V NyDP1iVCK2r/vdWKCIvkvtLkwOQUGcPlu5RWFOZq+b6+rh8F45zcHF4eIG3e5CpLMzj9UV6T u09zOJvXWlEIi+VB0tl6524ZOcDpeBXP5/GahaqA9QkuRHGSjicV1sCbi0hl7JBfkrUkbGJF 1Injxo5VoarYIsuv1AfrOvU2fKzdNNoXm6AKkHYq5uqy89+Iuw8dPGI4kUj++DZWWE3GFU8L tv8ylRoL1JHVvdWRO+LTRjJPOk3RV/3Kd33f1lebYNBHI3t4sEUa9/j9yNXu6deRIX3mxf5y rM3kYiKEGi33D50DlsR9AwAA Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Peter Bowen Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 18:54:00 -0000 ------=_NextPart_000_0656_01D25548.515F6BE0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Yes, technically constrained subordinate CA. When the subordinate's EKU contains TLS server auth, constraint means a finite list of DNS names and directory names in the name constraints extension. > -----Original Message----- > From: Salz, Rich [mailto:rsalz@akamai.com] > Sent: Tuesday, December 13, 2016 1:51 PM > To: Steve Medin ; Ryan Sleevi ietf@sleevi.com> > Cc: Matt Palmer ; trans@ietf.org; Peter Bowen > > Subject: RE: [Trans] Redaction > > > > What the 23kb TCSC I created taught me was that there are orgs that need: > > TCSC means a sub-CA with a nameConstraints field? ------=_NextPart_000_0656_01D25548.515F6BE0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEYYw ggQZMIIDAQIQYXDLSYxfmEUp57Cm2VBbejANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMx FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3Jr MTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv bmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRp b24gQXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkG A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp emVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCvCg3C1SzbZ7kt5ZQn3aW+4LBNj7NhVjzWfMP0zT6Gy6KI4uHYpGnFteK/waZHUF5GOYvVlrq1 bxS/EM4nE54FR5sxehPYH9nTAjeLrSxH8I6BBqcNMAzr9zwPIB3cckbupQLIW8PJVmlMxRjBkXsL 1RMAm7zvw0g+RmAghSrVkLbNi6DMMt23/UBVslAcVq7MjXdNxyBNpzF272iSipAeCIFWsq1po1LQ yxzEIz0fmf5M6BZjjsYIjvYx9tL65XbdtRySo0nNzQHNaM2pabqj6x0NnKQgpsGgxdFGTBdt0qxm P5aM4ITUNv8iWcX5EWCoXwR98hr2JUJhD8RKuD6JAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADQm FTzAjU1DSR296SGS12act97FuNDkXV92IsAm+YQ6OvmMtfvsYPHozgSwyN2nA48w85jfpOakMd/T HAtG3HIgP67uBTykMz8LOaxweHNLmSvfMMJUsKg7VaH+FijNQr10boDbJ0SnzkRd1BuQmA0eQpSx ACwE0HSjAgUiY2PNg7X7wW1ia2l1/V1wQbn1v3zfvsEycyIhi1iBexWRerrjZEiwf/s2JdqV0PEk FBfdGIBrRiM5VPWOYgkEHZSQppvmJeJCRaq4kK2+CI+pC0IYlM9yOeGxQ+Aoz7fnWmwTa0mz/+MY fImLM12sM9en+do6VclYEPmq71q2z0tL3yowggZMMIIFNKADAgECAhAcNy3LuXA+a7c+8/rRC0IG MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4x HzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlT aWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENs YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTAx MDYwMDAwMDBaFw0yNTAxMDUyMzU5NTlaMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50 ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsT LENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQDEyFT eW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw ggEKAoIBAQC21/RXe57fcFE+yEhkaEDBiW4/BJJK7Rx0JyDaOM9Skzy50VrHFy0+aE5haQuybmh5 9AJ2CvjSbrYbfntLxrVP2r34SQ4Cz+ytamfrzgR5vYTM85ojBNbPQj9JzpYn6ySuYdk0uWZ6vIOJ HxiUwGrAec5n4zVQiaJsde44X/H7ma7zF0gbFg8ZejRqIWZaFIMRQMKwntDbg87fBPIyQoMOZXsL Ko5ZZXgbyWwsTl4XLjL4yuv4pTQtVo5GiJU1l8mq2hkADD5tp7GRA+PmgTUTF/OeQJrZOcwKCoda HiIje9mGj1ZoiCDnhiqmNAd0WE2O3JsYFOEQOcYCgNy3jCD9AgMBAAGjggJEMIICQDASBgNVHRMB Af8ECDAGAQH/AgEAMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0 cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9ycGEwDgYDVR0PAQH/BAQDAgEGMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwud3Mu c3ltYW50ZWMuY29tL3BjYTItZzMuY3JsMCgGA1UdEQQhMB+kHTAbMRkwFwYDVQQDExBTeW1hbnRl Y1BLSS0yLTIzMB0GA1UdDgQWBBSkM6+ww0aHq+V4SbK04kaf6gn8FTCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejAN BgkqhkiG9w0BAQsFAAOCAQEAobYafeqzznZLxBH6OMpOEPGrh3+S6lCVJcA3aAL7gq2AyzPUzEMw sEVn+yKYhjzAFZ3XRY9qIYl922HdLZGqso3wyQ7WUCvWIDeRg9EUztoB0tDxzjsiQUgyeRtLpuDS 6H4ZAYfUahBN5gRevERnuE3u2eUk/qb4KhswvL/9sQxGXApV4XIfIDVO5rhZdfGHV/YFleeAXE49 JaPRPff9h1QjweUAMxYR6oB4w5xE6cOUtyZaSkxDF8qmlnf+flaPiA/o3edR0vgUtbtg4Lr/hb4C DU1a6yDtcphIeS91zOIEKwoA+8moz0X/wSI8hf8cy/zjVKMXfHtYEfxNTffKMjCCBxUwggX9oAMC AQICEDztlWuklUUR25LYiQfCRmEwDQYJKoZIhvcNAQELBQAwgbAxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0Ex KjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzAeFw0xNjA3MjAwMDAw MDBaFw0xNzA3MjAyMzU5NTlaMFgxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMSAwHgYD VQQLDBdTeW1hbnRlYyBFbXBsb3llZSBFbWFpbDEVMBMGA1UEAwwMU3RldmVuIE1lZGluMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvq01EJSDIsFS5i9XiwbGjdpqIA4wQ7syWfq4Ma68 tG7Rnpbowe06isw9AMe4jg+vfiD+YQ1ZTvzNEB0qc7XDtS9CGdWvbDZh2oWB/dk2K6nsxAqT9mlV vs+VrSDXzpKCua6vDLghmoaTnb3F4IXqMcsUEuu9JM42jJQkyHjy61FNtw/wH2JtdcWKtFQLPYa3 eNkYwciUGtAUpR78gYMjEGXNbeuuGGoWhY1Vo6kwFdhRBmDaowrJoyHuMFnsZ/qeg94GraI2yqDW Y3yTMWoD/RMik9pU2XG5KawZClRi9S1z5s8TILqLCqj4k/1On3+dnD0xP+toKOFLz3dCs64G3wID AQABo4IDgDCCA3wwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYI KwYBBQUHAwQwHQYDVR0OBBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCMGA1UdEQQcMBqBGFN0ZXZl X01lZGluQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQG CCsGAQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNv bTCCASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNE JTIwU3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1Ul MjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmli ZXIlMjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBP JTIwJTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRp ZmljYXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNv bS9jYV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1Ud IARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNv bS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcN AQkPBDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQB KjArBgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhF ARAFBCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3 DQEBCwUAA4IBAQAkFsvRsGAuybrzzBuilyhaw5EDCzYTHBL/dOMyrPgokGbHe0cQz7dEwbfkA7Q3 RI7J1JSOFXGSrbeHlx5vl9MkIIGU+76C64wf6sGmWiI9WIH8dDN0/MD1gyFVf6Hn136R9A11haNv FQUZse4UpTyBxMxpTyOqhMPJMDZpCDNKdEyUFkavYVWF0a8mGfH11S7aVPRGid+vyuHlZCTu9gbt LVFS2dG7w80ipCNRpFm9k2mKWw0yWtnfkNLJmGH+Pz2bDd/QZzw72t0PBYsjawMvNIaLblWGaS96 a0Uopc6gaBn9iejPNnXrTocaF+g2707Y4ge9H/4jJUT0+ouWnlVtMYIEqDCCBKQCAQEwgcUwgbAx CzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3lt YW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlk dWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0Eg LSBHMwIQPO2Va6SVRRHbktiJB8JGYTANBglghkgBZQMEAgEFAKCCArMwGAYJKoZIhvcNAQkDMQsG CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEzMTg1MzQzWjAvBgkqhkiG9w0BCQQxIgQg j1M8S0VblJ/72YIZSHAMDg7U76EFB5bhOVdDEnRKyPowgZMGCSqGSIb3DQEJDzGBhTCBgjALBglg hkgBZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0D AgICAIAwDQYIKoZIhvcNAwICAUAwCwYJYIZIAWUDBAIBMAsGCWCGSAFlAwQCAzALBglghkgBZQME AgIwBwYFKw4DAhowgdYGCSsGAQQBgjcQBDGByDCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZh MIHYBgsqhkiG9w0BCRACCzGByKCBxTCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYDVQQLEyxD bGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgGA1UEAxMhU3lt YW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczAhA87ZVrpJVFEduS2IkHwkZhMA0GCSqGSIb3 DQEBAQUABIIBAFeZXrHkbkkCgXDFe9/oZ6c2qiKYuD4hGoiocD/ePNUScaOzY7aOhSJj20L5cxgt JIRO77udsxvA35lrfCpVMZelRDdQ9boIqE6hIZefncC5h1m1leyHDpuWEBxbhCxoDXzQmk/kRqHy UZMUXoVg4FGkhqni5DISScMVHTh7iPobEWOiTZmsGKNuxusbl7aLnRfbHXUnCKxd8+mBM5Z9XbJY OEPtL/A38w8qOxjY2rraXa62o8B8ne22WKprJgv/OfSF4voobRRnniKWNTq/2lRecFixwPoY3z3o /PFauO/tG3t2DRSDeCg2KedNzZbvQL0RLJepWg3wS2jyRJn2uCoAAAAAAAA= ------=_NextPart_000_0656_01D25548.515F6BE0-- From nobody Tue Dec 13 14:34:54 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3F8812945F for ; Tue, 13 Dec 2016 14:34:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.098 X-Spam-Level: X-Spam-Status: No, score=-7.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xhb4jBEbS-Uj for ; Tue, 13 Dec 2016 14:34:51 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26C0E129C11 for ; Tue, 13 Dec 2016 14:34:50 -0800 (PST) Received: from email.digicert.com (ex1-sgu [10.12.1.5]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPS id 284568FA17B; Tue, 13 Dec 2016 22:34:49 +0000 (GMT) From: Jeremy Rowley To: Ryan Sleevi Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAannQAAAFuH4AADpBY4P//3JMA//88dGA= Date: Tue, 13 Dec 2016 22:34:45 +0000 Message-ID: <82e822898faa4db082968b5f9086abcc@EX2.corp.digicert.com> References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [67.137.52.7] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_03F4_01D25556.6DF4BDB0" MIME-Version: 1.0 Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Steve Medin Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 22:34:52 -0000 ------=_NextPart_000_03F4_01D25556.6DF4BDB0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit We explained in the instructions that this only meant the left-most label of the DNS. We are about to roll the survey out to a larger customer base. I'm planning on clarifying that question as most people don't read instructions. Note, this survey was only sent to customers we categorize as "enterprise", meaning Plex and similar mass issuance customers were not included. I should include them for round 2. Tl;dr - I meant left-most label, but it could have been confused. -----Original Message----- From: Ryan Sleevi [mailto:ryan-ietf@sleevi.com] Sent: Monday, December 12, 2016 8:53 PM To: Jeremy Rowley Cc: Steve Medin ; Matt Palmer ; trans@ietf.org Subject: Re: [Trans] Redaction Out of curiousity, did you expand on what "Hide the DNS Label" means? In your original message, you suggested "100% of the concerned respondents wanted to support redaction of the left most label in the DNS." - but wildcards (which, in practice and as implemented by sane and astute readers of RFC 6125, is limited to the leftmost label) already accomplish this. I guess I'm trying to distinguish between whether, based on your survey, 100% of your customers are satisfied with ?.example.com Or if they are also imagining ?.?.example.com Arguably, it's much easier both in policy and in tech to restrict to ?.example.com, but it may be useful to confirm that was what you meant. ------=_NextPart_000_03F4_01D25556.6DF4BDB0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPdzCCA7cw ggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShY YAz4gNqpFZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g 1x/isdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm+qTZ 1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusIXxh3TwID AQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SS y4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTT PYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mzXeuy CSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTrQrf6jB7dYvG+UGe3 bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVt bI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCyp/oKRS+i8PIwggVmMIIETqADAgECAhALgHcH Lzs1YGO/amtK2gTIMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNI QTIgQXNzdXJlZCBJRCBDQTAeFw0xNTEwMTMwMDAwMDBaFw0xOTAxMTAxMjAwMDBaMIGBMQswCQYD VQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNlcnQx FjAUBgNVBAMTDUplcmVteSBSb3dsZXkxKTAnBgkqhkiG9w0BCQEWGmplcmVteS5yb3dsZXlAZGln aWNlcnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8kPdqjF+ljW5h8W7mQpM jaGlZ9YDLYTtUzcQjl71vRI4M6WSiZiUfbueAgupsQnxvl8By0BdwVmXnOIAUvqpFqzZhNIc8DGH M+uvXgT4+aoQvn9qPlt04CN5hzE/GFVvqs3neWgGfkzp1Z5H6RiqNoTOzdDWyr09Q8Gzm1jW9lTq sX0cxqooYtk29ooq12BvbVz0Jjgtt4Erdp27bTth11CaulJUDRT39YLLAwiR0bw3eMu8DCyuXAwV D68Ux33UbgYU9uvyFxBhJ83ST+1aw0r4E6iYTlQnKtYjEoNwlifhkwm4xS+lQHuTirpJGRFV42hd l9AtWQKRGuCUBL5EdwIDAQABo4IB8zCCAe8wHwYDVR0jBBgwFoAU5wIjgABP2Ne8lAvZP3Q5STI8 inkwHQYDVR0OBBYEFPEtLfkj2twAoaYEb8gixWV8QW8HMAwGA1UdEwEB/wQCMAAwJQYDVR0RBB4w HIEaamVyZW15LnJvd2xleUBkaWdpY2VydC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG CCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCGSAGG/WwEAQIwKjAoBggrBgEFBQcC ARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBiAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmwwPaA7oDmG N2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmww eQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYI KwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVk SURDQS5jcnQwDQYJKoZIhvcNAQELBQADggEBAKy4O+nfR40jBgIFlaomX723rsDsnP/MT7xA9waf /K/JSqkfi97389rH0IXxwcEG/ne664wDmq4tZ9EfFkT2cGv0+itbcCDETeeu9bqOj6/LbXiYj9EB zyRFTcZih4NBIVEpTEcEIZfFfNWn3yDocY6K9wZFaM4UKLAqsnN0xYEKCNkSFsWv1Ol/8J3p363A f+PrswxqzejMiYvsi0nFYPFUMby901Crme/n4xpIJ57mLWy28YshNFip8sIOmCdVJcJ9KU65YljF 5D0cWyFk4xslKhHz6x3LKwqQmpedxWG3zYJVcaqLuTyZSqaewzJ5q8qH+usnmkmb+tcF/SDFD7Aw ggZOMIIFNqADAgECAhAErnlgZmaQGrnFf6ZsW9zNMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xMzExMDUxMjAwMDBaFw0yODEx MDUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANz4ESM/arXvwCd5Gy0Fh6IQQzHfDtQVG093 pCLOPoxw8L4Hjt0nKrwBHbYsCsrdaVgfQe1qBR/aY3hZHiIsK/i6fsk1O1bxH3xCfiWwIxnGRTjX PUT5IHxgrhywWhgEvo8796nwlJqmDGNJtkEXU0AyvU/mUHpQHyVF6PGJr83/Xv9Q8/AXEf+9xYn1 vWK52PuORQSFbZnNxUhN/SarAjZF6jbXX2riGoJBCtzp2fWRF47GIa04PBPmHn9mnNVN2Uba9s9S p307JMO0wVE1xpvr1O9+5HsD4US9egs34E/LgooNcRjkpuCJLBvzsnM8wbCSnhh9vat9xX0IoSzC n3MCAwEAAaOCAvgwggL0MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsG AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMIGBBgNVHR8E ejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290 Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDCCAbMGA1UdIASCAaowggGm MIIBogYKYIZIAYb9bAACBDCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNv bS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBz ACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMA ZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQ AFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUA ZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABh AG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIA eQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFOcCI4AAT9jXvJQL2T90OUkyPIp5MB8G A1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQBO1Iknuf0d h3d+DygFkPEKL8k7Pr2TnJDGr/qRUYcyVGvoysFxUVyZjrX64GIZmaYHmnwTJ9vlAqKEEtkV9gpE V8Q0j21zHzrWoAE93uOC5EVrsusl/YBeHTmQvltC9s6RYOP5oFYMSBDOM2h7zZOr8GrLT1gPuXtd GwSBnqci4ldJJ+6Skwi+aQhTAjouXcgZ9FCATgLZsF2RtJOH+ZaWgVVAjmbtgti7KF/tTGHtBlgo GVMRRLxHICmyBGzYiVSZO3XbZ3gsHpJ4xlU9WBIRMm69QwxNNNt7xkLb7L6rm2FMBpLjjt8hKlBX BMBgojXVJJ5mNwlJz9X4ZbPg4m7CMYIDrzCCA6sCAQEweTBlMQswCQYDVQQGEwJVUzEVMBMGA1UE ChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdp Q2VydCBTSEEyIEFzc3VyZWQgSUQgQ0ECEAuAdwcvOzVgY79qa0raBMgwCQYFKw4DAhoFAKCCAgsw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEzMjIzNDQ0WjAj BgkqhkiG9w0BCQQxFgQUivhu8RBgCJkuq6DsK8vq67wIwnwwgYgGCSsGAQQBgjcQBDF7MHkwZTEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0 LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK 2gTIMIGKBgsqhkiG9w0BCRACCzF7oHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0 IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK2gTIMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZI AWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwIC AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJ YIZIAWUDBAIBMA0GCSqGSIb3DQEBAQUABIIBADqrP0E/SdAOCQ8/MUm40sEZCGyuAe9o4DbfBV02 oqs9nzWvgt1SUX1srr9Rrdypv1EvdxHAupKzMekGWcLgbE9wDFEZJQ9gJY1Y5+sR1gIGFBRv+mmu aq5PWgaO6YYSOgiO71/L5Mjmn3aHhnlERjDOXbIGrGq2IcwJhxd9w7lo8eiXhv8EWv5wsMMobL/z cdkRLNhCNUPQ+QNpeEUBHWohwmtq6CeGPWQiKjyj5OURPq8KUbFkKwpevp1YAITRJX70dE0cO2e0 VJgZ34OhJ61gOZrhXU++EtYKDApC9vkEiiEIhxXvDrs2zRbaYtmdK6mSy0daMsHbcxEGIfaL+JwA AAAAAAA= ------=_NextPart_000_03F4_01D25556.6DF4BDB0-- From nobody Tue Dec 13 14:41:18 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BF3E129C3B for ; Tue, 13 Dec 2016 14:41:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.098 X-Spam-Level: X-Spam-Status: No, score=-7.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZDvcsbaUrIa for ; Tue, 13 Dec 2016 14:41:14 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14884129C3E for ; Tue, 13 Dec 2016 14:41:00 -0800 (PST) Received: from email.digicert.com (ex1-sgu [10.12.1.5]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPS id AA32C7FA603; Tue, 13 Dec 2016 22:40:59 +0000 (GMT) From: Jeremy Rowley To: Steve Medin , Ryan Sleevi Thread-Topic: [Trans] Redaction Thread-Index: AdJUlksjv9TRzUd9SniOmObi+d+60QAannQAAAFuH4AAADbXgAAIcw2AAAFMTIAAH4BcAAAGsanw Date: Tue, 13 Dec 2016 22:40:56 +0000 Message-ID: References: <6268e70318aa4ba2acf869829fcb62c3@EX2.corp.digicert.com> <20161212222134.GM11153@hezmatt.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [67.137.52.7] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0425_01D25557.4B3E1040" MIME-Version: 1.0 Archived-At: Cc: Matt Palmer , "trans@ietf.org" , Peter Bowen Subject: Re: [Trans] Redaction X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 22:41:16 -0000 ------=_NextPart_000_0425_01D25557.4B3E1040 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Customers aren't required to solely the TCSC. They could use the TCSC for the ones they want redacted and a standard intermediate for the others. Most of the customers I've spoken with don't plan on redacting a lot of domains. There are just certain domain paths they want to make secret. For them, the TCSC is perfect because they can redact all sub domains while still leaving all their externally facing stuff on a regular intermediate. -----Original Message----- From: Trans [mailto:trans-bounces@ietf.org] On Behalf Of Steve Medin Sent: Tuesday, December 13, 2016 11:50 AM To: Ryan Sleevi Cc: Matt Palmer ; trans@ietf.org; Peter Bowen Subject: Re: [Trans] Redaction What the 23kb TCSC I created taught me was that there are orgs that need: .. And .. And all the permutations thereof, as well as the directory names of 80 data centers owing to a legacy of inserting the place of operation in the DN rather than corporate global or regional HQ. Brand is also deep, not only through acquisition but some orgs have a web presence of hundreds of microsites that are FQDN rather than query path. When a TCSC is created, it has to envelope a legacy of naming that received certificates in another manner. That means a lot of decisions that were made without DNS name and directory name constraints need to be accounted for in the extension. Once the TCSC is created, unless IT has an overbearing role in domain/brand approval, the deep branded organization is going to put a new name in the second/third level domain for every launch. That's another key ceremony, a new intermediate on the AIA CA Issuers URI, and ALL CAPS in the certificate issuance email reminding the server admin to rip out the old intermediate and add the new one. Ten brand launches later, 11 different TCSCs, wait, which one do I install? I don't intend to offend server admins, this isn't a matter of competence, it's a matter of the number and variety of tasks carried by the typical admin in the type of organization I describe. > -----Original Message----- > From: Ryan Sleevi [mailto:ryan-ietf@sleevi.com] > Sent: Monday, December 12, 2016 10:48 PM > To: Steve Medin > Cc: Peter Bowen ; Matt Palmer > ; trans@ietf.org > Subject: Re: [Trans] Redaction > > On Mon, Dec 12, 2016 at 7:10 PM, Steve Medin > wrote: > > Yea, but when I talk about the Plex Pass certs, I'm not on the > > internal network privacy concern that split-horizon suits, I'm > > talking about how TCSC fits customers with static and limited domain > > ownership. > > Can you expand on what use case for redaction doesn't fit into that > model? I don't believe we've heard such a use case articulated. > > That is, while it's possible to imagine foo.corp.example.com as part > of a domain hierarchy, or even impendingmerger.example.com (to use > Peter Bowen's example), are you suggesting that you believe it to be > routine and normal that such certificate holders need > > impendingmerger.example.com > impendingmerger.example.net > impendingmerger.example.org > impendingmerger.example > impendingmerger.pretend-the-next-word-is-a-cctld.example > impendingmerger.some-other-brand-name.example > (etc)? > > Otherwise, the discussion of the limitations of TCSC to branding don't > really seem to fit to the topic of the redaction use cases discussed > so far, but it's possible you're imagining a yet undiscovered case? ------=_NextPart_000_0425_01D25557.4B3E1040 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPdzCCA7cw ggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShY YAz4gNqpFZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g 1x/isdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm+qTZ 1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusIXxh3TwID AQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SS y4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTT PYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mzXeuy CSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTrQrf6jB7dYvG+UGe3 bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVt bI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCyp/oKRS+i8PIwggVmMIIETqADAgECAhALgHcH Lzs1YGO/amtK2gTIMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNI QTIgQXNzdXJlZCBJRCBDQTAeFw0xNTEwMTMwMDAwMDBaFw0xOTAxMTAxMjAwMDBaMIGBMQswCQYD VQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNlcnQx FjAUBgNVBAMTDUplcmVteSBSb3dsZXkxKTAnBgkqhkiG9w0BCQEWGmplcmVteS5yb3dsZXlAZGln aWNlcnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8kPdqjF+ljW5h8W7mQpM jaGlZ9YDLYTtUzcQjl71vRI4M6WSiZiUfbueAgupsQnxvl8By0BdwVmXnOIAUvqpFqzZhNIc8DGH M+uvXgT4+aoQvn9qPlt04CN5hzE/GFVvqs3neWgGfkzp1Z5H6RiqNoTOzdDWyr09Q8Gzm1jW9lTq sX0cxqooYtk29ooq12BvbVz0Jjgtt4Erdp27bTth11CaulJUDRT39YLLAwiR0bw3eMu8DCyuXAwV D68Ux33UbgYU9uvyFxBhJ83ST+1aw0r4E6iYTlQnKtYjEoNwlifhkwm4xS+lQHuTirpJGRFV42hd l9AtWQKRGuCUBL5EdwIDAQABo4IB8zCCAe8wHwYDVR0jBBgwFoAU5wIjgABP2Ne8lAvZP3Q5STI8 inkwHQYDVR0OBBYEFPEtLfkj2twAoaYEb8gixWV8QW8HMAwGA1UdEwEB/wQCMAAwJQYDVR0RBB4w HIEaamVyZW15LnJvd2xleUBkaWdpY2VydC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG CCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCGSAGG/WwEAQIwKjAoBggrBgEFBQcC ARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBiAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmwwPaA7oDmG N2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMS5jcmww eQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYI KwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVk SURDQS5jcnQwDQYJKoZIhvcNAQELBQADggEBAKy4O+nfR40jBgIFlaomX723rsDsnP/MT7xA9waf /K/JSqkfi97389rH0IXxwcEG/ne664wDmq4tZ9EfFkT2cGv0+itbcCDETeeu9bqOj6/LbXiYj9EB zyRFTcZih4NBIVEpTEcEIZfFfNWn3yDocY6K9wZFaM4UKLAqsnN0xYEKCNkSFsWv1Ol/8J3p363A f+PrswxqzejMiYvsi0nFYPFUMby901Crme/n4xpIJ57mLWy28YshNFip8sIOmCdVJcJ9KU65YljF 5D0cWyFk4xslKhHz6x3LKwqQmpedxWG3zYJVcaqLuTyZSqaewzJ5q8qH+usnmkmb+tcF/SDFD7Aw ggZOMIIFNqADAgECAhAErnlgZmaQGrnFf6ZsW9zNMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xMzExMDUxMjAwMDBaFw0yODEx MDUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANz4ESM/arXvwCd5Gy0Fh6IQQzHfDtQVG093 pCLOPoxw8L4Hjt0nKrwBHbYsCsrdaVgfQe1qBR/aY3hZHiIsK/i6fsk1O1bxH3xCfiWwIxnGRTjX PUT5IHxgrhywWhgEvo8796nwlJqmDGNJtkEXU0AyvU/mUHpQHyVF6PGJr83/Xv9Q8/AXEf+9xYn1 vWK52PuORQSFbZnNxUhN/SarAjZF6jbXX2riGoJBCtzp2fWRF47GIa04PBPmHn9mnNVN2Uba9s9S p307JMO0wVE1xpvr1O9+5HsD4US9egs34E/LgooNcRjkpuCJLBvzsnM8wbCSnhh9vat9xX0IoSzC n3MCAwEAAaOCAvgwggL0MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsG AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMIGBBgNVHR8E ejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290 Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDCCAbMGA1UdIASCAaowggGm MIIBogYKYIZIAYb9bAACBDCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNv bS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBz ACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMA ZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQ AFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUA ZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABh AG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIA eQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFOcCI4AAT9jXvJQL2T90OUkyPIp5MB8G A1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQBO1Iknuf0d h3d+DygFkPEKL8k7Pr2TnJDGr/qRUYcyVGvoysFxUVyZjrX64GIZmaYHmnwTJ9vlAqKEEtkV9gpE V8Q0j21zHzrWoAE93uOC5EVrsusl/YBeHTmQvltC9s6RYOP5oFYMSBDOM2h7zZOr8GrLT1gPuXtd GwSBnqci4ldJJ+6Skwi+aQhTAjouXcgZ9FCATgLZsF2RtJOH+ZaWgVVAjmbtgti7KF/tTGHtBlgo GVMRRLxHICmyBGzYiVSZO3XbZ3gsHpJ4xlU9WBIRMm69QwxNNNt7xkLb7L6rm2FMBpLjjt8hKlBX BMBgojXVJJ5mNwlJz9X4ZbPg4m7CMYIDrzCCA6sCAQEweTBlMQswCQYDVQQGEwJVUzEVMBMGA1UE ChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdp Q2VydCBTSEEyIEFzc3VyZWQgSUQgQ0ECEAuAdwcvOzVgY79qa0raBMgwCQYFKw4DAhoFAKCCAgsw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMjEzMjI0MDU2WjAj BgkqhkiG9w0BCQQxFgQUxKFXOQbla2bRsOOSyLjYQqLVjOwwgYgGCSsGAQQBgjcQBDF7MHkwZTEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0 LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK 2gTIMIGKBgsqhkiG9w0BCRACCzF7oHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0 IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBAhALgHcHLzs1YGO/amtK2gTIMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZI AWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwIC AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJ YIZIAWUDBAIBMA0GCSqGSIb3DQEBAQUABIIBAMh9t4ZX1hZcjo8h7RtLEhe/3B7O8FrmqHTf7DgI YPbmaTXFShjyJURGi8OGqkQeVYeD5DDzwhW+NevgjyjXQeJElASJwc3uOIjyIAJlo3wh2R+Z9XS3 iM+8uZaI+ChFyTbAlzYuJdZID9c30foerijPut53S0ygAkR7/WlUovVWr7TfNBxYXZE+TBCIuEbP 3mZ3l5pn+rG1y2t4oLWaOMRApz3taTFeHrD2YaRMLH4CDKnr43aCD+1F9EkOup8gQN3PJlnJIEzT VMWIQDdnoT/H43RNAhCLoNPA8XWbrvTQ7ENfgDcgXkRLJc0pgEMejpLDkwwgx1rS4ESk0wVdH/EA AAAAAAA= ------=_NextPart_000_0425_01D25557.4B3E1040-- From nobody Tue Dec 13 16:01:40 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD85F129C95 for ; Tue, 13 Dec 2016 16:01:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=andrewayer.name Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3iUCuf3ny7qv for ; Tue, 13 Dec 2016 16:01:30 -0800 (PST) Received: from alcazar.beanwood.com (alcazar.beanwood.com [IPv6:2600:3c00:e000:6c::1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63947129C9A for ; Tue, 13 Dec 2016 15:59:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=andrewayer.name; s=beanwood20160511; t=1481673558; bh=123AOJBauCQakmYpuOidaeKXxXqJL516l19MKZpypFo=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=CE4yM2FNA0rSe11tJ4viw/OeQqgnDpo5HJRGvPmklIygC8OuSRiert4OGbn8kMAoe Ol0zNNls3kXW1nScdYQU9i2wKF4cPKl2JbpmrZFYi/J0BsgVLcIAc6BpOQp+7Y/72o cwpg5zVMzeWy+1aZrjHsuoq9qwfBTYnxQIi2Ax9hcZqqzPixuliiktM6azX/Cg+AvM Hvt+lBa9SSSN6PClf/6p3MEHeSB1OqB5LiomfbRbRfKJxAGa4jjd8Ot4J0sdp2Qnk8 0L4EzXpFmIuB4b0W98SH5abNH9xWTjpquOg9q3O3/ytsnOpwkInkbRXdzRR9S8eT3R Y2YfPxeP/dGYg== Date: Tue, 13 Dec 2016 15:59:17 -0800 From: Andrew Ayer To: Eran Messeri Message-Id: <20161213155917.195a6b88a726c74cc320d7df@andrewayer.name> In-Reply-To: References: <06cb8a34-7067-95af-708d-b2c2be261a1d@comodo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Archived-At: Cc: Paul Wouters , "trans@ietf.org" , Rob Stradling , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 00:01:32 -0000 On Tue, 13 Dec 2016 14:32:04 +0000 Eran Messeri wrote: > * For Hash Algorithm repository, specify "Expert Review" guiding the > Expert to make sure the proposed hash algorithm has public > specification and does not suffer from known preimage attacks. The hash algorithm also needs collision resistance. How precise does the guidance need to be? "Not suffer from known preimage attacks" wouldn't be construed as forbidding SHA-2 because there are some very expensive preimage attacks on some rounds, would it? Arguably, "suitable for use as a cryptographic hash function" covers both preimage and collision resistance, and leaves it to the expert's discretion what attacks are worth worrying about. Would leaving it at this provide sufficient guidance? Regards, Andrew From nobody Tue Dec 13 16:20:33 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28AB81294EC for ; Tue, 13 Dec 2016 16:20:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6yDKu6NkKodQ for ; Tue, 13 Dec 2016 16:20:30 -0800 (PST) Received: from elasmtp-galgo.atl.sa.earthlink.net (elasmtp-galgo.atl.sa.earthlink.net [209.86.89.61]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01D21129A03 for ; Tue, 13 Dec 2016 16:20:29 -0800 (PST) Received: from [47.143.125.162] (helo=Williams-MacBook-Pro.local) by elasmtp-galgo.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1cGxIo-0004mE-Np; Tue, 13 Dec 2016 19:20:10 -0500 Date: Tue, 13 Dec 2016 16:20:10 -0800 From: Bill Frantz To: Andrew Ayer X-Priority: 3 In-Reply-To: <20161213155917.195a6b88a726c74cc320d7df@andrewayer.name> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-Mailer: Mailsmith 2.4 (470) X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec79f478480cc4a34e03554b6b970a3dbf19350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 47.143.125.162 Archived-At: Cc: Eran Messeri , trans@ietf.org Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 00:20:32 -0000 On 12/13/16 at 3:59 PM, agwa@andrewayer.name (Andrew Ayer) wrote: >On Tue, 13 Dec 2016 14:32:04 +0000 >Eran Messeri wrote: > >>* For Hash Algorithm repository, specify "Expert Review" guiding the >>Expert to make sure the proposed hash algorithm has public >>specification and does not suffer from known preimage attacks. > >The hash algorithm also needs collision resistance. > >How precise does the guidance need to be? "Not suffer from known >preimage attacks" wouldn't be construed as forbidding SHA-2 because >there are some very expensive preimage attacks on some rounds, would it? > >Arguably, "suitable for use as a cryptographic hash function" covers >both preimage and collision resistance, and leaves it to the expert's >discretion what attacks are worth worrying about. Would leaving it at >this provide sufficient guidance? It might be better to specifically mention the characteristics=20 known to be needed along with some general guidance which leans=20 on the reviewer's expertise. Perhaps: "Suitable for use as a cryptographic hash with no known preimage=20 or collision attacks. These attacks can damage the integrity of=20 the log." Cheers - Bill ------------------------------------------------------------------------ Bill Frantz |"Insofar as the propositions of mathematics=20 refer to 408-356-8506 | reality, they are not certain; and insofar=20 they are www.pwpconsult.com | certain, they do not refer to reality.=E2=80=9D=20 -- Einstein From nobody Tue Dec 13 16:55:57 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 685F51295FA for ; Tue, 13 Dec 2016 16:55:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.197 X-Spam-Level: X-Spam-Status: No, score=-7.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ams1l5gRSNID for ; Tue, 13 Dec 2016 16:55:53 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 107AF129489 for ; Tue, 13 Dec 2016 16:48:31 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AFF6FBE47; Wed, 14 Dec 2016 00:48:27 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdSvepKGaQ3Z; Wed, 14 Dec 2016 00:48:26 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E5137BE39; Wed, 14 Dec 2016 00:48:25 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1481676506; bh=sUaVVnrPjq//vcDkbuvo8mpvlYu+oJGrh5vQSgK+Lb4=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=lE+nMmQ8Z3WaS7eyPn3V+HrEjFIjj41tEVA2GDIHmFNePPXOVKSnJRYp1fckv6DD2 70vpBrs1LS0/ix559v87HuPWMHkpTIAI5DIPdFF1cLrkJZwirxebdOjdUr+v++r6Qa 1l6ygXYKZMyFH9FAyHURChL3U8+ECjkQA5Xxt2vE= To: Bill Frantz , Andrew Ayer References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> Date: Wed, 14 Dec 2016 00:48:26 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms020007050008020300030901" Archived-At: Cc: Eran Messeri , trans@ietf.org Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 00:55:56 -0000 This is a cryptographically signed message in MIME format. --------------ms020007050008020300030901 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Just a comment from the sidelines... On 14/12/16 00:20, Bill Frantz wrote: >=20 > "Suitable for use as a cryptographic hash with no known preimage or > collision attacks. These attacks can damage the integrity of the log." If taking this approach it might be useful to consider the duration for which any such properties are desired, e.g. to consider how that duration maps to hashes used in certificate signing would seem like a natural enough thing to do. And it might even be the case that such consideration provides a way to avoid a separate registry maybe, not sure. S. --------------ms020007050008020300030901 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMTQw MDQ4MjZaMC8GCSqGSIb3DQEJBDEiBCBCDjQldPZx6nUTniIKCTYkl7f0nqJ/Zu4XjKpc/pha 8jBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQC0KbUSWzUO4U8du3YMC53kPV774kHGsksDPwmraBLv3If1QWv2pn0y laL5Wzebjs5bjRrN846arwO76u5m9yQlOyCmeNjwKh9pjQUlJ3kphSNDkOw1yb/BVUjWIODa Ob5Zc6zEaBfmkQEmOxmk5XhmLNDJbTtPLXqXuZQDnkj5UH/oc1wd9VbgpAqK4NNGl2Va/NBx 7uCM/m6yT6es5MDz274xqbcRdNFIGfrljqkmMX5dqm2UHZLfRdF9zlAzXhD40pPUa3rjZ/LQ 8y2tjjyt1S6Z61tJnXy4IOQRvCZVNOpRH3kpCwiiOqyF7mIhSmJDEJR39qLeRzNH9x1Wmihr AAAAAAAA --------------ms020007050008020300030901-- From nobody Wed Dec 14 03:47:05 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 615C9129DDC for ; Wed, 14 Dec 2016 03:47:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QaLSDM6AHdII for ; Wed, 14 Dec 2016 03:47:00 -0800 (PST) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36565129DC8 for ; Wed, 14 Dec 2016 03:46:58 -0800 (PST) Received: (qmail 16186 invoked by uid 1004); 14 Dec 2016 11:46:56 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Wed, 14 Dec 2016 11:46:56 +0000 Received: (qmail 30910 invoked by uid 1000); 14 Dec 2016 11:46:56 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Wed, 14 Dec 2016 11:46:56 +0000 To: Stephen Farrell , Bill Frantz , Andrew Ayer References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> From: Rob Stradling Message-ID: <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> Date: Wed, 14 Dec 2016 11:46:55 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Eran Messeri , trans@ietf.org Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 11:47:03 -0000 FYI, I've been revamping the 6962-bis registry sections in this PR: https://github.com/google/certificate-transparency-rfcs/pull/216 On 14/12/16 00:48, Stephen Farrell wrote: > > Hiya, > > Just a comment from the sidelines... > > On 14/12/16 00:20, Bill Frantz wrote: >> >> "Suitable for use as a cryptographic hash with no known preimage or >> collision attacks. These attacks can damage the integrity of the log." > > If taking this approach it might be useful to consider the > duration for which any such properties are desired, e.g. to > consider how that duration maps to hashes used in certificate > signing would seem like a natural enough thing to do. And it > might even be the case that such consideration provides a way > to avoid a separate registry maybe, not sure. > > S. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Wed Dec 14 04:28:12 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB8B3129536 for ; Wed, 14 Dec 2016 04:28:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yCOQo7DCONRS for ; Wed, 14 Dec 2016 04:28:08 -0800 (PST) Received: from mail-wj0-x22c.google.com (mail-wj0-x22c.google.com [IPv6:2a00:1450:400c:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB57C1295C4 for ; Wed, 14 Dec 2016 04:28:06 -0800 (PST) Received: by mail-wj0-x22c.google.com with SMTP id tg4so31761459wjb.1 for ; Wed, 14 Dec 2016 04:28:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=my55LYiTIPH1dOUx1oVOWqYxlysynwfhzyItO5ICJBg=; b=YTljs1YOAa4SUK6NQDWmrVVBoM6DRlCdBNvSI2GlTOPjN8yrp/ALvObTj/i3yHH+1k r9NOxOq0UkbVtsS99f/mYNqx2M9vv12l6J0E/PjHJ/4f8VRtPDXzr853pIx22AERfdnh Vm+OBfbtUu4an+jCRghthb6ZdescG9lV06OkAfT2ohCru0U0ZylMhcPUbQtHgBl5lk/D +IeMFdjYcsVLg1BIVbdfSR5uc58jn4xYON0OXWcJYCYBZy+OBgoYF99kfClL/c7jMoE4 VZ5KyPikGDQ7JIkiPaW7evH78+xqm9RUQSuKORhbkfAdBuG3doziSAsOWIKynj4EVBP/ Ouzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=my55LYiTIPH1dOUx1oVOWqYxlysynwfhzyItO5ICJBg=; b=Mz5R4bFfT+IYy644TdK+FkAHYomgFlaKQ9Ea6DKumbVfzgJi/Jfm+JUDpfahV/UPXf /jj935V9u3l/6w8soxR4/ZB3vAnckGK77QaVD0StU7Yu6R4zl24sGX5s/8e2F7qKPed3 gQ+sJuhm97oVWGx0V9qvKK6v2UrgSgHJBi8QVACegF82gYUcAmcSDueZ2sWjHkIsS/XU 7SmL/J0gnLE67RLucMZFLPj6pzcmvy9QW6uT8ZJua7wk8MDxd3bT2QL8IxmMEArSnVZK VWshKqcXzx6WTaPjxkyrUJA7ckAHtgKavffUdAeEHeSk4R9PBpSP7KnxExQ9ZwopD+z9 6vGA== X-Gm-Message-State: AKaTC03TieKKP2jRCxx8akTuetIEozDuu/kwn8mjUNn5kLEr5LYqa+PDGsLfGvR09heUfivEabNPZQtzL8Kuq+K2 X-Received: by 10.28.96.4 with SMTP id u4mr7366508wmb.86.1481718485254; Wed, 14 Dec 2016 04:28:05 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Wed, 14 Dec 2016 04:27:34 -0800 (PST) In-Reply-To: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> From: Eran Messeri Date: Wed, 14 Dec 2016 12:27:34 +0000 Message-ID: To: Stephen Farrell Content-Type: multipart/alternative; boundary=001a1148e998f8e7ac05439d77a0 Archived-At: Cc: "trans@ietf.org" , Bill Frantz , Andrew Ayer Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 12:28:11 -0000 --001a1148e998f8e7ac05439d77a0 Content-Type: text/plain; charset=UTF-8 On Wed, Dec 14, 2016 at 12:48 AM, Stephen Farrell wrote: > > Hiya, > > Just a comment from the sidelines... > > On 14/12/16 00:20, Bill Frantz wrote: > > > > "Suitable for use as a cryptographic hash with no known preimage or > > collision attacks. These attacks can damage the integrity of the log." > > If taking this approach it might be useful to consider the > duration for which any such properties are desired, e.g. to > consider how that duration maps to hashes used in certificate > signing would seem like a natural enough thing to do. And it > might even be the case that such consideration provides a way > to avoid a separate registry maybe, not sure. > IIUC the question is for how long a hash algorithm used in a log should be resistant to preimage or collision attacks. A simple answer would be "for the entire lifetime of the log" (with the expectation that new logs would be spun up with better hash algorithms if the one in current use doesn't have these properties anymore). A more in-depth analysis of how the protocol would break if the hash algorithm used by logs is a good idea, merits more thought though (and may belong in the threat analysis document?). Re a separate registry, I've looked into re-using existing registries (following a suggestion from a colleague, David Drysdale), but concluded that it would complicate implementation by tying them to implementations of more hash algorithms than is necessary or useful to the protocol. Since each hash algorithm has to be evaluated for suitability for use in CT logs anyway, I didn't see much point in re-using an existing registry and specifying a bunch of exceptions on top of it. > > S. > > --001a1148e998f8e7ac05439d77a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Dec 14, 2016 at 12:48 AM, Stephen Farrell <= ;stephen.far= rell@cs.tcd.ie> wrote:

Hiya,

Just a comment from the sidelines...

On 14/12/16 00:20, Bill Frantz wrote:
>
> "Suitable for use as a cryptographic hash with no known preimage = or
> collision attacks. These attacks can damage the integrity of the log.&= quot;

If taking this approach it might be useful to consider the
duration for which any such properties are desired, e.g. to
consider how that duration maps to hashes used in certificate
signing would seem like a natural enough thing to do. And it
might even be the case that such consideration provides a way
to avoid a separate registry maybe, not sure.
IIUC the= question is for how long a hash algorithm used in a log should be resistan= t to preimage or collision attacks.
A simple answer would be &quo= t;for the entire lifetime of the log" (with the expectation that new l= ogs would be spun up with better hash algorithms if the one in current use = doesn't have these properties anymore).
A more in-depth analy= sis of how the protocol would break if the hash algorithm used by logs is a= good idea, merits more thought though (and may belong in the threat analys= is document?).

Re a separate registry, I've lo= oked into re-using existing registries (following a suggestion from a colle= ague, David Drysdale), but concluded that =C2=A0it would complicate impleme= ntation by tying them to implementations of more hash algorithms than is ne= cessary or useful to the protocol. Since each hash algorithm has to be eval= uated for suitability for use in CT logs anyway, I didn't see much poin= t in re-using an existing registry and specifying a bunch of exceptions on = top of it.

S.


--001a1148e998f8e7ac05439d77a0-- From nobody Wed Dec 14 07:03:23 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8236B1296C8 for ; Wed, 14 Dec 2016 07:03:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-IQ224eiq9t for ; Wed, 14 Dec 2016 07:03:16 -0800 (PST) Received: from mmextmx1.mcr.colo.comodoca.net (mmextmx1.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C62CD129702 for ; Wed, 14 Dec 2016 07:03:15 -0800 (PST) Received: (qmail 9952 invoked by uid 1004); 14 Dec 2016 15:03:13 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx1.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Wed, 14 Dec 2016 15:03:13 +0000 Received: (qmail 11010 invoked by uid 1000); 14 Dec 2016 15:03:13 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Wed, 14 Dec 2016 15:03:13 +0000 To: "trans@ietf.org" References: <1c7240d7-f38d-2011-ad45-587843e0f1f8@gmail.com> From: Rob Stradling Message-ID: <0415b9df-f67e-c19a-38d0-02135cc47a29@comodo.com> Date: Wed, 14 Dec 2016 15:03:13 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Eran Messeri , Ben Laurie , Peter Bowen , Melinda Shore Subject: Re: [Trans] Relaxing section 5.1 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 15:03:22 -0000 On 17/11/16 12:21, Eran Messeri wrote: > FYI this is the change to the draft: > https://github.com/google/certificate-transparency-rfcs/commit/bf6603e10affbee97b07e33265494efbd07c833f FYI, I did a couple of other tweaks, for consistency with this change. https://github.com/google/certificate-transparency-rfcs/commit/d5087815f84510f90d0d0649a5d9f0fb402cc6af > In addition to the change from MUST to SHOULD, I've added an example as > to why the a log may chose to reject valid submissions. > > Eran > > On Wed, Nov 16, 2016 at 8:26 PM, Ben Laurie > wrote: > > On 16 November 2016 at 02:00, Eran Messeri > wrote: > > My proposed compromise at the trans workgroup meeting yesterday was to > > change the MUST in the following paragraph to a SHOULD: > > "Logs MUST accept certificates and precertificates that are fully valid > > according to RFC 5280 verification rules and are submitted with such a > > chain." > > > > I believe that this change allows creating logs that can reject valid > > submissions under some circumstances while complying with 6962-bis. And we > > wouldn't have to go through WGLC again for such a change. > > This seems like a reasonable plan (mildly surprised such a change can > be made without WGLC, tho!). > > > > > On Sat, Nov 5, 2016 at 12:42 AM, Ben Laurie > wrote: > >> > >> On 4 November 2016 at 14:07, Peter Bowen > wrote: > >> > On Fri, Nov 4, 2016 at 6:33 AM, Ben Laurie > wrote: > >> >> > >> >> The bit you didn't quote does say they the log has to accept valid > >> >> certs, tho: "Logs MUST accept certificates and precertificates > that > >> >> are fully valid according to RFC 5280 [RFC5280] verification > rules and > >> >> are submitted with such a chain." > >> > > >> > Sorry about that. So the three MUSTs together are: > >> > > >> > - Logs MUST verify that each submitted certificate or > precertificate > >> > has a valid signature chain to an accepted trust anchor, using the > >> > chain of intermediate CA certificates provided by the submitter. > >> > > >> > - Logs MUST reject submissions without a valid signature chain > to an > >> > accepted trust anchor. > >> > > >> > - Logs MUST accept certificates and precertificates that are fully > >> > valid according to RFC 5280 verification rules and are > submitted with > >> > such a chain. > >> > > >> > When I read these together, I read that Logs must accept _any_ > >> > certificate that is fully valid according to RFC 5280 verification > >> > rules and chains to any root the log trusts and logs must > _only_ log > >> > such certificates (and no others). > >> > > >> > If this is accurate, we need to account for all types of > certificates > >> > being logged, as a log cannot choose to reject certificates for > usages > >> > other than server authentication and the log cannot reject > >> > certificates that have personal information (e.g. an server > >> > authentication certificate that states which human requested the > >> > certificate in the subject). > >> > > >> > This seems like a very strong assertion of policy rather than a > >> > technical discussion of how the CT protocol works. I would > again ask > >> > the WG to reconsider the requirement levels specified in this > section. > >> > >> FWIW, I tend to agree. I would also note that operationally, we have > >> already discussed options for logs that are incompatible with these > >> requirements, for example: > >> > >> * sharded logs (e.g. by hash(cert) mod n). > >> > >> * logs that only accept short or long lifetime certificates (this > >> would allow the working set to be reduced in size for CAs that > issue a > >> lot of short-lived certs). > >> > >> _______________________________________________ > >> Trans mailing list > >> Trans@ietf.org > >> https://www.ietf.org/mailman/listinfo/trans > > > > > > > > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online Office Tel: +44.(0)1274.730505 Office Fax: +44.(0)1274.730909 www.comodo.com COMODO CA Limited, Registered in England No. 04058690 Registered Office: 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Manchester M5 3EQ This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software. From nobody Wed Dec 14 07:49:39 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29FB4129AFF for ; Wed, 14 Dec 2016 07:49:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id osyLFVa7st4G for ; Wed, 14 Dec 2016 07:49:32 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF4EC12985D for ; Wed, 14 Dec 2016 07:49:31 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3tf1Gd381ZzCZn; Wed, 14 Dec 2016 16:49:29 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1481730569; bh=wG8bDaqe0HvRt7SoYWGiAab8n9JYPZbhJHFcn8+Ujqc=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=FIokHFiWQdW1hAVTOmU3tn2rMvLm4AL3P7TQ5cl5wOatxL0cD6zn5SNMZg9U009Tt XfKnj/v2zT+s+O0AwG69wXyNJiOUptC9C+QGhGyXutLRf5Lk8QyiLrEQCUw9pEnZEm xLkwddHxuiV01+dx94MJHGcAaXAKK8A1/1TrGj2M= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id K_L_1Yn3UxB3; Wed, 14 Dec 2016 16:49:28 +0100 (CET) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 14 Dec 2016 16:49:28 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id E65E8506F85; Wed, 14 Dec 2016 10:49:26 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca E65E8506F85 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id D0A4A40D72BA; Wed, 14 Dec 2016 10:49:26 -0500 (EST) Date: Wed, 14 Dec 2016 10:49:26 -0500 (EST) From: Paul Wouters To: Rob Stradling , Melinda Shore In-Reply-To: <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> Message-ID: References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Cc: Eran Messeri , Andrew Ayer , Trans , Bill Frantz , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 15:49:38 -0000 On Wed, 14 Dec 2016, Rob Stradling wrote: > FYI, I've been revamping the 6962-bis registry sections in this PR: > https://github.com/google/certificate-transparency-rfcs/pull/216 I think we reached a point where it has become rather confusing to see many small changes and pull requests on github. I think it would be a good idea to put out a new draft version with these changes. Then we can do a quick WGLC on the changes and move this document along. Paul From nobody Wed Dec 14 08:49:01 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D7C711293FD; Wed, 14 Dec 2016 08:48:59 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148173413987.16824.7226008968892672182.idtracker@ietfa.amsl.com> Date: Wed, 14 Dec 2016 08:48:59 -0800 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-22.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 16:49:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Version 2.0 Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-22.txt Pages : 55 Date : 2016-12-14 Abstract: This document describes version 2.0 of the Certificate Transparency (CT) protocol for publicly logging the existence of Transport Layer Security (TLS) server certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-22 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-22 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 14 09:07:21 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4DED12942F for ; Wed, 14 Dec 2016 09:07:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zaKqrx1KcGkY for ; Wed, 14 Dec 2016 09:07:14 -0800 (PST) Received: from mail-wj0-x236.google.com (mail-wj0-x236.google.com [IPv6:2a00:1450:400c:c01::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B78E129951 for ; Wed, 14 Dec 2016 09:07:14 -0800 (PST) Received: by mail-wj0-x236.google.com with SMTP id tg4so43918914wjb.1 for ; Wed, 14 Dec 2016 09:07:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=OoUlB8EGusjD5VQsG1N0DhX5UcJqnrHqKSc+ZpccYSI=; b=Sbf/qCsPndXNWP/VSFA+2z9ZQLsoMDTNwHla37RbZXDVm2637/nHvSpLkWw4XHCsn9 vSdzv5hmArvjfP+6gWYGM5W9Fl1Rxsgrk8W9DxHf6qQe+9beeydI4hCW7+oATKOXbBVU Mq4lRIZI2MV2jznQkeANK/lItbJ+ohP31S5OkD59jkcXs/i5oTA+VlbYrpR4IkzDs8cX 7IPP+fOh90pnfeQlET/ETp0dEdtlyzXyZe8Ut2qvljL7RCWHs6oGaFToN1ucxXiNYFRs 3JM0kV6vTXE5OQ/WmSHVBUL3L0sIA5m56S+4Vcn/cE74REhrjG2Bt6yuulmm+0VSYboe 1Ucg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=OoUlB8EGusjD5VQsG1N0DhX5UcJqnrHqKSc+ZpccYSI=; b=eulpn7EWWCNeJ0IzZKXUuzr2zF0A3PkzHa8i0IoPqSpPI81uE63+7S4qFipjgV3Umt Rj5x1iEhhWhw3yliaiKwlQKhvNy0Q/18r+eyqb4ZCjIDaDYseXhlmDP+7REojvxMF/Bl EwvS9xT4gj+1BDxE5Q8B8e/FvVmwZ/wi2tmLGOzG5kUkiJQxzD+qcO+fssAyg9qPCYL5 cMxU+BxZJdmX8fkR3ux7nhpXOtuNmtjbMBq17+G5ADHXuv0e3b0TEjAeXkfFe1Xouc5P v02EbWN+HqfcpS4g7S1dcKD0XsG6ByUPSykCYGSQWqLrBtIE89mrg46EKeDOM/f1B0Xs 3baQ== X-Gm-Message-State: AKaTC00xyCuRbxf3ZIkbrrjkiEbIKWGUDmYdwC7XwJZt6ppLcL/bKrMziogfcKKKcLQEDIRVVAiZiP6JkYV1JfeR X-Received: by 10.194.205.73 with SMTP id le9mr92043877wjc.31.1481735232956; Wed, 14 Dec 2016 09:07:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Wed, 14 Dec 2016 09:06:42 -0800 (PST) In-Reply-To: References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> From: Eran Messeri Date: Wed, 14 Dec 2016 17:06:42 +0000 Message-ID: To: Paul Wouters Content-Type: multipart/alternative; boundary=001a11c36b4e366c930543a15e06 Archived-At: Cc: Trans , Bill Frantz , Melinda Shore , Rob Stradling , Andrew Ayer , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 17:07:19 -0000 --001a11c36b4e366c930543a15e06 Content-Type: text/plain; charset=UTF-8 On Wed, Dec 14, 2016 at 3:49 PM, Paul Wouters wrote: > On Wed, 14 Dec 2016, Rob Stradling wrote: > > FYI, I've been revamping the 6962-bis registry sections in this PR: >> https://github.com/google/certificate-transparency-rfcs/pull/216 >> > > I think we reached a point where it has become rather confusing to > see many small changes and pull requests on github. I think it would > be a good idea to put out a new draft version with these changes. > Rob just did (thanks Rob!). > > Then we can do a quick WGLC on the changes and move this document > along. > > Paul > --001a11c36b4e366c930543a15e06 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

= On Wed, Dec 14, 2016 at 3:49 PM, Paul Wouters <paul@nohats.ca> = wrote:
On Wed, 14 Dec 20= 16, Rob Stradling wrote:

FYI, I've been revamping the 6962-bis registry sections in this PR:
https://github.com/google/certi= ficate-transparency-rfcs/pull/216

 I think we reached a point where it has become rather confusing to
see many small changes and pull requests on github. I think it would
be a good idea to put out a new draft version with these changes.
Rob just did (thanks Rob!).=C2=A0

Then we can do a quick WGLC on the changes and move this document
along.

Paul

--001a11c36b4e366c930543a15e06-- From nobody Wed Dec 14 09:47:33 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF29A129EA5 for ; Wed, 14 Dec 2016 09:47:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fK3EDg0TpFgR for ; Wed, 14 Dec 2016 09:47:28 -0800 (PST) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0443C1299A4 for ; Wed, 14 Dec 2016 09:47:21 -0800 (PST) Received: (qmail 10492 invoked by uid 1004); 14 Dec 2016 17:47:19 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Wed, 14 Dec 2016 17:47:19 +0000 Received: (qmail 26532 invoked by uid 1000); 14 Dec 2016 17:47:19 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Wed, 14 Dec 2016 17:47:19 +0000 To: Trans References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> From: Rob Stradling Message-ID: <708dd6c1-e239-bf28-8c96-facf974bcaab@comodo.com> Date: Wed, 14 Dec 2016 17:47:18 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Bill Frantz , Melinda Shore , Eran Messeri , Andrew Ayer , Paul Wouters , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 17:47:31 -0000 To view the changes to the .txt format of the I-D: https://www.ietf.org/rfcdiff?url1=draft-ietf-trans-rfc6962-bis-19&url2=draft-ietf-trans-rfc6962-bis-22 To view the changes to the .md source file: https://github.com/google/certificate-transparency-rfcs/compare/a3a5a20595c75c2cf0ee5170b2a4d18c4a5fb420...17e7404be8c4727fbc9dc57c10ed55626833cdb9 (Click "Files changed", then "Load diff" for draft-ietf-trans-rfc6962-bis.md) On 14/12/16 17:06, Eran Messeri wrote: > > On Wed, Dec 14, 2016 at 3:49 PM, Paul Wouters > wrote: > > On Wed, 14 Dec 2016, Rob Stradling wrote: > > FYI, I've been revamping the 6962-bis registry sections in this PR: > https://github.com/google/certificate-transparency-rfcs/pull/216 > > > > I think we reached a point where it has become rather confusing to > see many small changes and pull requests on github. I think it would > be a good idea to put out a new draft version with these changes. > > Rob just did (thanks Rob!). > > > Then we can do a quick WGLC on the changes and move this document > along. > > Paul -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Wed Dec 14 09:55:06 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 979B61293DC for ; Wed, 14 Dec 2016 09:55:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LY3v7rIYIoee for ; Wed, 14 Dec 2016 09:55:02 -0800 (PST) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D737129EC4 for ; Wed, 14 Dec 2016 09:54:58 -0800 (PST) Received: (qmail 11049 invoked by uid 1004); 14 Dec 2016 17:54:56 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Wed, 14 Dec 2016 17:54:56 +0000 Received: (qmail 30302 invoked by uid 1000); 14 Dec 2016 17:54:56 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Wed, 14 Dec 2016 17:54:56 +0000 To: Trans References: <5e6de6cc-4d3a-d380-d923-8933f51d9a0d@cs.tcd.ie> <6bb9057e-82fa-99fc-943d-cdaecd5d1401@comodo.com> <708dd6c1-e239-bf28-8c96-facf974bcaab@comodo.com> From: Rob Stradling Message-ID: <7da87e48-a321-3b5b-c605-b88991cefef9@comodo.com> Date: Wed, 14 Dec 2016 17:54:55 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <708dd6c1-e239-bf28-8c96-facf974bcaab@comodo.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Bill Frantz , Melinda Shore , Eran Messeri , Andrew Ayer , Paul Wouters , Stephen Farrell Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 17:55:04 -0000 Specifically, that's the changes to the document since the (second) WGLC that took place in September. On 14/12/16 17:47, Rob Stradling wrote: > To view the changes to the .txt format of the I-D: > https://www.ietf.org/rfcdiff?url1=draft-ietf-trans-rfc6962-bis-19&url2=draft-ietf-trans-rfc6962-bis-22 > > > To view the changes to the .md source file: > https://github.com/google/certificate-transparency-rfcs/compare/a3a5a20595c75c2cf0ee5170b2a4d18c4a5fb420...17e7404be8c4727fbc9dc57c10ed55626833cdb9 > > (Click "Files changed", then "Load diff" for > draft-ietf-trans-rfc6962-bis.md) -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Mon Dec 19 14:25:26 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 56026129406; Mon, 19 Dec 2016 14:25:25 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148218632533.12834.6958067145090649659.idtracker@ietfa.amsl.com> Date: Mon, 19 Dec 2016 14:25:25 -0800 Archived-At: Cc: trans-chairs@ietf.org, trans@ietf.org, melinda.shore@nomountain.net, stephen.farrell@cs.tcd.ie Subject: [Trans] trans - New Meeting Session Request for IETF 98 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 22:25:25 -0000 A new meeting session request has just been submitted by Melinda Shore, a Chair of the trans working group. --------------------------------------------------------- Working Group Name: Public Notary Transparency Area Name: Security Area Session Requester: Melinda Shore Number of Sessions: 1 Length of Session(s): 1.5 Hours Number of Attendees: 40 Conflicts to Avoid: First Priority: mtgvenue dnsop ipsecme httpbis Second Priority: curdle tls Third Priority: sacm Special Requests: --------------------------------------------------------- From nobody Wed Dec 21 06:50:53 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 36D65127071; Wed, 21 Dec 2016 06:50:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148233184921.12609.12330458441806342284.idtracker@ietfa.amsl.com> Date: Wed, 21 Dec 2016 06:50:49 -0800 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-23.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 14:50:49 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Version 2.0 Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-23.txt Pages : 54 Date : 2016-12-21 Abstract: This document describes version 2.0 of the Certificate Transparency (CT) protocol for publicly logging the existence of Transport Layer Security (TLS) server certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-23 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-23 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 21 07:00:20 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 755151296C1 for ; Wed, 21 Dec 2016 07:00:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.1 X-Spam-Level: X-Spam-Status: No, score=-5.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DUnP7OUpZXRo for ; Wed, 21 Dec 2016 07:00:16 -0800 (PST) Received: from mail-wj0-x22f.google.com (mail-wj0-x22f.google.com [IPv6:2a00:1450:400c:c01::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C6BF1296C3 for ; Wed, 21 Dec 2016 07:00:16 -0800 (PST) Received: by mail-wj0-x22f.google.com with SMTP id tk12so205921941wjb.3 for ; Wed, 21 Dec 2016 07:00:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=UwDxu1xcjQVwjA1lYylTeOA9rmfw81Eci7rWzvcGNeM=; b=qYE0uW60Pt4QyavIMKMEhhMbWvRsiUajqnorVHYEOSqUWHS2kqCFP5qsNPDOTY9yxa ojq9WNiEoWrAgf/LFV4sADf+9f4HbBVpoG7VOpMCpZ/biBkevUlh3X0HQ6aHhrnqqNvI mOdd+RBbz5uQ2AeDzTzSE00GhgmcKU3M1jncLrZwhK2KVe7YyvI8oJ/0jTENuJ7zOp65 VWwnHFX02D1U+PinqyHWrxtyNQFqufySRVCKqeqxJGCDBfhrlzwDfW+KwIt4n9P/WNI3 f49rYFVMqx0TN6oaSgZV81rM5xX+YSDViWfDwAYW++kxGOM5qZbq803S6x/MPyBWZQz5 rPhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=UwDxu1xcjQVwjA1lYylTeOA9rmfw81Eci7rWzvcGNeM=; b=dWXif2qLYh8JLZ1Utymk5wNb64acOl/qLyYyQe1fon7eOjY0s6zQzUXN1hQAwoMy1K 1mQE2DjR1TM2E7lwv/pbVJrtZRkaqdrzslSz3SVuow3lg0063r+zoLJJvPX78q9GCtQ8 uuru0T4oTIo283D6DAFRZ/zdeqYmzTDhqkpqCFvDBJj30YtGDS4FKWOE8JKj24SqPw9F 605A6vu4lOs3QsTyCIyHpRIOn9CodLtslHuyHWqTfbGsn9723+ocuOvMYwB9E8GNCiEy jl1fkBQt7kTmXQIWs3StzALznntjqr+XbvRYHjrUvWXnmP6gmDisHHRxYfDq+DyK2h9X 21sQ== X-Gm-Message-State: AIkVDXK2rPBR9ZJGzESxEUrTSsoqUkAuKaHItYQdUwII30X/P6Dvr1Vipt/syYR2AfPlKwHUH8jDbA5NNGTMeFlY X-Received: by 10.194.205.73 with SMTP id le9mr4819101wjc.31.1482332414656; Wed, 21 Dec 2016 07:00:14 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Wed, 21 Dec 2016 06:59:44 -0800 (PST) In-Reply-To: <148233184921.12609.12330458441806342284.idtracker@ietfa.amsl.com> References: <148233184921.12609.12330458441806342284.idtracker@ietfa.amsl.com> From: Eran Messeri Date: Wed, 21 Dec 2016 14:59:44 +0000 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=001a11c36b4e041ace05442c694e Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-23.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 15:00:18 -0000 --001a11c36b4e041ace05442c694e Content-Type: text/plain; charset=UTF-8 The only change between draft 22 and draft 23 is the removal of the option to log a name-constrained intermediate certificate with an extension indicating it is logged instead of the end-entity certificate. This concludes the removal of all name redaction-related features in 6962-bis. This text will be moved to the redaction draft. As name redaction is a sensitive topic, I'd like to point out that at least one UA explicitly stated this particular feature will not be implemented (since the bigger discussion about name redaction concerns it) and that both Rob and I believe the redaction draft is a more suitable document for this feature. Eran On Wed, Dec 21, 2016 at 2:50 PM, wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Public Notary Transparency of the IETF. > > Title : Certificate Transparency Version 2.0 > Authors : Ben Laurie > Adam Langley > Emilia Kasper > Eran Messeri > Rob Stradling > Filename : draft-ietf-trans-rfc6962-bis-23.txt > Pages : 54 > Date : 2016-12-21 > > Abstract: > This document describes version 2.0 of the Certificate Transparency > (CT) protocol for publicly logging the existence of Transport Layer > Security (TLS) server certificates as they are issued or observed, in > a manner that allows anyone to audit certification authority (CA) > activity and notice the issuance of suspect certificates as well as > to audit the certificate logs themselves. The intent is that > eventually clients would refuse to honor certificates that do not > appear in a log, effectively forcing CAs to add all issued > certificates to the logs. > > Logs are network services that implement the protocol operations for > submissions and queries that are defined in this document. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-23 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-23 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --001a11c36b4e041ace05442c694e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The only change between draft 22 and draft 23 is the remov= al of the option to log a name-constrained intermediate certificate with an= extension indicating it is logged instead of the end-entity certificate.
This concludes the removal of all name redaction-related = features in 6962-bis. This text will be moved to the redaction draft.
=

As name redaction is a sensitive topic, I'd like to= point out that at least one UA explicitly stated this particular feature w= ill not be implemented (since the bigger discussion about name redaction co= ncerns it) and that both Rob and I believe the redaction draft is a more su= itable document for this feature.

Eran
=

On Wed, Dec 21, 2= 016 at 2:50 PM, <internet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Public Notary Transparency=C2=A0 of the IE= TF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Certificate Transparency Version 2.0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Ben = Laurie
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Adam Langley
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Emilia Kasper
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Eran Messeri
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Rob Stradling
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-trans-rfc6962-bis-23.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 54
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2016-12-21

Abstract:
=C2=A0 =C2=A0This document describes version 2.0 of the Certificate Transpa= rency
=C2=A0 =C2=A0(CT) protocol for publicly logging the existence of Transport = Layer
=C2=A0 =C2=A0Security (TLS) server certificates as they are issued or obser= ved, in
=C2=A0 =C2=A0a manner that allows anyone to audit certification authority (= CA)
=C2=A0 =C2=A0activity and notice the issuance of suspect certificates as we= ll as
=C2=A0 =C2=A0to audit the certificate logs themselves.=C2=A0 The intent is = that
=C2=A0 =C2=A0eventually clients would refuse to honor certificates that do = not
=C2=A0 =C2=A0appear in a log, effectively forcing CAs to add all issued
=C2=A0 =C2=A0certificates to the logs.

=C2=A0 =C2=A0Logs are network services that implement the protocol operatio= ns for
=C2=A0 =C2=A0submissions and queries that are defined in this document.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/= draft-ietf-trans-rfc6962-bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ie= tf-trans-rfc6962-bis-23

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-trans-rfc6962-bis-23


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

--001a11c36b4e041ace05442c694e-- From nobody Wed Dec 21 11:28:27 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDFB5129952 for ; Wed, 21 Dec 2016 11:28:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.1 X-Spam-Level: X-Spam-Status: No, score=-5.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-3.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MNPu7ZkVhoDQ for ; Wed, 21 Dec 2016 11:28:16 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C542412957A for ; Wed, 21 Dec 2016 11:28:15 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3tkPnm62CjzG1V for ; Wed, 21 Dec 2016 20:28:12 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1482348492; bh=4iH1+xA4lrTrWpHCSMmkYuy1CE9B5RyZuMOUDsI5u2E=; h=Date:From:To:Subject; b=S9o9FS+inNw1Ff4VE1uiUQ9ANb9nOo4+gC4gPdUxi1yJnOaYxj7I4s7TkaqrOsenR JPU+tqafbcFtugRwvKHQGgRVkHcBFFbe7wbxz+AyJXy6zuPajaAO+8FeWdfpU+fwgq OHFBrNr9VgRsmnBrrCtRiIRazZ8Ug8oTrRONTdXk= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id b0ULiWX6dxKf for ; Wed, 21 Dec 2016 20:28:09 +0100 (CET) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS for ; Wed, 21 Dec 2016 20:28:09 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 7B20191B; Wed, 21 Dec 2016 14:28:07 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca 7B20191B Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 7682842691E8 for ; Wed, 21 Dec 2016 14:28:07 -0500 (EST) Date: Wed, 21 Dec 2016 14:28:07 -0500 (EST) From: Paul Wouters To: Trans Message-ID: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: [Trans] restarting WGLC for 6962-bis (draft-ietf-trans-rfc6962-bis-23) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 19:28:19 -0000 Since the last (second) WGLC of the 6962bis document, a number of changes were made that although relatively contained, caused a non-trivial amount of change in the document. It mostly relates to the IANA registries and a further removal of text related to redaction that is moving into a separate document. We still thought it best to restart a WGLC for this. Draft location: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-23 Diff from previous WGLC version: https://www.ietf.org/rfcdiff?url1=draft-ietf-trans-rfc6962-bis-19&url2=draft-ietf-trans-rfc6962-bis-23 This starts a new WGLC for draft-ietf-trans-rfc6962-bis-23 for three weeks. The WGLC closes on January 11, 2017. Please send feedback to the list, even (especially) if you sent feedback on the previous WGLC. Paul & Melinda From nobody Wed Dec 28 15:44:34 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDD7512941D for ; Wed, 28 Dec 2016 15:44:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ritter.vg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x_lk3lrBNpLG for ; Wed, 28 Dec 2016 15:44:30 -0800 (PST) Received: from mail-ua0-x233.google.com (mail-ua0-x233.google.com [IPv6:2607:f8b0:400c:c08::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6EC9129530 for ; Wed, 28 Dec 2016 15:44:29 -0800 (PST) Received: by mail-ua0-x233.google.com with SMTP id 34so179368174uac.1 for ; Wed, 28 Dec 2016 15:44:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=e25+hs3ivM2PKiE4nx+GgYc/rRtrXl5DKdWhF0JAMHU=; b=R1hQnHK2VO9BeHdGuilSdM9YNuIhXLR796gXpe5z4RJ0ZqBVannMkEpcIW1H3yZh5p vXtIJRr8PSSQHsMExiUg8Gc4Vn3SzBUb9QiiOo5DKZQo0BDTg4vlWqltpAP+kDbFu1VX HxFTFxqJo7+CzqWi0ueSAw1AUzdHTuPhemO5k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=e25+hs3ivM2PKiE4nx+GgYc/rRtrXl5DKdWhF0JAMHU=; b=d7W2s/PaFd87+bZGjw46npyva7A4/DWD1nrsZOOBM8HwzqfdnBm3yxxBfkiQAx83CK dFZtozW/dhY8m6ufGr3y7Pu8cORDJx+9UU1YNBm8V0taIkoD6yPV7RiilqkKs+2NfYJt Nnp5LyBbbs/q1bIiPP0J40fojP2G4RHkdqFMglYKCODLLe1x6mL/VmpHnyP5iiIPhD7O qhzr0OOH52I8WMmsH2+9gqUOZtkBJQZi/RBuLpFoYBO6Yr0J6WqdEkRkykNFbfiksA7i CJK0pOGpX9YPB0jRN0XNryXZaT9LSu7WvRnFhl7XjtHbhYlBs6Gr+Y5ovj0KEuA0CGVD d7Kw== X-Gm-Message-State: AIkVDXKKrdM2pENMuSgP9jiz8WuY8ZqCV2NUOC4O47OxQBgLw/nN0v+yqnwbs+bEkX8Q+8Zh7mBOIdro5HdF3nJK X-Received: by 10.176.17.18 with SMTP id e18mr30335402uab.19.1482968668968; Wed, 28 Dec 2016 15:44:28 -0800 (PST) MIME-Version: 1.0 Received: by 10.103.142.195 with HTTP; Wed, 28 Dec 2016 15:44:08 -0800 (PST) In-Reply-To: References: From: Tom Ritter Date: Wed, 28 Dec 2016 17:44:08 -0600 Message-ID: To: Paul Wouters Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Trans Subject: Re: [Trans] restarting WGLC for 6962-bis (draft-ietf-trans-rfc6962-bis-23) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Dec 2016 23:44:32 -0000 On 21 December 2016 at 13:28, Paul Wouters wrote: > > > Since the last (second) WGLC of the 6962bis document, a number of > changes were made that although relatively contained, caused a > non-trivial amount of change in the document. It mostly relates > to the IANA registries and a further removal of text related to > redaction that is moving into a separate document. We still thought > it best to restart a WGLC for this. > ... > Please send feedback to the list, even (especially) if you sent feedback > on the previous WGLC. -bis defines "Monitors watch logs to check that they behave correctly, for certificates of interest, or both." In my mind, I I thought in many others minds, this definition is split: A 'Monitor' which provides user notification of certificates of interest. An 'Auditor' does log consistency checking. Monitors are therefore public-facing (for some definition of public, it might be paid subscribers for example), while auditors are not necessarily so. In the Gossip draft, one can run an auditor that exposes a public interface for submissions, or one can run a fully private auditor that polls servers to collect data. If others agree with me, I can provide text suggestions splitting the two definitions again. -tom From nobody Thu Dec 29 02:19:35 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DE40129545 for ; Thu, 29 Dec 2016 02:19:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fY3o-HFLrtVU for ; Thu, 29 Dec 2016 02:19:31 -0800 (PST) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1812C1293F4 for ; Thu, 29 Dec 2016 02:19:30 -0800 (PST) Received: (qmail 19958 invoked by uid 1004); 29 Dec 2016 10:19:28 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Thu, 29 Dec 2016 10:19:28 +0000 Received: (qmail 19943 invoked by uid 1000); 29 Dec 2016 10:19:28 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Thu, 29 Dec 2016 10:19:28 +0000 To: Tom Ritter , Paul Wouters References: From: Rob Stradling Message-ID: Date: Thu, 29 Dec 2016 10:19:27 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Trans Subject: Re: [Trans] restarting WGLC for 6962-bis (draft-ietf-trans-rfc6962-bis-23) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 10:19:34 -0000 On 28/12/16 23:44, Tom Ritter wrote: > On 21 December 2016 at 13:28, Paul Wouters wrote: >> >> >> Since the last (second) WGLC of the 6962bis document, a number of >> changes were made that although relatively contained, caused a >> non-trivial amount of change in the document. It mostly relates >> to the IANA registries and a further removal of text related to >> redaction that is moving into a separate document. We still thought >> it best to restart a WGLC for this. >> ... >> Please send feedback to the list, even (especially) if you sent feedback >> on the previous WGLC. > > > -bis defines "Monitors watch logs to check that they behave correctly, > for certificates of interest, or both." > > In my mind, I I thought in many others minds, this definition is split: > A 'Monitor' which provides user notification of certificates of interest. > An 'Auditor' does log consistency checking. > > Monitors are therefore public-facing (for some definition of public, > it might be paid subscribers for example), while auditors are not > necessarily so. In the Gossip draft, one can run an auditor that > exposes a public interface for submissions, or one can run a fully > private auditor that polls servers to collect data. > > If others agree with me, I can provide text suggestions splitting the > two definitions again. Digging up some old tickets that seem relevant... https://trac.ietf.org/trac/trans/ticket/65 https://trac.ietf.org/trac/trans/ticket/118 -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Thu Dec 29 03:13:14 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 843B81293EB for ; Thu, 29 Dec 2016 03:13:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nFS_KYBu_kNh for ; Thu, 29 Dec 2016 03:13:12 -0800 (PST) Received: from mmextmx1.mcr.colo.comodoca.net (mmextmx1.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6DA7127A90 for ; Thu, 29 Dec 2016 03:13:11 -0800 (PST) Received: (qmail 1684 invoked by uid 1004); 29 Dec 2016 11:13:08 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx1.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Thu, 29 Dec 2016 11:13:08 +0000 Received: (qmail 13597 invoked by uid 1000); 29 Dec 2016 11:13:08 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Thu, 29 Dec 2016 11:13:08 +0000 To: Eran Messeri References: From: Rob Stradling Message-ID: <903fc1f0-2740-8171-5ca0-81c35412271e@comodo.com> Date: Thu, 29 Dec 2016 11:13:08 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Paul Wouters , Trans Subject: Re: [Trans] restarting WGLC for 6962-bis (draft-ietf-trans-rfc6962-bis-23) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 11:13:13 -0000 Eran, I don't know what happened to your toolchain when you generated -23, but I just noticed that the names of the authors at the top of the document have disappeared. This didn't happen when you generated -21 last month. I can't reproduce this problem locally. On 21/12/16 19:28, Paul Wouters wrote: > > > Since the last (second) WGLC of the 6962bis document, a number of > changes were made that although relatively contained, caused a > non-trivial amount of change in the document. It mostly relates > to the IANA registries and a further removal of text related to > redaction that is moving into a separate document. We still thought > it best to restart a WGLC for this. > > Draft location: > > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-23 > > Diff from previous WGLC version: > > > https://www.ietf.org/rfcdiff?url1=draft-ietf-trans-rfc6962-bis-19&url2=draft-ietf-trans-rfc6962-bis-23 > > > This starts a new WGLC for draft-ietf-trans-rfc6962-bis-23 for three > weeks. The WGLC closes on January 11, 2017. > > Please send feedback to the list, even (especially) if you sent feedback > on the previous WGLC. > > Paul & Melinda > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Thu Dec 29 03:33:23 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A931D1294B4 for ; Thu, 29 Dec 2016 03:33:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.54 X-Spam-Level: X-Spam-Status: No, score=-5.54 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBh66pcfHMpI for ; Thu, 29 Dec 2016 03:33:20 -0800 (PST) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B9F31294AA for ; Thu, 29 Dec 2016 03:33:20 -0800 (PST) Received: by mail-wm0-x230.google.com with SMTP id u144so80222593wmu.1 for ; Thu, 29 Dec 2016 03:33:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5BM8e3SPQdb/5w7ffaNxjuxz22w83Wq9dguwfMgaEDc=; b=Rltm3g+tcq2dfltAubUDeCkZo8NSnO0xYf17omu+xNHFYza7e+I5iUA8fkxXmYi64n jq490vPVwbRvJkLs2Hc5itGE2d9584sxv7FXj3II50JeY0xVmyjdK+b7X6yCFYW8th27 paQgQNChnyzj1dNryVlu9KoMxcL2BTy0VwdPNvCt0b3pZ2hmyJX+41cowzpGg8BeqbCK ogEwtl5zkMPKkT0QJRKRCdUa+G7zHaOC3y6RpYhw70f+V3Ezyri2qDTuqFQlX1TigItq bX8fl6VuHHl3alEwe4XsKzzvf2agR07fq6qrHNuzj+4JvbKk5EndE9xzN8dPTaSTtQUm M/lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5BM8e3SPQdb/5w7ffaNxjuxz22w83Wq9dguwfMgaEDc=; b=EN8vwBvRl6+kgmnT+B5a7cYYMWn2rFbMFZzfHUA9NVpuLuwbrmE85HgvzciArnu4J2 Qn1FYc+LfPhxIJBvWKHDQ5n9RsiGx6Css5y2v6TeWlP17D+lNzRI12mY3bpYpn+SSyLf NoN/DDzaiA6u9yBQEJ9BuwTFvCfbrfww5PqUjMNt8AitR/0pAGiWWwmPGNA+kabt00Ur 47msV9bguStLEp6B8r01czzDBuQGgKpUSM9JnZFZPNDG5L9Jn5aWJX7nWaZ+TtjUap7t YVbvEDb07FLMSbFNvS9m7dKFuY11iN2hgyLDKcZaJf6yxs65kTX5OsFvROrpbRh/1IEo MSOA== X-Gm-Message-State: AIkVDXJa8sVB7tJeFF7EyoeWUbJfznAJ6mVVIqxmSvaQVxduKlttCP1KYAKpSs5TsfGbj+zKzKCrduVHnS39DkhP X-Received: by 10.28.13.144 with SMTP id 138mr36310553wmn.120.1483011198637; Thu, 29 Dec 2016 03:33:18 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.31.21 with HTTP; Thu, 29 Dec 2016 03:32:48 -0800 (PST) In-Reply-To: <903fc1f0-2740-8171-5ca0-81c35412271e@comodo.com> References: <903fc1f0-2740-8171-5ca0-81c35412271e@comodo.com> From: Eran Messeri Date: Thu, 29 Dec 2016 11:32:48 +0000 Message-ID: To: Rob Stradling Content-Type: multipart/alternative; boundary=001a11443616b1b71f0544ca734f Archived-At: Cc: Paul Wouters , Trans Subject: Re: [Trans] restarting WGLC for 6962-bis (draft-ietf-trans-rfc6962-bis-23) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 11:33:21 -0000 --001a11443616b1b71f0544ca734f Content-Type: text/plain; charset=UTF-8 Seems like RFC generation on my Mac is broken. I've re-generated it on my desktop, uploading a new draft now. On Thu, Dec 29, 2016 at 11:13 AM, Rob Stradling wrote: > Eran, I don't know what happened to your toolchain when you generated -23, > but I just noticed that the names of the authors at the top of the document > have disappeared. This didn't happen when you generated -21 last month. I > can't reproduce this problem locally. > > > On 21/12/16 19:28, Paul Wouters wrote: > >> >> >> Since the last (second) WGLC of the 6962bis document, a number of >> changes were made that although relatively contained, caused a >> non-trivial amount of change in the document. It mostly relates >> to the IANA registries and a further removal of text related to >> redaction that is moving into a separate document. We still thought >> it best to restart a WGLC for this. >> >> Draft location: >> >> https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-23 >> >> Diff from previous WGLC version: >> >> >> https://www.ietf.org/rfcdiff?url1=draft-ietf-trans-rfc6962-b >> is-19&url2=draft-ietf-trans-rfc6962-bis-23 >> >> >> This starts a new WGLC for draft-ietf-trans-rfc6962-bis-23 for three >> weeks. The WGLC closes on January 11, 2017. >> >> Please send feedback to the list, even (especially) if you sent feedback >> on the previous WGLC. >> >> Paul & Melinda >> >> _______________________________________________ >> Trans mailing list >> Trans@ietf.org >> https://www.ietf.org/mailman/listinfo/trans >> >> > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > --001a11443616b1b71f0544ca734f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Seems like RFC generation on my Mac is broken. I've re= -generated it on my desktop, uploading a new draft now.

On Thu, Dec 29, 2016 at 11:13 A= M, Rob Stradling <rob.stradling@comodo.com> wrote:
Eran, I don't know what happened to you= r toolchain when you generated -23, but I just noticed that the names of th= e authors at the top of the document have disappeared.=C2=A0 This didn'= t happen when you generated -21 last month.=C2=A0 I can't reproduce thi= s problem locally.


On 21/12/16 19:28, Paul Wouters wrote:


Since the last (second) WGLC of the 6962bis document, a number of
changes were made that although relatively contained, caused a
non-trivial amount of change in the document. It mostly relates
to the IANA registries and a further removal of text related to
redaction that is moving into a separate document. We still thought
it best to restart a WGLC for this.

Draft location:

=C2=A0 =C2=A0 https://tools.ietf.org/html= /draft-ietf-trans-rfc6962-bis-23

Diff from previous WGLC version:


https://www.ietf.org/rfcdiff?url1=3Ddraft-ietf-trans-rfc69= 62-bis-19&url2=3Ddraft-ietf-trans-rfc6962-bis-23


This starts a new WGLC for draft-ietf-trans-rfc6962-bis-23 for three weeks. The WGLC closes on January 11, 2017.

Please send feedback to the list, even (especially) if you sent feedback on the previous WGLC.

Paul & Melinda

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans


--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

--001a11443616b1b71f0544ca734f-- From nobody Thu Dec 29 03:36:39 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 196EA1294B4; Thu, 29 Dec 2016 03:36:34 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148301139409.30173.5560225718690864029.idtracker@ietfa.amsl.com> Date: Thu, 29 Dec 2016 03:36:34 -0800 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-24.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 11:36:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Version 2.0 Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-24.txt Pages : 54 Date : 2016-12-29 Abstract: This document describes version 2.0 of the Certificate Transparency (CT) protocol for publicly logging the existence of Transport Layer Security (TLS) server certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-24 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-24 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/