[cabfpub] Updated Certificate Transparency + Extended Validation plan
Rob Stradling
rob.stradling at comodo.com
Wed Feb 5 17:26:29 UTC 2014
On 05/02/14 15:39, Adam Langley wrote:
> On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling <rob.stradling at comodo.com> wrote:
>> Also, what happened to the idea of only requiring 1 SCT for a 1-month cert?
>
> I'm to blame for that.
>
> Certificates with a single SCT put a lower bound on how quickly we can
> distrust a log (at least without special measures, such as shipping
> the whole, public log hashes to all the clients, which is probably
> impractical.)
Sure.
How quickly do you want to be able to distrust a log (without needing to
resort to using probably impractical special measures)?
Presumably it's somewhere between 10 and 31 days, since 1 SCT is
acceptable for Stapled OCSP and the BRs permit OCSP Responses to be
valid for up to 10 days.
> Since I'm not aware of any CAs issuing one month certs,
Maybe not today, but...
> and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that
> should be dropped.
Do you still think [1] is a good plan?
I think we should design CT with the assumption that [1] might happen in
the future. Just looking at what CAs are issuing today seems
short-sighted IMHO.
How about requiring only 1 SCT for certs with durations <= the maximum
validity period for an OCSP Response?
[1] https://www.imperialviolet.org/2011/03/18/revocation.html
"A much better solution would be for certificates to only be valid for a
few days and to forget about revocation altogether. This doesn't mean
that the private key needs to change every few days, just the
certificate. And the certificate is public data, so servers could just
download their refreshed certificate over HTTP periodically and
automatically (like OCSP stapling). Clients wouldn't have to perform
revocation checks (which are very complex and slow), CAs wouldn't have
to pay for massive, DDoS proof serving capacity and revocation would
actually work. If the CA went down for six hours, nobody cares. Only if
the CA is down for days is there a problem. If you want to “revoke” a
certificate, just stop renewing it."
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
More information about the Public
mailing list