Subject: [Trans] Walking through the issue tracker: Ticket #8

From: Melinda Shore <[email-masked]>
Date: Thu, 03 Jul 2014 11:57:27 -0800

This ticket asks about a mechanism for looking up Merkle proofs for a
batch of certificates around the SCT timestamp.

It looks as if there's an agreement to provide a DNS-based mechanism.
It may be worth pointing out that it's occasionally difficult to get
agreement to move data into the DNS and that we'll need to be prepared
to answer questions about that in order to get the document through the
process.  So, if you're not familiar with RFC 6950 ("Architectural
Considerations on Application Features in the DNS") it may be worth
giving it a read.

Should this ticket be closed?

Melinda

---

From: Eran Messeri <[email-masked]>
Date: Fri, 4 Jul 2014 10:26:22 +0100

IIUC the decision was to allow both - as you pointed out it may be
difficult to move data into the DNS, so logs would offer an API to get a
range of proofs as a fallback mechanism.
So it seems like ticket 8 should remain open - I've assigned it to myself
to add this method to the API.

On Thu, Jul 3, 2014 at 8:57 PM, Melinda Shore <[email-masked]>
wrote:

> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

---

From: Ben Laurie <[email-masked]>
Date: Fri, 4 Jul 2014 12:22:48 +0100

On 4 July 2014 10:26, Eran Messeri <[email-masked]> wrote:
> IIUC the decision was to allow both - as you pointed out it may be difficult
> to move data into the DNS, so logs would offer an API to get a range of
> proofs as a fallback mechanism.
> So it seems like ticket 8 should remain open - I've assigned it to myself to
> add this method to the API.

Much as the DNS folk hate it, CT's needs for DNS work fine with TXT
records (we have an implementation in the open source code, in fact).
That said, I believe the application of DNS to this particular problem
is within the guidelines in RFC 6950.