Subject: Re: [Trans] Tracking implementations

From: Fabrice Gautier <[email-masked]>
Date: Mon, 4 Aug 2014 10:55:14 -0700

On Thu, Jul 31, 2014 at 6:36 AM, Ben Laurie <[email-masked]> wrote:
> On 30 July 2014 17:13, Melinda Shore <[email-masked]> wrote:
>> During the session last week I was a bit surprised by the number of
>> people saying that they were doing implementations, and I think it
>> might be useful to get a better handle on that.  If nothing else, it
>> helps quite a bit during the publication process if it's known
>> that there are interoperable implementations and that we know a little
>> bit about them.
>>
>> So, I'd be grateful if people who've are working on implementations
>> and who can discuss them publicly could speak up, let us know the
>> status and whether or not you'll be releasing source, and provide a
>> pointer to a repo or other documentation if you're able.  Also let
>> me know whether or not you'd be willing to have your implementation
>> mentioned on a wiki page listing implementations.
>
> Obviously(?) Google has an open source implementation here:
> https://github.com/google/certificate-transparency.

My understanding is that this is only an implementation of a CT log,
am I correct ?

> We also have two internal production implementations, both of which
> share as much code as is feasible with the open source. No current
> plan to release source that is not already released.
>
> Feel free to mention them on a wiki page.
>
>>
>> Thanks again,
>>
>> Melinda
>>
>> _______________________________________________
>> Trans mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/trans
>
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans

---

From: Eran Messeri <[email-masked]>
Date: Tue, 5 Aug 2014 10:56:19 +0100

No, there are also monitor implementations in C++ and (partially) python,
log clients in C++, python and Java, as well as a TLS client in C++.

There's also plenty of test data for rfc6962 implementations.

While we're at it, there's another implementation in Chromium of SCT
deserialization and validation, using NSS (vs. OpenSSL used in the
open-source repository).

---

From: Rob Stradling <[email-masked]>
Date: Tue, 05 Aug 2014 11:28:30 +0100

On 05/08/14 10:56, Eran Messeri wrote:
> No, there are also monitor implementations in C++ and (partially)
> python, log clients in C++, python and Java, as well as a TLS client in C++.
>

Talking of SCTs and OpenSSL...

The OpenSSL_1_0_2-stable branch already has code to parse and view 
RFC6962 SCT Lists embedded in certificates and OCSP responses.  Right 
now I'm frantically coding extra functionality, such as SCT signature 
validation, in the hope of getting this into the initial 1.0.2 release.

Thanks for the "OpenSSL used in the open-source repository" tip, Eran. 
I'll check this out right now.  It may save me some time.  :-)

> On 4 Aug 2014 18:55, "Fabrice Gautier" <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     On Thu, Jul 31, 2014 at 6:36 AM, Ben Laurie <[email-masked]
>     <mailto:[email-masked]>> wrote:
>      > On 30 July 2014 17:13, Melinda Shore <[email-masked]
>     <mailto:[email-masked]>> wrote:
>      >> [email-masked] <mailto:[email-masked]>
>      > [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are 
addressed.  If you have received this email in error please notify the 
sender by replying to the e-mail containing this attachment. Replies to 
this email may be monitored by COMODO for operational or business 
reasons. Whilst every endeavour is taken to ensure that e-mails are free 
from viruses, no liability can be accepted and the recipient is 
requested to use their own virus checking software.

---

From: Leif Johansson <[email-masked]>
Date: Wed, 06 Aug 2014 18:16:00 +0200

> My understanding is that this is only an implementation of a CT log,

This is the other one - no shared code with the google impl:
https://devp.ct.nordu.net/. Linus is the lead for this one.