Subject: [Trans] [trans] #60 (rfc6962-bis): The number of redacted labels should be revealed in the Precertificate

From: "trans issue tracker" <[email-masked]>
Date: Tue, 17 Feb 2015 14:56:06 -0000

#60: The number of redacted labels should be revealed in the Precertificate

 The current -bis draft says:
   'When creating a Precertificate, the CA MAY substitute one or more of
    the complete leftmost labels in each DNS-ID with the literal string
    "(PRIVATE)".'

 In a recent thread on the list there was clear support for the idea of
 requiring a separate token for each redacted label, instead of permitting
 one token to cover several redacted labels.

 Also, it would be nice to use a token that is shorter than "(PRIVATE)".
 Steve Kent has asked that we consult some DNS experts before we make a
 final decision on what the token will be.  I'll kick off some discussion
 on that and report back to this ticket.  For now, my proposal is "?".

 Quick comparison of how to redact 2 labels from "a.b.example.com":
   Current -bis draft: (PRIVATE).example.com
   This proposal: ?.?.example.com

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-trans-
  [email-masked]           |  [email-masked]
     Type:  enhancement              |     Status:  new
 Priority:  major                    |  Milestone:
Component:  rfc6962-bis              |    Version:
 Severity:  -                        |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 17 Feb 2015 14:57:05 -0000

Changes (by [email-masked]):

 * owner:  [email-masked] =>
     [email-masked]

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:
  [email-masked]           |  [email-masked]
     Type:  enhancement              |      Status:  new
 Priority:  major                    |   Milestone:
Component:  rfc6962-bis              |     Version:
 Severity:  -                        |  Resolution:
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60#comment:1>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 17 Feb 2015 14:57:58 -0000

* type:  enhancement => defect

     Type:  defect                   |      Status:  new

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60#comment:2>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 17 Feb 2015 15:11:13 -0000

* status:  new => assigned

     Type:  defect                   |      Status:  assigned

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60#comment:3>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 17 Feb 2015 16:04:03 -0000

Changes (by [email-masked]):

 * cc: [email-masked] (added)

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60#comment:4>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Wed, 18 Feb 2015 16:50:43 -0000

Comment (by [email-masked]):

 Committed as...
 https://github.com/google/certificate-transparency-
 rfcs/commit/82ee686fa39a4fc10b6bca05aca0aa3d6ca5afd3

 Leaving this ticket open whilst we consult some DNS experts on "?".

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/60#comment:5>
trans <http://tools.ietf.org/trans/>