Subject: Re: [Trans] [trans] #82 (rfc6962-bis): add integrity validation to get-entries (and fetching SCTs?)

From: "trans issue tracker" <[email-masked]>
Date: Mon, 18 May 2015 14:28:22 -0000

#82: add integrity validation to get-entries (and fetching SCTs?)

Comment (by [email-masked]):

 Note that the SCTs do not cover the extra_data hence this addition will
 not provide integrity for the extra_data field (but accessing logs over
 HTTPS, which the RFC mandates they support, would).

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-trans-
  [email-masked]     |  [email-masked]
     Type:  enhancement  |      Status:  new
 Priority:  major        |   Milestone:
Component:  rfc6962-bis  |     Version:
 Severity:  -            |  Resolution:
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/82#comment:3>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Mon, 18 May 2015 14:33:22 -0000

#82: Add a way to get the SCTs for entries returned by get-entries

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/82#comment:4>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Mon, 18 May 2015 14:37:51 -0000

Out for review in https://github.com/google/certificate-transparency-
 rfcs/pull/42

 I've changed the ticket to reflect that what's needed is a way to get back
 SCTs, not integrity validation to get-entries:
 * Integrity can be provided by accessing the log over HTTPS (assuming the
 TLS client checks the log's certificate chain correctly).
 * the extra_data field is not currently covered by any signature so it'd
 be impossible to distinguish between transit and storage corruptions.
 * Providing the SCTs is enough to allow log mirroring.

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/82#comment:5>
trans <http://tools.ietf.org/trans/>