Subject: Re: [Trans] Tracking implementations

From: Rob Stradling <[email-masked]>
Date: Wed, 03 Jun 2015 15:26:57 +0100

https://crt.sh

Pronounced "search".  :-)

It's a web interface that lets you search for certs that have been 
logged by the publicly known RFC6962 logs.

Right now it's half a Monitor.  It fetches all new entries soon after 
they're added to the logs, but it doesn't (yet) verify STH signatures.

No current plans to release source code.

Feel free to mention this on the wiki page.

On 30/07/14 22:13, Melinda Shore wrote:
> During the session last week I was a bit surprised by the number of
> people saying that they were doing implementations, and I think it
> might be useful to get a better handle on that.  If nothing else, it
> helps quite a bit during the publication process if it's known
> that there are interoperable implementations and that we know a little
> bit about them.
>
> So, I'd be grateful if people who've are working on implementations
> and who can discuss them publicly could speak up, let us know the
> status and whether or not you'll be releasing source, and provide a
> pointer to a repo or other documentation if you're able.  Also let
> me know whether or not you'd be willing to have your implementation
> mentioned on a wiki page listing implementations.
>
> Thanks again,
>
> Melinda

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Paul Wouters <[email-masked]>
Date: Wed, 3 Jun 2015 12:50:08 -0400 (EDT)

On Wed, 3 Jun 2015, Rob Stradling wrote:

> https://crt.sh
>
> Pronounced "search".  :-)
>
> It's a web interface that lets you search for certs that have been logged by 
> the publicly known RFC6962 logs.

Very cool!

Paul

---

From: Tim Wicinski <[email-masked]>
Date: Wed, 03 Jun 2015 10:40:31 -0700

Thanks Rob.  The security folks at my employer already found a domain 
that was set up by some marketing folks that has a less than optimal 
cert, and the domain appears to be in someone's personal account, and 
they are no longer with the company.  Of course the domain is active.

sigh

tim

---

From: Melinda Shore <[email-masked]>
Date: Wed, 03 Jun 2015 09:58:45 -0800

Excellent - thanks!  I've updated the wiki:
http://trac.tools.ietf.org/wg/trans/trac/wiki

If there are other implementations underway,
please let us know.

Melinda

---

From: Rob Stradling <[email-masked]>
Date: Wed, 03 Jun 2015 19:54:59 +0100

>> logged by the publicly known RFC6962 logs.

Thanks Paul.  :-)

---

From: Rob Stradling <[email-masked]>
Date: Wed, 03 Jun 2015 19:57:05 +0100

Thanks Tim.  :-)

On 03/06/15 18:40, Tim Wicinski wrote:
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are 
addressed.  If you have received this email in error please notify the 
sender by replying to the e-mail containing this attachment. Replies to 
this email may be monitored by COMODO for operational or business 
reasons. Whilst every endeavour is taken to ensure that e-mails are free 
from viruses, no liability can be accepted and the recipient is 
requested to use their own virus checking software.

---

From: Rob Stradling <[email-masked]>
Date: Wed, 03 Jun 2015 20:10:25 +0100

> http://trac.tools.ietf.org/wg/trans/trac/wiki

Thanks.

> If there are other implementations underway,

Chromium/Chrome really should get a mention, I think.

OpenSSL-1.0.2 can pretty-print RFC6962 SCTs embedded in certs and OCSP 
responses.  Incidentally, this is used by crt.sh (e.g. [1]) although 
I've adapted it slightly to also show the log name.

There's also work in progress (well, it's on hold for now until 6962-bis 
is a bit more settled) to add a full API for handling SCTs to OpenSSL-next.

[1] https://crt.sh/?id=7842948
    Search for "Signed Certificate Timestamp"

---

From: Matt Palmer <[email-masked]>
Date: Mon, 29 Jun 2015 10:16:05 +1000

> If there are other implementations underway,

I've recently released an open-source (GPLv3) RFC6962-compliant log
monitoring framework, for retrieving and validating STHs, entries, etc:

    https://github.com/tobermorytech/certificate-transparency-monitor

I've also released several supporting Ruby gems:

* merkle-hash-tree -- build and verify merkle hash trees;
* certificate-transparency -- RFC6962 data structures;
* certificate-transparency-client -- interact with an RFC6962 log over HTTP.

I'd add all of these to the wiki page, except that I can't seem to get a
Trac login (I'm following up that with webmaster@tools).

- Matt

---

From: Melinda Shore <[email-masked]>
Date: Sun, 28 Jun 2015 17:08:39 -0800

Great, Matt - thanks.  Sorry about the Trac problem -
small consolation but this does happen unfortunately
often.

Melinda