Subject: [Trans] architecture document

From: Stephen Kent <[email-masked]>
Date: Fri, 2 Oct 2015 14:11:20 -0400

We have an initial draft of the CT architecture document, as discussed 
at the meeting
in Prague. It will be posted later today.

The intro for this doc was extracted from the threat/attack model, as 
discussed
in Prague.

There are diagrams that try to capture the interactions between the log 
and the
various system elements, and between the (non-log) elements.

For the log, the doc describes its role and points to 6962-bis as the 
definitive
characterization of its operation.

For the other elements (Monitor, Auditor, CA, Subject, and browser) the 
doc includes
proposed requirements for each. I'd prefer to move these to separate 
docs, one
per element, and keep only a top level description for each, analogous 
to the
way that the log is treated here. To that end, Karen and David, who have 
worked
with me on this doc, are volunteering to prepare separate docs for the 
other elements,
using the text in this doc as a starting point.

We extracted the algs for some log-based checks from 6962-bis, and made 
them normative
appendices in this doc. The authors of 6962-bit are acknowledged as the 
source of
these algs. David added a normative appendix to describe how a browser
matches an SCT to a cert, when the SCT is not embedded in the cert.

More text is needed to better define browser behavior wrt processing 
SCTs, but that
can be added in the next rev, when we have separate docs, as noted above.

Steve