Subject: Re: [Trans] Certificate Transparency Newsletter - August 2015

From: Rob Stradling <[email-masked]>
Date: Mon, 19 Oct 2015 12:31:30 +0100

On 17/08/15 18:24, 'Adam Eijdenberg' via certificate-transparency wrote:
> (posted to [email-masked], [email-masked]
> and [email-masked])
<snip>
> Lookahead:
> - We're very interested in exploring how we make it viable for a
>    site-owner to be able to opt-in to requiring CT, ahead of any general
>    browser-enforced deadlines.  We would welcome participation in helping
>    define what this might look like in a manner that would work well for
>    both browsers and site-owners.

Adam,

RFC 7633: "X.509v3 Transport Layer Security (TLS) Feature Extension"

This newly standardized certificate extension could be used to signal 
that the TLS server MUST send the CT TLS extension.

I realize that this may not suit many early adopters, since few deployed 
servers support the CT TLS extension yet.  But I figured it was worth 
mentioning.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Tom Ritter <[email-masked]>
Date: Mon, 19 Oct 2015 08:29:38 -0500

On 19 October 2015 at 06:31, Rob Stradling <[email-masked]> wrote:
> This newly standardized certificate extension could be used to signal that
> the TLS server MUST send the CT TLS extension.
>

It could... but that seems awfully limited.  Requiring CT is a lot
easier than requiring one of the specific forms. If you change
infrastructure, and lose the ability to include a TLS Extension, you
can at least staple OCSP or get them embedded in a cert.

-tom

---

From: Rob Stradling <[email-masked]>
Date: Mon, 19 Oct 2015 15:05:55 +0100

On 19/10/15 14:29, Tom Ritter wrote:
> On 19 October 2015 at 06:31, Rob Stradling wrote:

That's true.

Perhaps 6962-bis should prohibit or recommend against using TLS Feature 
for the CT TLS extension then.  Or...

Actually, I can't find any explicit requirement in RFC7633 that says 
words to the effect of "The TLS server MUST send TLS extension X".  The 
actual requirements are expressed more vaguely than that.  e.g.
   "A server offering an end-entity certificate with a TLS feature
    extension MUST satisfy a client request for the specified feature"
   "If these features are requested by the client in its ClientHello
    message, then the server MUST return a ServerHello message that
    satisfies this request."

So, perhaps 6962-bis could specify that, if a TLS client sends the CT 
TLS extension and the TLS server's cert contains the TLS Feature cert 
extension with the CT TLS extension identifier, then the TLS server MUST 
"satisfy the request" by sending SCTs via any of the three supported 
mechanisms (CT TLS extension, cert extension, stapled OCSP response 
extension).

---

From: Tom Ritter <[email-masked]>
Date: Mon, 19 Oct 2015 11:29:35 -0500

On 19 October 2015 at 09:05, Rob Stradling <[email-masked]> wrote:
> Perhaps 6962-bis should prohibit or recommend against using TLS Feature for
> the CT TLS extension then.  Or...
>
> Actually, I can't find any explicit requirement in RFC7633 that says words
> to the effect of "The TLS server MUST send TLS extension X".  The actual
> requirements are expressed more vaguely than that.  e.g.
> So, perhaps 6962-bis could specify that, if a TLS client sends the CT TLS
> extension and the TLS server's cert contains the TLS Feature cert extension
> with the CT TLS extension identifier, then the TLS server MUST "satisfy the
> request" by sending SCTs via any of the three supported mechanisms (CT TLS
> extension, cert extension, stapled OCSP response extension).

So... you could. But it wouldn't solve the generic problem of letting
a site owner dictate that CT should always be enabled for their
domain.  The reason I'm critical of 7633 is that it only applies to a
single certificate[0].  If I want to 'enforce' CT for a single
certificate, via a x509 extension... I could just put the CT x509
extension in the certificate.

I'm opposed to the idea of a x509 extension seen on one certificate,
once, applying a policy for the entire domain. For one thing it's
weird, and for another thing it has no way to indicate how long the
policy should apply for. (And it couldn't work for wildcard certs.)

[0] Now technically where 7633 really comes into play and is very
useful is when it's included in intermediates or (my pounding heart be
still) - root certs.  In *that* case it would work great for requiring
CT... but not for site owners, for certificate authorities.  A CA is
assured that all the certs it issues will be publicly logged, and it
can use this as a check against misissuance.  I think that's great...
but it still doesn't help site owners. =)

-tom