Subject: [Trans] [trans] #141 (rfc6962-bis): expanding audit description

From: "trans issue tracker" <[email-masked]>
Date: Wed, 02 Dec 2015 06:13:25 -0000

#141: expanding audit description

 The description of Auditing in Section 9.4 is vague and difficult to
 interpret -- “Auditing is taking partial information about a log as input
 and verifying that this information is consistent with other partial
 information held.”  It would make sense to create a separate Auditor
 requirements document that could contain a more thorough description of
 auditing. Also, 9.4.1 to 9.4.3 could be moved to normative appendices
 which could then be referred to by the auditor draft.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-trans-
  [email-masked]           |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  rfc6962-bis  |    Version:
 Severity:  -            |   Keywords:
-------------------------+-------------------------------------------------

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/141>
trans <https://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Wed, 02 Dec 2015 15:57:09 -0000

Comment (by [email-masked]):

 Please provide text for the current document.

 Severity:  -            |  Resolution:
 Keywords:               |

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/141#comment:1>
trans <https://tools.ietf.org/trans/>

---

From: Karen Seo <[email-masked]>
Date: Mon, 14 Dec 2015 21:42:52 -0500

On 12/2/15 10:57 AM, trans issue tracker wrote:
> Comment ([email-masked]):
>
Hello, Paul,

In line with the approach of focussing 6962-bis on the log and moving 
the other components of CT into separate specifications, how about the 
following....

_/*6962-bis:*/_

 1. Section 9.4. Auditing
      * Leaving the first paragraph as is [subject to further WG review].
      * Replace the 2nd, 3rd, and 4th paragraph with "See 'Certificate
        Transparency (CT) Requirements for Monitors and Auditors' for a
        detailed description of the functions performed by an Auditor."
 2. Move Section 9.4.1 to Appendix A "Verifying an inclusion proof"
 3. Move Section 9.4.2 to Appendix B "Verifying consistency between two
    STHs"
 4. Move Section 9.4.3 to Appendix C "Verifying root hash given entries"

_/*
*/__/*Certificate Transparency (CT) Requirements for Monitors and 
Auditors (draft submitted on 11/24/2015)*/__/*:*/_

 1. Change Section 3.1., first sentence:
      * _/*From:*/_ Checking that a log is behaving correctly with
        regard to MMD, STH Frequency Count and Append-only property MUST
        be performed using the algorithms described in Sections 9.3 and
        9.4 of [6962-bis]
      * _/*To:*/_ Checking that a log is behaving correctly with regard
        to MMD, STH Frequency Count and Append-only property MUST be
        performed using the algorithms described in Section 9.3 and
        AppendicesA, B, and C of 6962-bis.
 2. Change Section 3.1, bullet 3:
      * _/*From:*/_ In order to verify the append-only property, an
        Auditor executes the algorithm as described in Section 9.4.2 of
        [6962-bis].
      * /_*To:*_/ In order to verify the append-only property, an
        Auditor executes the algorithm as described in Appendix B of
        [6962-bis].

Thank you,
Karen

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 15 Dec 2015 16:09:44 -0000

Comment (by [email-masked]):

 Below is a capture from the thread (by kseo):
 ----
 In line with the approach of focussing 6962-bis on the log and moving the
 other components of CT into separate specifications, how about the
 following....

 6962-bis:
 Section 9.4. Auditing
 Leaving the first paragraph as is [subject to further WG review].
 Replace the 2nd, 3rd, and 4th paragraph with "See 'Certificate
 Transparency (CT) Requirements for Monitors and Auditors' for a detailed
 description of the functions performed by an Auditor."
 Move Section 9.4.1 to Appendix A "Verifying an inclusion proof"
 Move Section 9.4.2 to Appendix B "Verifying consistency between two STHs"
 Move Section 9.4.3 to Appendix C "Verifying root hash given entries"

 Certificate Transparency (CT) Requirements for Monitors and Auditors
 (draft submitted on 11/24/2015):
 Change Section 3.1., first sentence:
 From: Checking that a log is behaving correctly with regard to MMD, STH
 Frequency Count and Append-only property MUST be performed using the
 algorithms described in Sections 9.3 and 9.4 of [6962-bis]
 To: Checking that a log is behaving correctly with regard to MMD, STH
 Frequency Count and Append-only property MUST be performed using the
 algorithms described in Section 9.3 and Appendices A, B, and C of
 6962-bis.
 Change Section 3.1, bullet 3:
 From: In order to verify the append-only property, an Auditor executes the
 algorithm as described in Section 9.4.2 of [6962-bis].
 To: In order to verify the append-only property, an Auditor executes the
 algorithm as described in Appendix B of [6962-bis].

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/141#comment:2>
trans <https://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 22 Dec 2015 16:40:23 -0000

Comment (by [email-masked]):

 The following text is offered to replace Section 9.4.

 An Auditor interacts with a log to detect misbehavior of the log.
 When it detects misbehavior, an Auditor notifies Monitors that have
 arranged for such notification. Because Browser Vendors supply log
 metadata in their browsers, each is expected to operate an Auditor, or to
 arrange to receive notifications of log misbehavior from Auditors, or
 both.

 An Auditor detects log misbehavior by performing checks on log
 entries and Signed Tree Heads (STHs). There are four log behavior
 properties that Auditors check:

      1. The Maximum Merge Delay (MMD)
      2. The STH Frequency Count
      3. The append-only property
      4. The consistency of the log view presented to all query sources

 The first three of these checks are easily performed using existing log
 interfaces and log metadata, employing algorithms described in Appendices
 A, B, and C. The last check is more difficult to perform because it
 requires a way to share log responses among a set of CT elements, perhaps
 including browsers, web sites, Monitors, and Auditors, e.g., so-called
 gossiping. A comprehensive specification of Auditor requirements will be
 provided in a document to be published later.

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/141#comment:3>
trans <https://tools.ietf.org/trans/>