IETF Logo Mail Archive

Re: [Trans] Providing the history of STHs a log has issued (in 6962-bis)

Paul Hadfield <hadfieldp@google.com> Thu, 04 May 2017 13:01 UTC

Return-Path: <hadfieldp@google.com>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87BED126E01 for <trans@ietfa.amsl.com>; Thu, 4 May 2017 06:01:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lUc_nn94aT5e for <trans@ietfa.amsl.com>; Thu, 4 May 2017 06:01:52 -0700 (PDT)
Received: from mail-pg0-x22e.google.com (mail-pg0-x22e.google.com [IPv6:2607:f8b0:400e:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5479127BA3 for <trans@ietf.org>; Thu, 4 May 2017 06:01:50 -0700 (PDT)
Received: by mail-pg0-x22e.google.com with SMTP id o3so8213792pgn.2 for <trans@ietf.org>; Thu, 04 May 2017 06:01:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3Cb6GUTxmlAikbyGef/xfRDHM/dBmFyLCfVGT1h4WrQ=; b=MzVEzZ5HDjBk/VicTflWim8ZfkzgI9Vpl6IELMsCgspboa9qvGiHkzwmkvtbLjrhVS Pub+XTQrpJ/48PtR9jNyU0WcLyzh4F+UBxc7XuLQBGHk/qvecV6OKb9ScVXnrU8bTTTp MHH7TclTUvrEBNPcIgk5Ub7EHltrkGOlgG2YmtbO94D/2HmV/hh9yDMefR1p4vAx+MaY luF2jESy+RLOhwVqHhNlndw2RSEtCvnanUp5Z+q4UVjt2f4zcg6QVoA8zUvA9CPTLw/I zkEKsSupb8XAiVx/03xd6icUpVUN4ca8YihhpX/nMFLIj9d6u4tcmIhItt3IESMtbwlW 6RUw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3Cb6GUTxmlAikbyGef/xfRDHM/dBmFyLCfVGT1h4WrQ=; b=AOkJL0xC5KD2arimdlouMkg1anIifU7OyCQMu5+SfgxI/SUf5hsOP3nbcxzO0OBepw NlXvV+S7Y8wmQZJq1CNMwW8+/HW921GJeuHW+Tig5aEiEPxz7OPbZouF7xfCeB7aSIYF XYIz6uN5sP6NuJy/TY8r0UIvEB5glPS3tVT0m2VgkTjEeXOh8xOBn0NWDEkQ4am20kSx IVt5HFvQVxxZMm9fj3C+5as94OKV/+ffUxn6iY83mo8vIzjmgd+M6aUl+eFieE18DMQB fIkomEZ5mRq8Wakz2N22F92yCfusZjgXssqZW2CF7har4DjcGLpCrryGokThFmwISlPd QvCg==
X-Gm-Message-State: AN3rC/6PpICzhNonrZz+iAw0fdb6nWdYttY4pEKXJK6vUl93BBIgfpga NBgFkbiMRH2WPW17DvfkiJyzcOaDTu8fh4Q=
X-Received: by 10.98.84.194 with SMTP id i185mr10856205pfb.234.1493902910088; Thu, 04 May 2017 06:01:50 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.100.141.80 with HTTP; Thu, 4 May 2017 06:01:49 -0700 (PDT)
In-Reply-To: <CALzYgEe+PbYJN6Zz4NnPXBnnhYCi8Op-WmSzFKGxRv+uf+b=sA@mail.gmail.com>
References: <CALzYgEe+PbYJN6Zz4NnPXBnnhYCi8Op-WmSzFKGxRv+uf+b=sA@mail.gmail.com>
From: Paul Hadfield <hadfieldp@google.com>
Date: Thu, 04 May 2017 14:01:49 +0100
Message-ID: <CAGDCdM4G2w7F6CU4EGFbqn_f-EPkLy5voh_GOeeYR_2OrutQ7Q@mail.gmail.com>
To: Eran Messeri <eranm@google.com>
Cc: "trans@ietf.org" <trans@ietf.org>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="94eb2c0ce1d24e9c28054eb260d5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/KL1kEdqtPrIdP5PGeMZ5K7GYR8s>
Subject: Re: [Trans] Providing the history of STHs a log has issued (in 6962-bis)
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 May 2017 13:01:53 -0000

I support the addition of this API; Rob's PR
<https://github.com/google/certificate-transparency-rfcs/pull/200/> was
created in response to my original proposal
<https://mailarchive.ietf.org/arch/msg/trans/AsxrWg9L1hgxt-g3PSlip73DvYs>
for this made Oct, 25 2016.

As the operator of a CT Monitor, I could use the STH history API to perform
historic analysis of the logs my monitor visits. This includes
determination of whether MMD violations occurred in the past.

Without this API, CT Monitors that ingest a log's entries from STHm to STHn
(n>m) could incorrectly identify an MMD violation, as it is possible for
them to have missed an STH that sits between m and n.

With this API, a log operator that is incorrectly called out for a MMD
violation has the ability to demonstrate that the monitor drew an incorrect
conclusion as a consequence of not observing the log's complete STH
sequence.

Paul

On Thu, May 4, 2017 at 1:41 PM, Eran Messeri <eranm@google.com> wrote:

> I'm looking for feedback on the proposal to add an API endpoint which
> would provide access to historical STHs issued by the log (
> https://trac.ietf.org/trac/trans/ticket/163).
>
> I personally think it's a good idea to have such an API since it'd allow
> auditing a log for past compliance with the MMD requirement.
>
> Rob Stradling has sent a PR
> <https://github.com/google/certificate-transparency-rfcs/pull/200/> for
> this.
>
> Eran
>

v2.23.0 | Report a Bug | By Email