Further explain SCITT analogy to RFC9162 CT entities and processes #301
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aj-stein-nist
requested review from
henkbirkholz,
ad-l,
fournet,
yogeshbdeshpande,
SteveLasker,
JAG-UK and
OR13
as code owners
SteveLasker
requested changes
Sep 3, 2024
| @@ -316,7 +316,7 @@ Considering CT in terms of SCITT: | |||
| - CAs (Issuers) sign the ASN.1 DER encoded tbsCertificate structure to produce an X.509 certificate (Signed Statements) | |||
| - CAs submit the certificates to one or more CT logs (Transparency Services) | |||
| - CT logs produce Signed Certificate Timestamps (Transparent Statements) | |||
| - Signed Certificate Timestamps are checked by Relying Parties | |||
| - Signed Certificate Timestamps, Signed Tree Heads, and their respective consistency proofs are checked by Relying Parties | |||
There was a problem hiding this comment.
The arch doc doesn't discuss Signed Tree Heads. Proposing:
Suggested change
| - Signed Certificate Timestamps, Signed Tree Heads, and their respective consistency proofs are checked by Relying Parties | |
| - Signed Certificate Timestamps and their respective consistency proofs are checked by Relying Parties |
There was a problem hiding this comment.
Steve, Does this mean a Transparency Service provider MUST check Signed Certificate Timestamps and their respective consistency proofs?
There was a problem hiding this comment.
Good catch, @rjb4standards:
consistency proofs are checked by Relying Parties
questions if "are" is a MUST, SHOULD, COULD, or just a passive reference.
As this is the "Definition of Transparency" section, I would read this as an example and IMO, I'm ok with it not being more restrictive. For that matter, x.509 is not required, so I wouldn't take this further.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #263.