Dear Linus, Paul Wouters brought up the idea of sharing certs on [metzdowd], and I guess that's the same thing as gossiping SCTs, right?
I think that could actually be very useful for detecting a MITM, here's my reply to him there: http://www.metzdowd.com/pipermail/cryptography/2014-September/023037.html > The more information shared, the better detection we seem to get. But > sharing information have privacy implications. It seems to me that > sharing STH's is much less problematic than sharing SCT's. Why do you think sharing SCTs is problematic, and what privacy implications does it pose? If the SCTs are shared over an encrypted connection, only the server, the client, and the potential MITM will know about them. Any time a cert changes, the client would tell the server about that change over the established TLS connection. When MITM leaves, the server would find out that a fraudulent cert had been generated for their website, and could then identify the CA responsible. Kind regards, Greg Slepak -- Please do not email me anything that you are not comfortable also sharing with the NSA.
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Trans mailing list [email protected] https://www.ietf.org/mailman/listinfo/trans
