Subject: Re: Call for Adoption: Expect-CT

From: Eran Messeri <[email-masked]>
Date: Mon, 12 Dec 2016 12:01:16 +0000

I support (have implemented a previous incarnation of the header on
Google's front-ends, will implement the version described in the draft
soon).

---

From: Eran Messeri <[email-masked]>
Date: Tue, 13 Dec 2016 11:42:55 +0000

While in theory this could be a TLS option, in practice, with the
infrastructure deployed today, it would be very hard to deploy as a TLS
option.
One of the ways to support Certificate Transparency in an TLS connection is
to send Signed Certificate TImestamp Lists in the TLS handshake (assuming
the client advertises support for it).

Deploying that feature, in Chrome, on Google's infrastructure and
open-source HTTP servers, have taught us that this is a very invasive
change that could break servers (simply by clients re-ordering the TLS
 extensions they support) and is not trivial to deploy (needs support in
the underlying SSL library).

Exactly for this reason a header is, IMHO, a good solution: It is much
easier to set up and would help identify cases where a site owner believes
their site supports CT, but it doesn't (if changing certificate issuance
software / TLS servers was easy, we wouldn't have needed this feature in
the first place).

---

From: "J.C. Jones" <[email-masked]>
Date: Wed, 14 Dec 2016 18:26:17 -0700

Better late than never...

On 2016/12/08 13:05, Mark Nottingham wrote:
> Again, there seemed to be strong support in Seoul, and now on the list, for adopting this draft:
>
> <https://tools.ietf.org/html/draft-stark-expect-ct>
>
> Please comment / express support on list.

The Security Engineering team at Mozilla is interested in implementing
Expect-CT in Firefox in 2017. I believe this view was communicated in
person but, as I wasn't there, I want to be sure it's recorded properly.

Expect-CT primarily gives us a method to allow website operators to start
testing the as-of-now-unspecified Firefox CT policy across the variety of
end-user environments, and get some feedback as to whether their CDN /
Webserver combination is distributing SCTs properly.

Cheers,

J.C.
Security Engineering, Mozilla

---

From: =JeffH <[email-masked]>
Date: Thu, 15 Dec 2016 15:58:36 -0800

> On Dec 7, 2016, at 8:05 PM, Mark Nottingham <[email-masked]> wrote:
 >

support.