Subject: [Trans] [trans] #150 (threat-analysis): Architecture document: Indicate missing SCT is equivalent to invalid one

From: "trans issue tracker" <[email-masked]>
Date: Fri, 08 Jan 2016 17:02:29 -0000

#150: Architecture document: Indicate missing SCT is equivalent to invalid one

 In section 2, in the part about TLS clients (browsers), append "or
 missing" to the last section so it reads "if the SCT is invalid or
 missing" - a CT-aware TLS client should treat both cases as equal.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-trans-threat-
  [email-masked]       |  [email-masked]
     Type:  enhancement  |     Status:  new
 Priority:  major        |  Milestone:
Component:  threat-      |    Version:
  analysis               |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/150>
trans <https://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 12 Jan 2016 19:15:01 -0000

Comment (by [email-masked]):

 I don't think it appropriate to treat missing and invalid SCTs as
 equivalent. An invalid SCT violates the spec for SCT syntax or has a bad
 signature, and thus is a justification for rejecting a cert. We do not
 have a proposal for how to be backwards compatible and yet mandate SCTs
 for all web server sites, so we ought not treat a missing SCT as
 equivalent.

  analysis               |  Resolution:
 Keywords:               |

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/150#comment:1>
trans <https://tools.ietf.org/trans/>