2 ms·
SCT does nothing by itself except some additional fields in a cert. By itself, it is of absolutely no protection whatsoever.
by throwaway2048 8y ago
SCT does nothing by itself except some additional fields in a cert. By itself, it is of absolutely no protection whatsoever.
- tialaramex 8y agoSCTs are signatures from log servers. So the presence of the SCT means now not only the CA vouches for this certificate, but also the signing logs vouch for having seen this certificate. Chrome has a policy baked into it about which logs it will trust. Under current policy this "nothing" means Google plus at least one independent log operator claim to have seen it and logged it. This eliminates the scenario in which a powerful adversary obtains certificates but only shows them to a single victim or small victim group. Whatever they did, everybody will see it.
- deleted 8y ago[deleted]