3 ms·
Regarding backdating: isn't there a thing like a log that cannot be fudged with? I.e. if you issue a cert now with date y - 1, it needs to be on the log at y -
by WirelessGigabit 4y ago
Regarding backdating: isn't there a thing like a log that cannot be fudged with? I.e. if you issue a cert now with date y - 1, it needs to be on the log at y - 1. Which will invalidate al l entries after that. Like a hashlist (I don't want to say the other word)
- jefftk 4y agoYou're describing certificate transparency: https://certificate.transparency.dev/howctworks/ https://certificate.transparency.dev/howctworks/
- mcpherrinm 4y agoCertificate transparency doesn’t prevent cert backdating, because certs can be included in logs long after they’re issued. It would be possible to require certs be included in logs before some cutoff time but no browsers do that today. It does provide a mechanism that cert backdating can be detected, if new never before seen certs keep showing up from a partially distrusted CA.
- jefftk 4y agoYour last paragraph seems pretty key to me.