3 ms·
So, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack: "None of CT’s proofs (audit or consistency proo
by itistoday2 12y ago
So, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack:
"None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [1]"
And that's for today's attacks. In the section before that paragraph, another attack is demonstrated that also cannot be prevented by CT's audit proofs.
[1] https://moderncrypto.org/mail-archive/messaging/2014/000873.html https://moderncrypto.org/mail-archive/messaging/2014/000873....
- yuhong 12y agoAnd the point is that logging intermediates only does not directly prevent the attacks but it is still useful.