<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Dear Ted,</div><div><br></div><div>On Sep 27, 2014, at 6:33 PM, Theodore Ts'o <<a href="mailto:tytso@mit.edu">tytso@mit.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Sat, Sep 27, 2014 at 06:04:50PM -0700, Greg wrote:<br><blockquote type="cite"><br>No, that is not true.<br><br>The SCTs in the certificate are the ones the MITM puts there.<br><br>They are not the ones you're thinking of (that whatever trustworthy entity chose).<br></blockquote><br>If the client has a policy which requires one or more SCT's from<br>entities that come from legal jourisdictions that aren't subject to<br>NSL's, then in order for the MITM to impersonate those SCT's, it will<br>need to either gimmick those entities's certificate, or compromise<br>their private keys. Either way, it makes the job of the MITM more<br>difficult.<br></blockquote><div><br class="webkit-block-placeholder"></div><div>Ah yes, I see what you mean now, thank you for clarifying. This doesn't really fix the problem, but it might make life more difficult for everyone (including the MITM, and those who are trying to use CT legitimately).</div><div><br></div><div>OK, I am done with emails about CT for the day. Have spent way too much time on this already, and I didn't even get payed for it. :P</div><div><br></div><div>Cheers,</div><div>Greg</div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></body></html>