<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Sep 27, 2014, at 1:43 PM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:<div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div style="word-wrap: break-word;"><span class="">I'm saying their trees work like Merkle trees are supposed to work, and that none of their proofs detect mis-issued certificates.<br></span><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>The two certs (legit and false) will happily live side-by-side in the tree undetected by the gossip protocol.</div></div></div></div></div></div></blockquote><div><br></div><div>Even after the network partition is resolved and the latest log is seen?</div><div><br></div><div>If you allege that's the case, I don't understand your attack. </div></div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>What do you mean by "network partition"?</div><div><br></div><div>Maybe this will help, go to Google's "How Log Proofs Work" page:</div><div><br></div><div><a href="http://www.certificate-transparency.org/log-proofs-work">http://www.certificate-transparency.org/log-proofs-work</a></div><div><br></div><div>Look at the little green boxes that represent certificates.</div><div><br></div><div>So, one of those green boxes will be a legitimate certificate, and the other will be the fraudulent one.</div><div><br></div><div>Neither consistency nor audit proofs will let a client know whether or not the cert they're being shown is fraudulent or not, and that is even when both of them are in the same log (which they don't have to be).</div><div><br></div><div>Gossip just sends the little red boxes between the server and the clients. They don't matter.</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div></div></div></div></div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></div></body></html>