Skip to content

Commit 5ff900c

Browse files
author
ID Bot
committed
Script updating gh-pages from 192a68b. [ci skip]
1 parent 7249e19 commit 5ff900c

3 files changed

Lines changed: 81 additions & 16 deletions

File tree

‎draft-davidben-tls-merkle-tree-certs.html‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Python 3.12.12
2121
ConfigArgParse 1.7
2222
google-i18n-address 3.1.1
23-
intervaltree 3.1.0
23+
intervaltree 3.2.1
2424
Jinja2 3.1.6
2525
lxml 6.0.2
2626
platformdirs 4.5.1
@@ -1046,11 +1046,11 @@
10461046
<thead><tr>
10471047
<td class="left">Internet-Draft</td>
10481048
<td class="center">Merkle Tree Certificates</td>
1049-
<td class="right">December 2025</td>
1049+
<td class="right">January 2026</td>
10501050
</tr></thead>
10511051
<tfoot><tr>
10521052
<td class="left">Benjamin, et al.</td>
1053-
<td class="center">Expires 4 July 2026</td>
1053+
<td class="center">Expires 10 July 2026</td>
10541054
<td class="right">[Page]</td>
10551055
</tr></tfoot>
10561056
</table>
@@ -1063,12 +1063,12 @@
10631063
<dd class="internet-draft">draft-davidben-tls-merkle-tree-certs-latest</dd>
10641064
<dt class="label-published">Published:</dt>
10651065
<dd class="published">
1066-
<time datetime="2025-12-31" class="published">31 December 2025</time>
1066+
<time datetime="2026-01-06" class="published">6 January 2026</time>
10671067
</dd>
10681068
<dt class="label-intended-status">Intended Status:</dt>
10691069
<dd class="intended-status">Standards Track</dd>
10701070
<dt class="label-expires">Expires:</dt>
1071-
<dd class="expires"><time datetime="2026-07-04">4 July 2026</time></dd>
1071+
<dd class="expires"><time datetime="2026-07-10">10 July 2026</time></dd>
10721072
<dt class="label-authors">Authors:</dt>
10731073
<dd class="authors">
10741074
<div class="author">
@@ -1128,7 +1128,7 @@ <h2 id="name-status-of-this-memo">
11281128
time. It is inappropriate to use Internet-Drafts as reference
11291129
material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow"></a></p>
11301130
<p id="section-boilerplate.1-4">
1131-
This Internet-Draft will expire on 4 July 2026.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
1131+
This Internet-Draft will expire on 10 July 2026.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
11321132
</section>
11331133
</div>
11341134
<div id="copyright">
@@ -1137,7 +1137,7 @@ <h2 id="name-copyright-notice">
11371137
<a href="#name-copyright-notice" class="section-name selfRef">Copyright Notice</a>
11381138
</h2>
11391139
<p id="section-boilerplate.2-1">
1140-
Copyright (c) 2025 IETF Trust and the persons identified as the
1140+
Copyright (c) 2026 IETF Trust and the persons identified as the
11411141
document authors. All rights reserved.<a href="#section-boilerplate.2-1" class="pilcrow"></a></p>
11421142
<p id="section-boilerplate.2-2">
11431143
This document is subject to BCP 78 and the IETF Trust's Legal
@@ -3740,7 +3740,7 @@ <h3 id="name-log-entries">
37403740
</pre><a href="#section-5.3-2" class="pilcrow"></a>
37413741
</div>
37423742
<p id="section-5.3-3">When <code>type</code> is <code>tbs_cert_entry</code>, <code>N</code> is the number of bytes needed to consume the rest of the input. A MerkleTreeCertEntry is expected to be decoded in contexts where the total length of the entry is known.<a href="#section-5.3-3" class="pilcrow"></a></p>
3743-
<p id="section-5.3-4"><code>tbs_cert_entry_data</code> contains the DER <span>[<a href="#X.690" class="cite xref">X.690</a>]</span> encoding of a TBSCertificateLogEntry, defined below:<a href="#section-5.3-4" class="pilcrow"></a></p>
3743+
<p id="section-5.3-4"><code>tbs_cert_entry_data</code> contains the contents octets (i.e. excluding the initial identifier and length octets) of the DER <span>[<a href="#X.690" class="cite xref">X.690</a>]</span> encoding of a TBSCertificateLogEntry, defined below. Equivalently, <code>tbs_cert_entry_data</code> contains the DER encodings of each field of the TBSCertificateLogEntry, concatenated. This construction allows a single-pass implementation in <a href="#verifying-certificate-signatures" class="auto internal xref">Section 7.2</a>.<a href="#section-5.3-4" class="pilcrow"></a></p>
37443744
<div class="lang-asn.1 sourcecode" id="section-5.3-5">
37453745
<pre>
37463746
TBSCertificateLogEntry ::= SEQUENCE {
@@ -4507,6 +4507,34 @@ <h3 id="name-verifying-certificate-signa">
45074507
</li>
45084508
</ol>
45094509
<p id="section-7.2-3">This procedure only replaces the signature verification portion of X.509 path validation. The relying party MUST continue to perform other checks, such as checking expiry.<a href="#section-7.2-3" class="pilcrow"></a></p>
4510+
<p id="section-7.2-4">In this procedure, <code>entry_hash</code> can equivalently be computed in a single pass from the DER-encoded TBSCertificate, without storing the full TBSCertificateLogEntry or MerkleTreeCertEntry in memory:<a href="#section-7.2-4" class="pilcrow"></a></p>
4511+
<ol start="1" type="1" class="normal type-1" id="section-7.2-5">
4512+
<li id="section-7.2-5.1">
4513+
<p id="section-7.2-5.1.1">Initialize a hash instance.<a href="#section-7.2-5.1.1" class="pilcrow"></a></p>
4514+
</li>
4515+
<li id="section-7.2-5.2">
4516+
<p id="section-7.2-5.2.1">Write the big-endian, two-byte <code>tbs_cert_entry</code> value to the hash.<a href="#section-7.2-5.2.1" class="pilcrow"></a></p>
4517+
</li>
4518+
<li id="section-7.2-5.3">
4519+
<p id="section-7.2-5.3.1">Write the TBSCertificate contents octets to the hash, up to the <code>subjectPublicKeyInfo</code> field.<a href="#section-7.2-5.3.1" class="pilcrow"></a></p>
4520+
</li>
4521+
<li id="section-7.2-5.4">
4522+
<p id="section-7.2-5.4.1">Write the octet 0x04 to the hash. This is an OCTET STRING identifer.<a href="#section-7.2-5.4.1" class="pilcrow"></a></p>
4523+
</li>
4524+
<li id="section-7.2-5.5">
4525+
<p id="section-7.2-5.5.1">Write the octet L to the hash, where L is the hash length. (This assumes L is at most 127.)<a href="#section-7.2-5.5.1" class="pilcrow"></a></p>
4526+
</li>
4527+
<li id="section-7.2-5.6">
4528+
<p id="section-7.2-5.6.1">Write H to the hash, where H is the hash of the <code>subjectPublicKeyInfo</code> field.<a href="#section-7.2-5.6.1" class="pilcrow"></a></p>
4529+
</li>
4530+
<li id="section-7.2-5.7">
4531+
<p id="section-7.2-5.7.1">Write the remainder of the TBSCertificate contents octets to the hash, starting just after the <code>subjectPublicKeyInfo</code> field.<a href="#section-7.2-5.7.1" class="pilcrow"></a></p>
4532+
</li>
4533+
<li id="section-7.2-5.8">
4534+
<p id="section-7.2-5.8.1">Finalize the hash and set <code>entry_hash</code> to the result.<a href="#section-7.2-5.8.1" class="pilcrow"></a></p>
4535+
</li>
4536+
</ol>
4537+
<p id="section-7.2-6">This is possible because the structure in <a href="#log-entries" class="auto internal xref">Section 5.3</a> omits the TBSCertificateLogEntry's identifier and length octets.<a href="#section-7.2-6" class="pilcrow"></a></p>
45104538
</section>
45114539
</div>
45124540
<div id="trusted-cosigners">
@@ -6391,6 +6419,9 @@ <h3 id="name-since-draft-davidben-tls-merkle-tre-2">
63916419
</li>
63926420
<li class="normal" id="appendix-E.10-1.3">
63936421
<p id="appendix-E.10-1.3.1">Fixes to ASN.1 module<a href="#appendix-E.10-1.3.1" class="pilcrow"></a></p>
6422+
</li>
6423+
<li class="normal" id="appendix-E.10-1.4">
6424+
<p id="appendix-E.10-1.4.1">Make log entry more friendly to single-pass verification<a href="#appendix-E.10-1.4.1" class="pilcrow"></a></p>
63946425
</li>
63956426
</ul>
63966427
</section>

‎draft-davidben-tls-merkle-tree-certs.txt‎

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
Network Working Group D. Benjamin
66
Internet-Draft Google LLC
77
Intended status: Standards Track D. O'Brien
8-
Expires: 4 July 2026
8+
Expires: 10 July 2026
99
B. E. Westerbaan
1010
L. Valenta
1111
Cloudflare
1212
F. Valsorda
1313
Geomys
14-
31 December 2025
14+
6 January 2026
1515

1616

1717
Merkle Tree Certificates
@@ -58,11 +58,11 @@ Status of This Memo
5858
time. It is inappropriate to use Internet-Drafts as reference
5959
material or to cite them other than as "work in progress."
6060

61-
This Internet-Draft will expire on 4 July 2026.
61+
This Internet-Draft will expire on 10 July 2026.
6262

6363
Copyright Notice
6464

65-
Copyright (c) 2025 IETF Trust and the persons identified as the
65+
Copyright (c) 2026 IETF Trust and the persons identified as the
6666
document authors. All rights reserved.
6767

6868
This document is subject to BCP 78 and the IETF Trust's Legal
@@ -1169,8 +1169,12 @@ Table of Contents
11691169
consume the rest of the input. A MerkleTreeCertEntry is expected to
11701170
be decoded in contexts where the total length of the entry is known.
11711171

1172-
tbs_cert_entry_data contains the DER [X.690] encoding of a
1173-
TBSCertificateLogEntry, defined below:
1172+
tbs_cert_entry_data contains the contents octets (i.e. excluding the
1173+
initial identifier and length octets) of the DER [X.690] encoding of
1174+
a TBSCertificateLogEntry, defined below. Equivalently,
1175+
tbs_cert_entry_data contains the DER encodings of each field of the
1176+
TBSCertificateLogEntry, concatenated. This construction allows a
1177+
single-pass implementation in Section 7.2.
11741178

11751179
TBSCertificateLogEntry ::= SEQUENCE {
11761180
version [0] EXPLICIT Version DEFAULT v1,
@@ -1939,6 +1943,34 @@ Table of Contents
19391943
X.509 path validation. The relying party MUST continue to perform
19401944
other checks, such as checking expiry.
19411945

1946+
In this procedure, entry_hash can equivalently be computed in a
1947+
single pass from the DER-encoded TBSCertificate, without storing the
1948+
full TBSCertificateLogEntry or MerkleTreeCertEntry in memory:
1949+
1950+
1. Initialize a hash instance.
1951+
1952+
2. Write the big-endian, two-byte tbs_cert_entry value to the hash.
1953+
1954+
3. Write the TBSCertificate contents octets to the hash, up to the
1955+
subjectPublicKeyInfo field.
1956+
1957+
4. Write the octet 0x04 to the hash. This is an OCTET STRING
1958+
identifer.
1959+
1960+
5. Write the octet L to the hash, where L is the hash length. (This
1961+
assumes L is at most 127.)
1962+
1963+
6. Write H to the hash, where H is the hash of the
1964+
subjectPublicKeyInfo field.
1965+
1966+
7. Write the remainder of the TBSCertificate contents octets to the
1967+
hash, starting just after the subjectPublicKeyInfo field.
1968+
1969+
8. Finalize the hash and set entry_hash to the result.
1970+
1971+
This is possible because the structure in Section 5.3 omits the
1972+
TBSCertificateLogEntry's identifier and length octets.
1973+
19421974
7.3. Trusted Cosigners
19431975

19441976
A relying party's cosigner policy determines the sets of cosigners
@@ -3670,6 +3702,8 @@ Since draft-davidben-tls-merkle-tree-certs-09
36703702

36713703
* Fixes to ASN.1 module
36723704

3705+
* Make log entry more friendly to single-pass verification
3706+
36733707
Authors' Addresses
36743708

36753709
David Benjamin

‎index.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ <h2>Preview for branch <a href="russ-feedback">russ-feedback</a></h2>
4545
<tr>
4646
<td><a href="russ-feedback/draft-davidben-tls-merkle-tree-certs.html" class="html draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (HTML)">Merkle Tree Certificates</a></td>
4747
<td><a href="russ-feedback/draft-davidben-tls-merkle-tree-certs.txt" class="txt draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (Text)">plain text</a></td>
48-
<td>same as main</td>
48+
<td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.txt&amp;url_2=https://davidben.github.io/merkle-tree-certs/russ-feedback/draft-davidben-tls-merkle-tree-certs.txt" class="diff draft-davidben-tls-merkle-tree-certs">diff with main</a></td>
4949
</tr>
5050
</table>
5151
<h2>Preview for branch <a href="bas">bas</a></h2>
@@ -62,7 +62,7 @@ <h2>Preview for branch <a href="single-pass">single-pass</a></h2>
6262
<tr>
6363
<td><a href="single-pass/draft-davidben-tls-merkle-tree-certs.html" class="html draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (HTML)">Merkle Tree Certificates</a></td>
6464
<td><a href="single-pass/draft-davidben-tls-merkle-tree-certs.txt" class="txt draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (Text)">plain text</a></td>
65-
<td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.txt&amp;url_2=https://davidben.github.io/merkle-tree-certs/single-pass/draft-davidben-tls-merkle-tree-certs.txt" class="diff draft-davidben-tls-merkle-tree-certs">diff with main</a></td>
65+
<td>same as main</td>
6666
</tr>
6767
</table>
6868
<h2>Preview for branch <a href="demo">demo</a></h2>

0 commit comments

Comments
 (0)