Script updating gh-pages from 86ead15. [ci skip]

Author: ID Bot

draft-davidben-tls-merkle-tree-certs.html

@@ -1046,11 +1046,11 @@
 <thead><tr>
 <td class="left">Internet-Draft</td>
 <td class="center">Merkle Tree Certificates</td>
-<td class="right">October 2025</td>
+<td class="right">November 2025</td>
 </tr></thead>
 <tfoot><tr>
 <td class="left">Benjamin, et al.</td>
-<td class="center">Expires 22 April 2026</td>
+<td class="center">Expires 8 May 2026</td>
 <td class="right">[Page]</td>
 </tr></tfoot>
 </table>
@@ -1063,12 +1063,12 @@
 <dd class="internet-draft">draft-davidben-tls-merkle-tree-certs-latest</dd>
 <dt class="label-published">Published:</dt>
 <dd class="published">
-<time datetime="2025-10-19" class="published">19 October 2025</time>
+<time datetime="2025-11-04" class="published">4 November 2025</time>
     </dd>
 <dt class="label-intended-status">Intended Status:</dt>
 <dd class="intended-status">Experimental</dd>
 <dt class="label-expires">Expires:</dt>
-<dd class="expires"><time datetime="2026-04-22">22 April 2026</time></dd>
+<dd class="expires"><time datetime="2026-05-08">8 May 2026</time></dd>
 <dt class="label-authors">Authors:</dt>
 <dd class="authors">
 <div class="author">
@@ -1128,7 +1128,7 @@ <h2 id="name-status-of-this-memo">
         time. It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.1-4">
-        This Internet-Draft will expire on 22 April 2026.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
+        This Internet-Draft will expire on 8 May 2026.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="copyright">
@@ -4779,26 +4779,28 @@ <h3 id="name-certificate-malleability">
             <p id="section-12.6-3.4.1"><code>subjectPublicKeyInfo</code> is hashed as <code>subjectPublicKeyInfoHash</code> in TBSCertificateLogEntry. Provided the underlying hash function is collision-resistant, no other values are possible for a given log entry.<a href="#section-12.6-3.4.1" class="pilcrow">¶</a></p>
 </li>
         </ul>
-<p id="section-12.6-4">Some non-conforming X.509 implementations use a BER <span>[<a href="#X.690" class="cite xref">X.690</a>]</span> parser instead of DER and then, instead of computing the canonical DER encoding per <span><a href="https://rfc-editor.org/rfc/rfc5280#section-4.1.1.3" class="relref">Section 4.1.1.3</a> of [<a href="#RFC5280" class="cite xref">RFC5280</a>]</span>, verify the signature over the particular BER encoding received. Those implementations may still assume the received BER-encoded TBSCertificate is not malleable. However, as BER encoding is not unique, this breaks the above assumptions in Merkle Tree Certificates. To preserve non-malleability, these non-conforming implementations MUST do the following when verifying a Merkle Tree Certificate:<a href="#section-12.6-4" class="pilcrow">¶</a></p>
+<p id="section-12.6-4">X.509 implementations often implement <span><a href="https://rfc-editor.org/rfc/rfc5280#section-4.1.1.3" class="relref">Section 4.1.1.3</a> of [<a href="#RFC5280" class="cite xref">RFC5280</a>]</span> by equivalently retaining the original received DER encoding, rather than recomputing the canonical DER encoding TBSCertificate. This optimization is compatible with the assumptions above.<a href="#section-12.6-4" class="pilcrow">¶</a></p>
+<p id="section-12.6-5">Some non-conforming X.509 implementations use a BER <span>[<a href="#X.690" class="cite xref">X.690</a>]</span> parser instead of DER, and then apply this optimization to the received BER encoding. BER encoding is not unique, so this does not produce the same result. In such implementations, the BER-encoded TBSCertificate becomes also non-malleable, and applications may rely on this. To preserve this property in Merkle Tree Certificates, such non-conforming implementations MUST do the following when implementing <a href="#verifying-certificate-signatures" class="auto internal xref">Section 7.2</a>:<a href="#section-12.6-5" class="pilcrow">¶</a></p>
 <ul class="normal">
-<li class="normal" id="section-12.6-5.1">
-            <p id="section-12.6-5.1.1">When parsing the outermost TBSCertificate SEQUENCE tag and length, reparse with a conforming DER parser.<a href="#section-12.6-5.1.1" class="pilcrow">¶</a></p>
+<li class="normal" id="section-12.6-6.1">
+            <p id="section-12.6-6.1.1">Reparse the initial identifier (the SEQUENCE tag) and length octets of the TBSCertificate structure with a conforming DER parser and fail verification if invalid.<a href="#section-12.6-6.1.1" class="pilcrow">¶</a></p>
 </li>
-          <li class="normal" id="section-12.6-5.2">
-            <p id="section-12.6-5.2.1">When copying the <code>version</code>, <code>issuer</code>, <code>validity</code>, <code>subject</code>, <code>issuerUniqueID</code>, <code>subjectUniqueID</code>, and <code>extensions</code> fields, either reparse with a conforming DER parser, or copy over the observed BER encodings.<a href="#section-12.6-5.2.1" class="pilcrow">¶</a></p>
+          <li class="normal" id="section-12.6-6.2">
+            <p id="section-12.6-6.2.1">When copying the <code>version</code>, <code>issuer</code>, <code>validity</code>, <code>subject</code>, <code>issuerUniqueID</code>, <code>subjectUniqueID</code>, and <code>extensions</code> fields, either copy over the observed BER encodings, or reparse each field with a conforming DER parser and fail verification if invalid.<a href="#section-12.6-6.2.1" class="pilcrow">¶</a></p>
 </li>
-          <li class="normal" id="section-12.6-5.3">
-            <p id="section-12.6-5.3.1">Reparse the <code>serialNumber</code> field with a conforming DER parser.<a href="#section-12.6-5.3.1" class="pilcrow">¶</a></p>
+          <li class="normal" id="section-12.6-6.3">
+            <p id="section-12.6-6.3.1">Reparse the <code>serialNumber</code> field with a conforming DER parser and fail verification if invalid.<a href="#section-12.6-6.3.1" class="pilcrow">¶</a></p>
 </li>
-          <li class="normal" id="section-12.6-5.4">
-            <p id="section-12.6-5.4.1">Reparse the <code>signature</code> field with a conforming DER parser. Equivalently, check for an exact match for the expected, DER-encoded value.<a href="#section-12.6-5.4.1" class="pilcrow">¶</a></p>
+          <li class="normal" id="section-12.6-6.4">
+            <p id="section-12.6-6.4.1">Reparse the <code>signature</code> field with a conforming DER parser and fail verification if invalid. Equivalently, check for an exact equality with for the expected, DER-encoded value.<a href="#section-12.6-6.4.1" class="pilcrow">¶</a></p>
 </li>
-          <li class="normal" id="section-12.6-5.5">
-            <p id="section-12.6-5.5.1">When hashing <code>subjectPublicKeyInfo</code>, either reparse with a conforming DER parser, or hash the observed BER encoding.<a href="#section-12.6-5.5.1" class="pilcrow">¶</a></p>
+          <li class="normal" id="section-12.6-6.5">
+            <p id="section-12.6-6.5.1">When hashing <code>subjectPublicKeyInfo</code>, either hash the observed BER encoding, or reparse the structure with a conforming DER parser and fail verification if invalid.<a href="#section-12.6-6.5.1" class="pilcrow">¶</a></p>
 </li>
         </ul>
-<p id="section-12.6-6"><a href="#log-entries" class="auto internal xref">Section 5.3</a> requires that the TBSCertificateLogEntry in a MerkleTreeCertEntry be DER-encoded, so applying a stricter parser will be compatible with conforming CAs. While these existing non-conforming implementations may be unable to switch to a DER parser due to compatibility concerns, Merkle Tree Certificates is new, so there is no existing deployment of malformed BER-encoded TBSCertificateLogEntry structures.<a href="#section-12.6-6" class="pilcrow">¶</a></p>
-<p id="section-12.6-7">The above only ensures the TBSCertificate portion is non-malleable. In Merkle Tree Certificates, similar to ECDSA X.509 signature, the signature value is malleable. Multiple MTCProof structures may prove a single TBSCertificate structure. Additionally, in all X.509-based protocols, a BER-based parser for the outer, unsigned Certificate structure will admit malleability in those portions of the encoding. Applications that derive a unique identifier from the Certificate MUST instead use the TBSCertificate, or some portion of it, for Merkle Tree Certificates.<a href="#section-12.6-7" class="pilcrow">¶</a></p>
+<p id="section-12.6-7">These additional checks are redundant in X.509 implementations that use a conforming DER parser.<a href="#section-12.6-7" class="pilcrow">¶</a></p>
+<p id="section-12.6-8"><a href="#log-entries" class="auto internal xref">Section 5.3</a> requires that the TBSCertificateLogEntry in a MerkleTreeCertEntry be DER-encoded, so applying a stricter parser will be compatible with conforming CAs. While these existing non-conforming implementations may be unable to switch to a DER parser due to compatibility concerns, Merkle Tree Certificates is new, so there is no existing deployment of malformed BER-encoded TBSCertificateLogEntry structures.<a href="#section-12.6-8" class="pilcrow">¶</a></p>
+<p id="section-12.6-9">The above only ensures the TBSCertificate portion is non-malleable. In Merkle Tree Certificates, similar to ECDSA X.509 signature, the signature value is malleable. Multiple MTCProof structures may prove a single TBSCertificate structure. Additionally, in all X.509-based protocols, a BER-based parser for the outer, unsigned Certificate structure will admit malleability in those portions of the encoding. Applications that derive a unique identifier from the Certificate MUST instead use the TBSCertificate, or some portion of it, for Merkle Tree Certificates.<a href="#section-12.6-9" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>

draft-davidben-tls-merkle-tree-certs.txt

@@ -5,13 +5,13 @@
 Network Working Group                                        D. Benjamin
 Internet-Draft                                                Google LLC
 Intended status: Experimental                                 D. O'Brien
-Expires: 22 April 2026                                                  
+Expires: 8 May 2026                                                     
                                                         B. E. Westerbaan
                                                               L. Valenta
                                                               Cloudflare
                                                              F. Valsorda
                                                                   Geomys
-                                                         19 October 2025
+                                                         4 November 2025
 
 
                         Merkle Tree Certificates
@@ -58,7 +58,7 @@ Status of This Memo
    time.  It is inappropriate to use Internet-Drafts as reference
    material or to cite them other than as "work in progress."
 
-   This Internet-Draft will expire on 22 April 2026.
+   This Internet-Draft will expire on 8 May 2026.
 
 Copyright Notice
 
@@ -2582,32 +2582,42 @@ Table of Contents
       collision-resistant, no other values are possible for a given log
       entry.
 
+   X.509 implementations often implement Section 4.1.1.3 of [RFC5280] by
+   equivalently retaining the original received DER encoding, rather
+   than recomputing the canonical DER encoding TBSCertificate.  This
+   optimization is compatible with the assumptions above.
+
    Some non-conforming X.509 implementations use a BER [X.690] parser
-   instead of DER and then, instead of computing the canonical DER
-   encoding per Section 4.1.1.3 of [RFC5280], verify the signature over
-   the particular BER encoding received.  Those implementations may
-   still assume the received BER-encoded TBSCertificate is not
-   malleable.  However, as BER encoding is not unique, this breaks the
-   above assumptions in Merkle Tree Certificates.  To preserve non-
-   malleability, these non-conforming implementations MUST do the
-   following when verifying a Merkle Tree Certificate:
-
-   *  When parsing the outermost TBSCertificate SEQUENCE tag and length,
-      reparse with a conforming DER parser.
+   instead of DER, and then apply this optimization to the received BER
+   encoding.  BER encoding is not unique, so this does not produce the
+   same result.  In such implementations, the BER-encoded TBSCertificate
+   becomes also non-malleable, and applications may rely on this.  To
+   preserve this property in Merkle Tree Certificates, such non-
+   conforming implementations MUST do the following when implementing
+   Section 7.2:
+
+   *  Reparse the initial identifier (the SEQUENCE tag) and length
+      octets of the TBSCertificate structure with a conforming DER
+      parser and fail verification if invalid.
 
    *  When copying the version, issuer, validity, subject,
       issuerUniqueID, subjectUniqueID, and extensions fields, either
-      reparse with a conforming DER parser, or copy over the observed
-      BER encodings.
+      copy over the observed BER encodings, or reparse each field with a
+      conforming DER parser and fail verification if invalid.
+
+   *  Reparse the serialNumber field with a conforming DER parser and
+      fail verification if invalid.
 
-   *  Reparse the serialNumber field with a conforming DER parser.
+   *  Reparse the signature field with a conforming DER parser and fail
+      verification if invalid.  Equivalently, check for an exact
+      equality with for the expected, DER-encoded value.
 
-   *  Reparse the signature field with a conforming DER parser.
-      Equivalently, check for an exact match for the expected, DER-
-      encoded value.
+   *  When hashing subjectPublicKeyInfo, either hash the observed BER
+      encoding, or reparse the structure with a conforming DER parser
+      and fail verification if invalid.
 
-   *  When hashing subjectPublicKeyInfo, either reparse with a
-      conforming DER parser, or hash the observed BER encoding.
+   These additional checks are redundant in X.509 implementations that
+   use a conforming DER parser.
 
    Section 5.3 requires that the TBSCertificateLogEntry in a
    MerkleTreeCertEntry be DER-encoded, so applying a stricter parser

index.html

@@ -45,23 +45,15 @@ <h2>Preview for branch <a href="proof-explain">proof-explain</a></h2>
       <tr>
         <td><a href="proof-explain/draft-davidben-tls-merkle-tree-certs.html" class="html draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (HTML)">Merkle Tree Certificates</a></td>
         <td><a href="proof-explain/draft-davidben-tls-merkle-tree-certs.txt" class="txt draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (Text)">plain text</a></td>
-        <td>same as main</td>
-      </tr>
-    </table>
-    <h2>Preview for branch <a href="notation">notation</a></h2>
-    <table id="branch-notation">
-      <tr>
-        <td><a href="notation/draft-davidben-tls-merkle-tree-certs.html" class="html draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (HTML)">Merkle Tree Certificates</a></td>
-        <td><a href="notation/draft-davidben-tls-merkle-tree-certs.txt" class="txt draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (Text)">plain text</a></td>
-        <td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.txt&amp;url_2=https://davidben.github.io/merkle-tree-certs/notation/draft-davidben-tls-merkle-tree-certs.txt" class="diff draft-davidben-tls-merkle-tree-certs">diff with main</a></td>
+        <td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.txt&amp;url_2=https://davidben.github.io/merkle-tree-certs/proof-explain/draft-davidben-tls-merkle-tree-certs.txt" class="diff draft-davidben-tls-merkle-tree-certs">diff with main</a></td>
       </tr>
     </table>
     <h2>Preview for branch <a href="draft-davidben-tls-merkle-tree-certs-08">draft-davidben-tls-merkle-tree-certs-08</a></h2>
     <table id="branch-draft-davidben-tls-merkle-tree-certs-08">
       <tr>
         <td><a href="draft-davidben-tls-merkle-tree-certs-08/draft-davidben-tls-merkle-tree-certs.html" class="html draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (HTML)">Merkle Tree Certificates</a></td>
         <td><a href="draft-davidben-tls-merkle-tree-certs-08/draft-davidben-tls-merkle-tree-certs.txt" class="txt draft-davidben-tls-merkle-tree-certs" title="Merkle Tree Certificates (Text)">plain text</a></td>
-        <td>same as main</td>
+        <td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.txt&amp;url_2=https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs-08/draft-davidben-tls-merkle-tree-certs.txt" class="diff draft-davidben-tls-merkle-tree-certs">diff with main</a></td>
       </tr>
     </table>
     <h2>Preview for branch <a href="unify-consistency">unify-consistency</a></h2>