Include the SPKI algorithm in log entries - #186
Conversation
While this makes log entries bigger, the modern tlog-based API compresses runs of 256 entries together, so they should gzip fairly well. Including the algorithm can allow folks to more easily monitor the status of an algorithm transition, and flag some misconfigurations. For example, a PQ-incapable server might ask both a classical and PQ CA to sign its classical key. But a PQ-capable server should ask a classical CA to sign the classical key and a PQ CA to sign its PQ key. Closes #76
bwesterb
left a comment
bwesterb
left a comment
There was a problem hiding this comment.
Should we mention algorithm in this line?
When hashing
subjectPublicKeyInfo, either hash the observed BER encoding, or reparse the structure with a conforming DER parser and fail verification if invalid.
| The TBSCertificate's `serialNumber` MUST contain the zero-based index of the TBSCertificateLogEntry in the log. {{Section 4.1.2.2 of !RFC5280}} forbids zero as a serial number, but {{log-entries}} defines a `null_entry` type for use in entry zero, so the index will be positive. This encoding is intended to avoid implementation errors by having the serial numbers and indices off by one. | ||
|
|
||
| The TBSCertificate's `subjectPublicKeyInfo` contains the specified public key. Its hash MUST match the TBSCertificateLogEntry's `subjectPublicKeyInfoHash`. | ||
| The TBSCertificate's `subjectPublicKeyInfo` contains the specified public key. Its `algorithm` field MUST match the TBSCertificateLogEntry's `subjectPublicKeyAlgorithm`. Its hash MUST match the TBSCertificateLogEntry's `subjectPublicKeyInfoHash`. |
There was a problem hiding this comment.
subjectPublicKeyAlgorithm ≠ subjectPublicKeyInfoAlgorithm
There was a problem hiding this comment.
Whoops. Made the rest of them match subjectPublicKeyAlgorithm. Not sure if the "info" is doing anything here and subjectPublicKeyAlgorithm is shorter.
I think it's okay without? This bit is talking about non-malleability. It is both necessary and sufficient to capture the SPKI encoding in the hash. At that point, you've already locked in the SPKI encoding and having the algorithm elsewhere doesn't matter. |
3 participants
While this makes log entries bigger, the modern tlog-based API compresses runs of 256 entries together, so they should gzip fairly well.
Including the algorithm can allow folks to more easily monitor the status of an algorithm transition, and flag some misconfigurations. For example, a PQ-incapable server might ask both a classical and PQ CA to sign its classical key. But a PQ-capable server should ask a classical CA to sign the classical key and a PQ CA to sign its PQ key.
Closes #76