2

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow?

I'm thinking the answer to this is no, but I'm not certain.

The only way I see that it could work is if the issued certificates themselves somehow are linked via hashes or something, but as far as I can tell that's not case.

(The log entries are linked via the Merkel hash tree, but that just stops the Logs from being manipulated)

1
  • Also they could make many trees and only show one to different actors, if they can 1) tell actors appart 2) make sure actors don't exchange info
    – curiousguy
    Oct 5 '19 at 4:18
1

It would not be noticed if a certificate is just issued. It would be noticed though if the certificate gets used in practice since the validation against the CT log will fail (it is not in there). And it will notice if there is no CT information in the certificate even though it is required for the CA.

For more see How will Certificate Transparency be enforced?

1
  • 1
    yes, once the certificate leaks to wild, it will be noticed, because fails CT validation. And CAs are risking with their reputation if they issue such certificates in the wild.
    – Crypt32
    Jul 4 '19 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.