1

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency logs.

Let's take Google Chrome as an example, as Google seems to be a key proponent of CT. How does Chrome check if the certificate presented by the web server is present in the CT logs?

Does it actually make a request to CT logs to verify this (I doubt this as it will add latency to the TLS handshake proces)?

Improve this question

1 Answer 1

Reset to default
2

The browser generally requires the website to provide an SCT (Signed Certificate Timestamp) signed by the logs which have logged the certificate. This means that while the browser may not immediately verify that the certificate has actually been logged, they still have a promise from multiple log operators that the certificate has been logged. Given chrome's CT compliance policy, it would require the cooperation of at least three rogue entities (one CA and two log operators). While this is not completely ideal, it is significantly better than the previous approach of having a single point of failure.

Not all browsers perform SCT auditing as this becomes a significant privacy. However, chrome implements opt-in SCT auditing where the browsers sends the SCTs it receives to google, which then checks if the certificates have actually been logged.

Improve this answer
3
  • What is the context of the "SCT auditing" document you shared? It seems to describe an update to Chrome's behavior regarding verifying SCT's, but it is unclear to me if this is a current document describing a future update or a old document describing behavior that is now default. But the document seems to imply that Chrome does an offline lookup of the SCT in a Merkle tree and only when the SCT is unknown, it get sent to Googel for verification. Would you agree to that? So apparently Merkle trees for all certs in the world are so limited in size they can be included in the program files?
    – JazZeus
    Mar 1, 2022 at 14:14
  • @JazZeus Ah, interesting, I didn't realize I was linking to the design doc for phase 2. As far as I can tell, it hasn't been rolled out yet. The design doc for the current version is: docs.google.com/document/d/…
    – nobody
    Mar 1, 2022 at 15:13
  • @JazZeus As for what is described in the phase 2 doc, I think you got it slightly wrong. The merkle tree is not stored on the client, rather it is stored on Google's servers. The client queries the server to determine if an SCT is known, but it does not send the entire SCT to Google. Instead it sends the first few bits of a hash corresponding to the SCT. Google will then return all known hash values that have the same prefix, and they will be compared the to the full hash on the client-side. This process is known as k-anonymity.
    – nobody
    Mar 1, 2022 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .