1926414 - Add an option to make CRLite coverage checks more strict

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P3)

Description

[John Schanck [:jschanck]]

A certificate is considered to be "covered" by a CRLite filter when it is presented with at least one SCT that attests to its inclusion in a portion of a CT log that was ingested by the CRLite backend. When a log experiences an MMD violation, it is possible that

1. there is a certificate C with an SCT from that log at time T,
2. the CRLite backend believes it has seen all certificates in that log with timestamps < T' - MMD for some T' > T + MMD.
3. C is not in the log at time T'.

This can cause a CRLite client to mistakenly view C as revoked. We currently mitigate this by double-checking "revoked" results against OCSP.

Eventually the CT ecosystem will transition to sunlight logs, SCTs will include the leaf-index extension, and CRLite coverage checks will not depend on the MMD. Until then, we might consider stricter notions of coverage that require two or more timestamps from different logs.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1926414 - add a pref to make CRLite coverage checks more strict. r=keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5a6e5a234f11
add a pref to make CRLite coverage checks more strict. r=keeler

Comment 3

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/5a6e5a234f11