{"action":"created","comment":{"url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments/56976682","id":56976682,"diff_hunk":"@@ -1654,13 +1672,12 @@ this can be done.\n Merkle inclusion proof (<xref target=\"get-proof-by-hash\"/>) for each observed SCT.\n These checks can be asynchronous and\n need only be done once per each certificate. In order to protect the clients'\n-privacy, these checks need not reveal the exact certificate to the log. Clients\n-can instead request the proof from a trusted auditor (since anyone can compute\n-the proofs from the log) or request Merkle inclusion proofs for a batch of\n-certificates around the SCT timestamp.\n+privacy, these checks need not reveal the exact certificate to the log. Instead, clients\n+can request the proof from a trusted auditor (since anyone can compute\n+the proofs from the log) or communicate with the log via proxies.\n         </t>\n         <t>\n-          Violation of the append-only property can be detected by clients comparing their instances of the Signed Tree Heads. As soon as two conflicting Signed Tree Heads for the same log are detected, this is cryptographic proof of that log's misbehavior. There are various ways this could be done, for example via gossip (see <xref target=\"I-D.ietf-trans-gossip\"/>) or peer-to-peer communications or by sending STHs to monitors (who could then directly check against their own copy of the relevant log).\n+          Violation of the append-only property or the STH issuance rate limit can be detected by clients comparing their instances of the Signed Tree Heads. There are various ways this could be done, for example via gossip (see <xref target=\"I-D.ietf-trans-gossip\"/>) or peer-to-peer communications or by sending STHs to monitors (who could then directly check against their own copy of the relevant log). A proof of misbehavior in such cases would be a series of STHs that were issued too closely together, proving violation of the STH issuance rate limit, or an STH with a root hash that does not match the one calculated from a copy of the log, proving entries in the logs were changed since that STH was issued.","path":"rfc6962-bis.xml","position":62,"original_position":62,"commit_id":"617fc81ce05ceb72a84c1bb90053721b7d90d918","original_commit_id":"617fc81ce05ceb72a84c1bb90053721b7d90d918","user":{"login":"benlaurie","id":40044,"avatar_url":"https://avatars.githubusercontent.com/u/40044?v=3","gravatar_id":"","url":"https://api.github.com/users/benlaurie","html_url":"https://github.com/benlaurie","followers_url":"https://api.github.com/users/benlaurie/followers","following_url":"https://api.github.com/users/benlaurie/following{/other_user}","gists_url":"https://api.github.com/users/benlaurie/gists{/gist_id}","starred_url":"https://api.github.com/users/benlaurie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benlaurie/subscriptions","organizations_url":"https://api.github.com/users/benlaurie/orgs","repos_url":"https://api.github.com/users/benlaurie/repos","events_url":"https://api.github.com/users/benlaurie/events{/privacy}","received_events_url":"https://api.github.com/users/benlaurie/received_events","type":"User","site_admin":false},"body":"It doesn't prove that the entries were changed _since_ the STH was issued (i.e. it could've been before it was issued, but after the copy was taken). So, I would just say \"proving violation of the append-only property\".\r\n","created_at":"2016-03-22T12:21:36Z","updated_at":"2016-03-22T12:21:36Z","html_url":"https://github.com/google/certificate-transparency-rfcs/pull/141#discussion_r56976682","pull_request_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141","_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments/56976682"},"html":{"href":"https://github.com/google/certificate-transparency-rfcs/pull/141#discussion_r56976682"},"pull_request":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141"}}},"pull_request":{"url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141","id":63360743,"html_url":"https://github.com/google/certificate-transparency-rfcs/pull/141","diff_url":"https://github.com/google/certificate-transparency-rfcs/pull/141.diff","patch_url":"https://github.com/google/certificate-transparency-rfcs/pull/141.patch","issue_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/141","number":141,"state":"open","locked":false,"title":"Ticket 141: Further expand auditing","user":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"body":"Incorporate some of the comments in ticket 141, describing what aspects of log\r\nbehaviour should be audited.\r\nNote that while some are described in the auditing section, others are\r\nin the security considerations section.","created_at":"2016-03-18T11:27:19Z","updated_at":"2016-03-22T12:21:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1e9fabcfa3a237d45f04681fbe1793df92eb45b9","assignee":{"login":"robstradling","id":958624,"avatar_url":"https://avatars.githubusercontent.com/u/958624?v=3","gravatar_id":"","url":"https://api.github.com/users/robstradling","html_url":"https://github.com/robstradling","followers_url":"https://api.github.com/users/robstradling/followers","following_url":"https://api.github.com/users/robstradling/following{/other_user}","gists_url":"https://api.github.com/users/robstradling/gists{/gist_id}","starred_url":"https://api.github.com/users/robstradling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robstradling/subscriptions","organizations_url":"https://api.github.com/users/robstradling/orgs","repos_url":"https://api.github.com/users/robstradling/repos","events_url":"https://api.github.com/users/robstradling/events{/privacy}","received_events_url":"https://api.github.com/users/robstradling/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141/commits","review_comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141/comments","review_comment_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/141/comments","statuses_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/617fc81ce05ceb72a84c1bb90053721b7d90d918","head":{"label":"eranmes:ticket_141_and_134_auditing","ref":"ticket_141_and_134_auditing","sha":"617fc81ce05ceb72a84c1bb90053721b7d90d918","user":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"repo":{"id":21980702,"name":"certificate-transparency-rfcs","full_name":"eranmes/certificate-transparency-rfcs","owner":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/eranmes/certificate-transparency-rfcs","description":"Certificate Transparency RFC","fork":true,"url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs","forks_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/forks","keys_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/teams","hooks_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/hooks","issue_events_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/events","assignees_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/tags","blobs_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/languages","stargazers_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/stargazers","contributors_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/contributors","subscribers_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/subscribers","subscription_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/subscription","commits_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/merges","archive_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/downloads","issues_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/labels{/name}","releases_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/deployments","created_at":"2014-07-18T13:12:17Z","updated_at":"2016-01-28T10:47:56Z","pushed_at":"2016-03-22T11:25:25Z","git_url":"git://github.com/eranmes/certificate-transparency-rfcs.git","ssh_url":"git@github.com:eranmes/certificate-transparency-rfcs.git","clone_url":"https://github.com/eranmes/certificate-transparency-rfcs.git","svn_url":"https://github.com/eranmes/certificate-transparency-rfcs","homepage":"http://www.certificate-transparency.org/","size":1523,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"google:master","ref":"master","sha":"9318ca4c31cf2299e65e43c683de02238575f4c4","user":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"repo":{"id":20069953,"name":"certificate-transparency-rfcs","full_name":"google/certificate-transparency-rfcs","owner":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/google/certificate-transparency-rfcs","description":"Certificate Transparency RFC","fork":false,"url":"https://api.github.com/repos/google/certificate-transparency-rfcs","forks_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/forks","keys_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/teams","hooks_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/hooks","issue_events_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/events","assignees_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/tags","blobs_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/languages","stargazers_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/stargazers","contributors_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/contributors","subscribers_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/subscribers","subscription_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/subscription","commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/merges","archive_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/downloads","issues_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/labels{/name}","releases_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/deployments","created_at":"2014-05-22T17:15:59Z","updated_at":"2016-03-17T15:19:47Z","pushed_at":"2016-03-22T12:05:34Z","git_url":"git://github.com/google/certificate-transparency-rfcs.git","ssh_url":"git@github.com:google/certificate-transparency-rfcs.git","clone_url":"https://github.com/google/certificate-transparency-rfcs.git","svn_url":"https://github.com/google/certificate-transparency-rfcs","homepage":"http://www.certificate-transparency.org/","size":1650,"stargazers_count":36,"watchers_count":36,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":14,"mirror_url":null,"open_issues_count":2,"forks":14,"open_issues":2,"watchers":36,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141"},"html":{"href":"https://github.com/google/certificate-transparency-rfcs/pull/141"},"issue":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/141"},"comments":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/141/comments"},"review_comments":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141/comments"},"review_comment":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/141/commits"},"statuses":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/617fc81ce05ceb72a84c1bb90053721b7d90d918"}}}}