{"action":"created","comment":{"url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments/56808909","id":56808909,"diff_hunk":"@@ -1153,10 +1153,13 @@ entry specified by <spanx style=\"verb\">start</spanx>.\n     </section>\n     <section title=\"TLS Servers\" anchor=\"tls_servers\">\n       <t>\n-        TLS servers MUST use at least one of the three mechanisms listed below to present one or more SCTs or inclusion proofs from one or more logs to each TLS client during TLS handshakes, where each SCT or inclusion proof corresponds to the server certificate or to a name-constrained intermediate the server certificate chains to. Three mechanisms are provided because they have different tradeoffs.\n+        TLS servers MUST use at least one of the three mechanisms listed below to present one or more SCTs from one or more logs to each TLS client during TLS handshakes, where each SCT corresponds to the server certificate or to a name-constrained intermediate the server certificate chains to. TLS servers MAY present relevant inclusion proofs together with Signed Tree Heads(<spanx style=\"verb\">TransItem</spanx> of types <spanx style=\"verb\">inclusion_proof</spanx> or <spanx style=\"verb\">signed_tree_head</spanx>) in addition to the SCTs. When presented, the inclusion proof SHOULD be for computing the root in the accompanying Signed Tree Head.","path":"rfc6962-bis.xml","position":5,"original_position":5,"commit_id":"e696b2417d1584a779caeb70e0895b4798b1f0ae","original_commit_id":"e696b2417d1584a779caeb70e0895b4798b1f0ae","user":{"login":"benlaurie","id":40044,"avatar_url":"https://avatars.githubusercontent.com/u/40044?v=3","gravatar_id":"","url":"https://api.github.com/users/benlaurie","html_url":"https://github.com/benlaurie","followers_url":"https://api.github.com/users/benlaurie/followers","following_url":"https://api.github.com/users/benlaurie/following{/other_user}","gists_url":"https://api.github.com/users/benlaurie/gists{/gist_id}","starred_url":"https://api.github.com/users/benlaurie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benlaurie/subscriptions","organizations_url":"https://api.github.com/users/benlaurie/orgs","repos_url":"https://api.github.com/users/benlaurie/repos","events_url":"https://api.github.com/users/benlaurie/events{/privacy}","received_events_url":"https://api.github.com/users/benlaurie/received_events","type":"User","site_admin":false},"body":"Let's make it SHOULD, not MAY. And also say that it SHOULD use a recent STH. And that the STH MUST correspond to the inclusion proof.\r\n\r\nAnd maybe say why a server would do this (to increase client privacy and reduce log load).","created_at":"2016-03-21T11:32:11Z","updated_at":"2016-03-21T11:32:11Z","html_url":"https://github.com/google/certificate-transparency-rfcs/pull/142#discussion_r56808909","pull_request_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142","_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments/56808909"},"html":{"href":"https://github.com/google/certificate-transparency-rfcs/pull/142#discussion_r56808909"},"pull_request":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142"}}},"pull_request":{"url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142","id":63378199,"html_url":"https://github.com/google/certificate-transparency-rfcs/pull/142","diff_url":"https://github.com/google/certificate-transparency-rfcs/pull/142.diff","patch_url":"https://github.com/google/certificate-transparency-rfcs/pull/142.patch","issue_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/142","number":142,"state":"open","locked":false,"title":"Ticket 156: Requiring SCTs in addition to inclusion proofs","user":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"body":"…proofs.\r\n\r\nThe gist of the reasoning is that without the timestamp and extensions fields\r\nfrom the SCT, it is not possible to calculate the leaf hash that would\r\nbe used together with the rest of the nodes from the inclusion proof to\r\ncalculate the root hash.\r\n\r\nTo make implementation of clients simpler (i.e. clients would only need\r\nto check signatures from SCTs rather than having to check them over STHs\r\nas well and implement inclusion checking) this PR suggests mandating\r\npresence of SCTs, while pointing out the benefit of supplying both\r\nSCT and inclusion proof.","created_at":"2016-03-18T14:02:39Z","updated_at":"2016-03-21T11:32:11Z","closed_at":null,"merged_at":null,"merge_commit_sha":"11c7f18c50b19273d9edeb519788d6cfe5135ee2","assignee":{"login":"robstradling","id":958624,"avatar_url":"https://avatars.githubusercontent.com/u/958624?v=3","gravatar_id":"","url":"https://api.github.com/users/robstradling","html_url":"https://github.com/robstradling","followers_url":"https://api.github.com/users/robstradling/followers","following_url":"https://api.github.com/users/robstradling/following{/other_user}","gists_url":"https://api.github.com/users/robstradling/gists{/gist_id}","starred_url":"https://api.github.com/users/robstradling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robstradling/subscriptions","organizations_url":"https://api.github.com/users/robstradling/orgs","repos_url":"https://api.github.com/users/robstradling/repos","events_url":"https://api.github.com/users/robstradling/events{/privacy}","received_events_url":"https://api.github.com/users/robstradling/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142/commits","review_comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142/comments","review_comment_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/142/comments","statuses_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/e696b2417d1584a779caeb70e0895b4798b1f0ae","head":{"label":"eranmes:ticket_156_inclusion_proof_optional","ref":"ticket_156_inclusion_proof_optional","sha":"e696b2417d1584a779caeb70e0895b4798b1f0ae","user":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"repo":{"id":21980702,"name":"certificate-transparency-rfcs","full_name":"eranmes/certificate-transparency-rfcs","owner":{"login":"eranmes","id":1072163,"avatar_url":"https://avatars.githubusercontent.com/u/1072163?v=3","gravatar_id":"","url":"https://api.github.com/users/eranmes","html_url":"https://github.com/eranmes","followers_url":"https://api.github.com/users/eranmes/followers","following_url":"https://api.github.com/users/eranmes/following{/other_user}","gists_url":"https://api.github.com/users/eranmes/gists{/gist_id}","starred_url":"https://api.github.com/users/eranmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eranmes/subscriptions","organizations_url":"https://api.github.com/users/eranmes/orgs","repos_url":"https://api.github.com/users/eranmes/repos","events_url":"https://api.github.com/users/eranmes/events{/privacy}","received_events_url":"https://api.github.com/users/eranmes/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/eranmes/certificate-transparency-rfcs","description":"Certificate Transparency RFC","fork":true,"url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs","forks_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/forks","keys_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/teams","hooks_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/hooks","issue_events_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/events","assignees_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/tags","blobs_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/languages","stargazers_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/stargazers","contributors_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/contributors","subscribers_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/subscribers","subscription_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/subscription","commits_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/merges","archive_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/downloads","issues_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/labels{/name}","releases_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/eranmes/certificate-transparency-rfcs/deployments","created_at":"2014-07-18T13:12:17Z","updated_at":"2016-01-28T10:47:56Z","pushed_at":"2016-03-18T14:13:29Z","git_url":"git://github.com/eranmes/certificate-transparency-rfcs.git","ssh_url":"git@github.com:eranmes/certificate-transparency-rfcs.git","clone_url":"https://github.com/eranmes/certificate-transparency-rfcs.git","svn_url":"https://github.com/eranmes/certificate-transparency-rfcs","homepage":"http://www.certificate-transparency.org/","size":1641,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"google:master","ref":"master","sha":"00b8bf705b570c8912dba024be96c161a3d6371c","user":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"repo":{"id":20069953,"name":"certificate-transparency-rfcs","full_name":"google/certificate-transparency-rfcs","owner":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/google/certificate-transparency-rfcs","description":"Certificate Transparency RFC","fork":false,"url":"https://api.github.com/repos/google/certificate-transparency-rfcs","forks_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/forks","keys_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/teams","hooks_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/hooks","issue_events_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/events","assignees_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/tags","blobs_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/languages","stargazers_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/stargazers","contributors_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/contributors","subscribers_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/subscribers","subscription_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/subscription","commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/merges","archive_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/downloads","issues_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/labels{/name}","releases_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/google/certificate-transparency-rfcs/deployments","created_at":"2014-05-22T17:15:59Z","updated_at":"2016-03-17T15:19:47Z","pushed_at":"2016-03-21T11:23:17Z","git_url":"git://github.com/google/certificate-transparency-rfcs.git","ssh_url":"git@github.com:google/certificate-transparency-rfcs.git","clone_url":"https://github.com/google/certificate-transparency-rfcs.git","svn_url":"https://github.com/google/certificate-transparency-rfcs","homepage":"http://www.certificate-transparency.org/","size":1511,"stargazers_count":36,"watchers_count":36,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":14,"mirror_url":null,"open_issues_count":2,"forks":14,"open_issues":2,"watchers":36,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142"},"html":{"href":"https://github.com/google/certificate-transparency-rfcs/pull/142"},"issue":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/142"},"comments":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/issues/142/comments"},"review_comments":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142/comments"},"review_comment":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/pulls/142/commits"},"statuses":{"href":"https://api.github.com/repos/google/certificate-transparency-rfcs/statuses/e696b2417d1584a779caeb70e0895b4798b1f0ae"}}}}