Re:Let's Encrypt Has Issued a Billion Certificates
by tgsovlerkhgsel on Friday February 28, 2020 @08:06PM
(#22447906)
The malicious cert would presumably only be used against specific targets, reducing the chance that an auditor gets to see it.
But indeed, an SCT and a later timestamp on the log without having logged the cert would be the cryptographic evidence I talked about.
If a SCT is issued, it has to be logged within a certain amout of time; 3rd party auditors check for this. [1]:
An auditor is a third party that keeps log operators honest. They query logs from various vantage points on the internet and gossip with each other about what order certificates are in. They’re like the paparazzi of the PKI. They also keep track of whether an SCT has been honored or not by measuring the time it took between the SCT’s timestamp and the corresponding certificate showing up in the log.
And only certain logs are trusted anyway [2]; a CT log that doesn't meet certain requirements wouldn't be trusted to begin with. And if a trusted CT log turned evil, it would quickly be noticed.
[1]: https://blog.cloudflare.com/introducing-certificate-transpar...
[2]: https://github.com/chromium/ct-policy/blob/master/log_policy...