Compare commits

..

2 Commits

Author SHA256 Message Date
28edc9e99f V1.00.128.2025.06.03
All checks were successful
Render RFCXML to PDF. / Render RFCXML to PDF. (push) Successful in 1m8s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-06-03 19:53:06 +02:00
5ba1fa34ff V1.00.128.2025.06.03
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-06-03 19:47:44 +02:00

View File

@@ -32,6 +32,10 @@
<organization>Centurion Intelligence Consulting Agency
</organization>
<address>
<postal>
<city>Lisboa</city>
<country>PT</country>
</postal>
<phone>+1 (202) 992 1702</phone>
<email>rfc.editor@coresecret.eu</email>
<uri>https://coresecret.eu/</uri>
@@ -137,8 +141,8 @@
<section>
<name>CATALOG approach</name>
<t>Currently, there is no standardized, discoverable mechanism in DNS for a domain owner to declare, which
Certificate Transparency (CT) Logs must or may record its Certificates.
As a result, CAs rely on out-of-band configurations or hard-coded lists,
Certificate Transparency (CT) Logs must or may record its Certificates. As a result, CAs rely on
out-of-band configurations or hard-coded lists,
increasing operational complexity and expanding the attack surface.
</t>
<section>
@@ -1247,10 +1251,10 @@ https://caa-ct-sts.<domain>.<tld>/.well-known/caa-ct-sts.txt
</t>
</section>
<section anchor="redundancy">
<name>Policy Redundancy Considerations |𝑪| ≥ 𝑛 + 1 ∧ |𝑾| ≤ 2</name>
<t>Let 𝐶 be the number of critical CT-Logs and 𝑊 be the number of whitelisted (non-critical) CT-Logs,
<name>Policy Redundancy Considerations</name>
<t>Let c be the number of critical CT-Logs and w be the number of whitelisted (non-critical) CT-Logs,
then the following expression is strongly <strong>RECOMMENDED</strong>:
|𝑪| ≥ 𝑛 + 1 ∧ |𝑾| ≤ 2
|c| ≥ n + 1 ∧ |w| ≤ 2
</t>
<t>While the "critical=true" flag in the CAA <strong>"issuect"</strong> Parameter enforces that every
Certificate issuance must be logged to all specified CT-Logs, this strict requirement can introduce
@@ -2061,7 +2065,7 @@ echo "${JSON}" | awk -v OWN="${OWN_DOMAIN}" -v CA="${CAA_DOMAIN}" -v CRIT="${CRI
improved the technical clarity and robustness of this draft. Their objective and insightful feedback has been
invaluable in refining the specification.
</t>
<contact fullname="André Horst Zimnol" initials="A. H."
<contact fullname="Andre Horst Zimnol" initials="A. H."
surname="Zimnol">
<organization>Private Contributor</organization>
<address>