Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ provided in the respective directories:
The [`log checkpoint`](./log/README.md#checkpoint-format) represents a commitment to the
state of a transparent log.

### RFC 6962 / Certificate Transparency Interoperability

For interoperability with classic RFC 6962 logs, the [`note`](./note) package provides tools to convert Signed Tree Heads (STHs) to the checkpoint format and verify their signatures. See [`note_rfc6962.go`](./note/note_rfc6962.go) for details.

## Support
* Mailing list: https://groups.google.com/forum/#!forum/trillian-transparency
- Slack: https://transparency-dev.slack.com/ ([invitation](https://transparency.dev/slack/))
8 changes: 8 additions & 0 deletions log/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,14 @@ If you plan to use `otherdata` in your log, see the section on [merging checkpoi
The first signature on a checkpoint should be from the log which issued it, but there MUST NOT
be more than one signature from a log identity present on the checkpoint.

## RFC 6962 (Certificate Transparency) Interoperability

If you need to work with classic RFC 6962 CT logs, you can convert their JSON Signed Tree Heads (STHs) to this checkpoint format.

The conversion and verification tools are located in the [`note`](../note) package:
* [`note.RFC6962STHToCheckpoint`](../note/note_rfc6962.go) converts an STH to a signed checkpoint.
* [`note.NewRFC6962Verifier`](../note/note_rfc6962.go) creates a verifier for these checkpoint signatures.

## Example

An annotated example signed checkpoint in this format is shown below:
Expand Down
3 changes: 3 additions & 0 deletions log/checkpoint.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@

// Package log provides basic support for the common log checkpoint and proof
// format described by the README in this directory.
//
// For converting classic RFC 6962 Signed Tree Heads (STH) to this checkpoint
// format, see note.RFC6962STHToCheckpoint in the github.com/transparency-dev/formats/note package.
package log

import (
Expand Down
8 changes: 4 additions & 4 deletions note/note_rfc6962.go
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func RFC6962VerifierString(logURL string, pubK crypto.PublicKey) (string, error)
return fmt.Sprintf("%s+%08x+%s", name, hash, base64.StdEncoding.EncodeToString(append([]byte{algRFC6962STH}, pubSer...))), nil
}

// NewRFC6962Verifier creates a note verifier for Sunlight/RFC6962 checkpoint signatures.
// NewRFC6962Verifier creates a note verifier for Static CT/RFC6962 checkpoint signatures.
func NewRFC6962Verifier(vkey string) (note.Verifier, error) {
name, vkey, _ := strings.Cut(vkey, "+")
hash16, key64, _ := strings.Cut(vkey, "+")
Expand Down Expand Up @@ -90,7 +90,7 @@ type signedTreeHead struct {
}

// RFC6962STHToCheckpoint converts the provided RFC6962 JSON representation of a CT Signed Tree Head structure to
// a sunlight style signed checkpoint.
// a Static CT style signed checkpoint.
// The passed in verifier must be an RFC6929Verifier containing the correct details for the log which signed the STH.
func RFC6962STHToCheckpoint(j []byte, v note.Verifier) ([]byte, error) {
var sth signedTreeHead
Expand Down Expand Up @@ -134,11 +134,11 @@ func rfc6962Keyhash(name string, logID [32]byte) uint32 {
return binary.BigEndian.Uint32(r)
}

// rfc6962LogName returns a sunlight checkpoint compatible log name from the
// rfc6962LogName returns a Static CT checkpoint compatible log name from the
// passed in CT log root URL.
//
// "For example, a log with submission prefix https://rome.ct.example.com/2024h1/ will use rome.ct.example.com/2024h1 as the checkpoint origin line"
// (see https://github.com/C2SP/C2SP/blob/main/sunlight.md#checkpoints)
// (see https://github.com/C2SP/C2SP/blob/main/static-ct-api.md#checkpoints)
func rfc6962LogName(logURL string) string {
logURL = strings.ToLower(logURL)
logURL = strings.TrimPrefix(logURL, "http://")
Expand Down
2 changes: 1 addition & 1 deletion note/note_verifier_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ func TestNewVerifier(t *testing.T) {
name: "ECDSA works",
key: sigStoreKey,
}, {
name: "Sunlight works",
name: "Static CT works",
key: "ct.googleapis.com/logs/us1/argon2024+7deb49d0+BTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB25bKnLaZTFXOa2pgO70rjcVEMXKJkMBgFQHZ1kwFlGK9zIAx0FtC2oCfeZQe0E++VXuiYE9hFSzhRlOy92K8A=",
},
} {
Expand Down
Loading