Outdated CT policy implementation
Closed this issue · 1 comments
The CT policy of google chrome is different from the CT policy implemented in this library.
The google chrome CT policy is found here: https://github.com/GoogleChrome/CertificateTransparency/blob/master/ct_policy.md
This library follows the policy defined by google chrome (CTInterceptorBuilder.kt line 67: Default: [CTPolicy] which follows rules of https://github.com/chromium/ct-policy/blob/master/ct_policy.md; this link now redirects to the url above), so it might be wise to update the CT policy in this library.
The biggest difference is that the number of distinct SCT logs only differs between 2 and 3 (still based on lifetime of the certificate) for certificates issued on-or-after 15 april 2022.
Also some new constraints regarding the state of the logservers is introduced which could be (partly) included in this library as well.
Will have a PR up shortly to at least sort out the number of required SCTs. We don't currently implement any of the diversity rules although this is probably something that should be added too.
One of the other main missing constraints is around the newly introduced previousOperators entry in the v3 log list for the times when log servers change - this sits outside of the DefaultPolicy class as part of determining the validity of an SCT