trillian/ctfe: Prevent STH being used for fingerprinting users about certificate-transparency-go HOT 8 CLOSED

There are other potential solutions too:
e.g. a deterministic function which looks at each Trillian STH, and determines whether it should be promoted to a CT STH (noddy example: TrillianSTH.RootHash%n == 0) - this should result in tuneably fewer STHs being emitted by the Log. And since the function is deterministic, each CTFE would naturally promote the same selection of Trillian STHs without requiring any form of coordination. (I can see a few wrinkles in here, but it's an avenue of thought at least.)

from certificate-transparency-go.

from certificate-transparency-go.

So I guess there are two factors that make STHs more individually identifiable for Trillian than for previous log implementations:
a) The Trillian logsigner runs very frequently, and so issues STH more frequently & with finer granularity (i.e. smaller gap in tree size between one STH and the next).
b) The CTFE re-signs every time it is asked for an STH.

An initial pair of simplistic things to do might be to:
a) Increase the --sequencer_interval for the logsigner to something larger (5m?)
b) Have each CTFE instance locally cache the last-sth signature, and re-use the signature if the Trillian backend returns the same log root as previously.

Those are both easy to do, but are they enough to reduce the fingerprinting concerns?

from certificate-transparency-go.

Simple-thing-do-to-(a) will only work if there are fewer than batch_size certs coming along within whatever value you set --sequencer_interval to, I think. In the case where there's more work to do that can be done in one batch, the sequencer should be busy looping until it's cleared the backlog, and that'll produce a series of Trillian STHs in quick succession.

from certificate-transparency-go.

Do we think the STH cache is enough for the moment or should we do more?

from certificate-transparency-go.

@rolandshoemaker running through our backlog. Per Martin's comment, is the STH cache sufficient? Thanks!

from certificate-transparency-go.

Seems like a reasonable solution to me.

from certificate-transparency-go.

Closing. Will re-open if STH cache becomes insufficient.

from certificate-transparency-go.