Sunlight, a Certificate Transparency log implementation (letsencrypt.org)

Article summary

Let's Encrypt has introduced Sunlight, a new implementation of a Certificate Transparency log designed for scalability, ease of operation, and reduced cost. The current Certificate Transparency log implementation, Oak, faces challenges with growing volumes of certificates, and Sunlight aims to address these issues. Sunlight uses a tile-based system for storing and serving log data, which allows for more efficient caching and reduced storage costs. This new implementation is expected to improve the robustness and diversity of the CT ecosystem.

Main themes

• Certificate Transparency
• Scalability and performance
• Log implementation
• Security and trust
• Blockchain comparison

What commenters say

• Transparency logs are more suitable for certain use cases than blockchains due to their ability to provide trivial discoverability and smaller inclusion and consistency proofs.
• The TLS ecosystem, despite its limitations, provides unparalleled security benefits to the majority of people, and efforts like Sunlight are crucial for its improvement.
• Some argue that SSH provides stronger security guarantees than X.509 certificates, but this view is contested, with others pointing out the limitations of trust-on-first-use and the impracticality of verifying key fingerprints for every website.
• The introduction of Sunlight may lead to an increase in the number of log operators, as the reduced cost of log operation makes it more accessible to a wider range of entities.
• There is a need for a specification to implement verifiers for certificate transparency logs, and efforts are underway to provide test vectors and improve the ecosystem.
• Some commentators believe that channel binding, which allows for secure verification of certificates independent of third-party attestation, could be a valuable addition to the web ecosystem, but its applicability is limited to certain use cases.
• The comparison between transparency logs and blockchains highlights differences in trust assumptions and censorship resistance, with transparency logs being seen as more suitable for certain applications.
• The development of Sunlight and its potential impact on the CT ecosystem is seen as a positive step forward, but some commentators express concerns about the limitations and potential vulnerabilities of the current system.