Skip to content

Commit

Permalink
Fix broken links in "Transparency Logs: A Verifiable Transport Layer"…
Browse files Browse the repository at this point in the history
… article (#45)
  • Loading branch information
roger2hk authored Dec 7, 2023
1 parent 7ab6d6c commit dc4762a
Showing 1 changed file with 2 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ show_side_bar: true
author: "Martin Hutchinson"
---

Transparency logs are a powerful tool for storing information and presenting it to all users in such a way that they can all verify they see the same entries. Originally deployed for Certificate Transparency over a decade ago, logs are now being used to provide tamper evidence for other ecosystems such as [binary transparency](https://security.googleblog.com/2023/08/pixel-binary-transparency-verifiable.html) and [AI model transparency](https://security.googleblog.com/2023/10/increasing-transparency-in-ai-security.html?m=1). When a transparency log is used correctly in a tight feedback loop it allows for timely detection and response to malfeasance, forming an important part of security response to protect users.
Transparency logs are a powerful tool for storing information and presenting it to all users in such a way that they can all verify they see the same entries. Originally deployed for Certificate Transparency over a decade ago, logs are now being used to provide tamper evidence for other ecosystems such as [binary transparency](https://security.googleblog.com/2023/08/pixel-binary-transparency-verifiable.html) and [AI model transparency](https://security.googleblog.com/2023/10/increasing-transparency-in-ai-security.html). When a transparency log is used correctly in a tight feedback loop it allows for timely detection and response to malfeasance, forming an important part of security response to protect users.

This article looks at what it means to verify a log. Readers familiar with verifiable logs probably have an idea about what “verifying a log” means, which is likely one of the following:

Expand All @@ -21,7 +21,7 @@ Note that the paragraph above delineates these checks into two subgroups:
* Checks 1-3 verify that the log operator is behaving correctly
* Check 4 verifies that the entries in the log are safe to rely on and aren’t evidence of malicious activity

Checking for correct log operation is a well beaten path at this point; libraries for verifying inclusion and consistency are available at [github.com/transparency-dev/merkle](https://github.com/transparency-dev/merkle), and witnessing libraries are available at [github.com/transparency-dev/witness](github.com/transparency-dev/witness). This verification is standard across all logs that use the [standard checkpoint format](github.com/transparency-dev/formats).
Checking for correct log operation is a well beaten path at this point; libraries for verifying inclusion and consistency are available at [github.com/transparency-dev/merkle](https://github.com/transparency-dev/merkle), and witnessing libraries are available at [github.com/transparency-dev/witness](https://github.com/transparency-dev/witness). This verification is standard across all logs that use the [standard checkpoint format](https://github.com/transparency-dev/formats).

The rest of the article will discuss the remaining verification check: looking for evidence of malfeasance stored in the log. This check is arguably the most important, and is the primary motivation for introducing transparency logs: "sunlight is the best disinfectant" after all. Once a log has integrated an entry, an appropriate party must verify the contents of that entry in a timely manner. This verification must go beyond checking the cryptographic log proofs because an entry being present in a log _does not mean that this entry is good_. Lies can also be recorded in logs. Prompt verification of log entries allows such lies to be detected and corrective action taken, ideally before harm is caused.

Expand Down

0 comments on commit dc4762a

Please sign in to comment.