Certificate Transparency: Collect metrics on age of SCT vs STH

tools/metrics/histograms/histograms.xml

Index: tools/metrics/histograms/histograms.xml
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 297bd54f7a948120210ab76bb17abc9a899c2440..57c3ba7029f7acad08a50e5221a59421cef1730f 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -26569,6 +26569,18 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   </summary>
 </histogram>
 
+<histogram name="Net.CertificateTransparency.CanInclusionCheckSCT"
+    enum="BooleanSCTCanBeChecked">
+  <owner>eranm@chromium.org</owner>
+  <summary>
+    Whether an observed Signed Certificate Timestamp (SCT) is covered by the
+    Signed Tree Head (STH) currently known to this client, meaning the timestamp
+    from the SCT is less than the timestamp from the STH + the log's Maximum
+    Merge Delay (24 hours). In that case it can be checked for inclusion
+    immediately without waiting for a new STH.

[Ryan Sleevi, 2016/07/20 20:34:00]

Grammatically, this reads rather weird as a description. In particular, the "in
that case" combined with the previous sentence feels fairly ambiguous.

For example, it seems based on how you're actually using it, that this is
something like:

When a Signed Certificate Timestamp (SCT) is observed, measures whether the SCT
can be
checked against the Signed Tree Head (STH) currently known to the client. An SCT
can
be checked against an STH if the STH's timestamp is at least 24 hours (the log's
Maximum Merge Delay) newer than the SCT.

Is this correct?

+  </summary>
+</histogram>
+
 <histogram name="Net.CertificateTransparency.MainFrameValidSCTCount">
   <owner>eranm@chromium.org</owner>
   <summary>
@@ -67826,6 +67838,11 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   <int value="1" label="Revoked"/>
 </enum>
 
+<enum name="BooleanSCTCanBeChecked" type="int">
+  <int value="0" label="Requires newer STH"/>
+  <int value="1" label="Can be checked for inclusion"/>
+</enum>
+
 <enum name="BooleanSecure" type="int">
   <int value="0" label="Insecure"/>
   <int value="1" label="Secure"/>