<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Many DV suppliers already operate in an automated fashion. Do they ever look at the issued certificates? I’m not sure how an automated system will increase risks over the current practices. If there was a requirement that each certificate be reviewed manually, then I would agree with you. This is not the case.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Jeremy<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> management-bounces@cabforum.org [mailto:management-bounces@cabforum.org] <b>On Behalf Of </b>Eddy Nigg (StartCom Ltd.)<br><b>Sent:</b> Friday, July 27, 2012 12:47 PM<br><b>To:</b> public@cabforum.org<br><b>Cc:</b> management@cabforum.org<br><b>Subject:</b> Re: [cabfman] [cabfpub] Short Lived Certificates<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><br>On 07/27/2012 09:36 PM, From <a href="mailto:kirk_hall@trendmicro.com:">kirk_hall@trendmicro.com:</a> <o:p></o:p></p><p class=MsoNormal>Jeremy, even if an attacker could cache and supply a previously good response (clearly a problem) – wouldn’t that be the rare case? <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>More likely a short lived cert might be revoked soon after issuance because of a key compromise, etc. – in those cases, quick revocation with required OCSP responses would, in fact, deliver correct revocation information (“revoked”) to the vast majority of relying parties (as no attacker would be devilishly supplying cached but incorrect good responses to relying parties in those cases).<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br>We have been through this discussion already a few times and one of the clear risks involved that nobody seems to consider right now is the necessity to issue new certificates on a regular basis (turn-over) very frequently and most likely in an automated fashion. Those certificates will also have to be installed in a similar (automated) manner. There are risks when doing so and removes the ability to closely monitor issuance and review of the certificates or at least it makes it a lot harder, being it at the CA or at the subscriber side. Assuming that every week a bunch of those certificates have be pushed out, with increasing numbers the risk grows exceptionally.<br><br>A CA that issues tens or hundred of thousands of certificates per year would have to issue the same amount of certificates times 52. I can't see how any due diligence can be done here. And done tell me that the issuing systems are all secured beyond any doubt that no human intervention and monitoring is necessary.<o:p></o:p></span></p><div><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Regards <o:p></o:p></span></p></td></tr><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Signer: <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Eddy Nigg, COO/CTO<o:p></o:p></span></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><a href="http://www.startcom.org">StartCom Ltd.</a><o:p></o:p></span></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>XMPP: <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a><o:p></o:p></span></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Blog: <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><a href="http://blog.startcom.org">Join the Revolution!</a><o:p></o:p></span></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Twitter: <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><a href="http://twitter.com/eddy_nigg">Follow Me</a><o:p></o:p></span></p></td></tr><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p></td></tr></table></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></body></html>