<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
On 06/14/2013 12:43 PM, From Gervase Markham:
<blockquote cite="mid:51BAE5B8.3070404@mozilla.org" type="cite">
<pre wrap="">These are embedded devices accessing specific servers which are designed
to communicate with them. If this was happening over a private network,
it would clearly be not "Web PKI". Are you saying that any SSL
connection which traverses the public Internet is "Web PKI"?
</pre>
</blockquote>
<br>
If those sites/servers using such certificates are accessed through
the HTTPS protocol they are within the scope of the BR/EV since it
can be accessed with a browser. A compromised key due to its small
size can be very well used for other purpose than the specific
device it's used at that time.<br>
<br>
<blockquote cite="mid:51BAE5B8.3070404@mozilla.org" type="cite">Why
is this situation different from the "issue from the root"
situation, where we have a limited exception for legacy
compatibility?</blockquote>
<br>
Who said that I'm happy with this exception? I'm absolutely not, but
root certificates are much tighter controlled through the browser
and software vendors whereas end user certificates are issued
according to the judgement of the CAs. There is no instance that
weighs in the risk involved.<br>
<br>
Otherwise why should we or anybody else care if various CAs issued
512 bit keys until recently if not the entire PKI eco system would
be at risk? We (and others) decided that 1024 shouldn't be used
anymore as of a certain date in order to prevent a practical
compromise as it happened with 512 keys or MD5 hashes.<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>