<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-size:11pt; font-family:Calibri,sans-serif">I understand the intent of the requirement and I think the idea is logically sound.<br>
<br>
As Tom said, the problem is that the requirement does not protect from attackers that are able to use the same serial number as unexpired certificates. When you factor in the requirement for CAs to instaneously update the OCSP server, or make the CA database
accessible to the OCSP server, we have to make a security trade off.<br>
<br>
The lesson I learned from the Diginotar incident is that network compromises is fact and I believe it is more important to reduce the risk of compromising a CA server by making it as easy as possible to limit the network exposure, than requiring a specific
mitigation.<br>
<br>
Kelvin<br>
<br>
Sent from Windows Phone 8</div>
</div>
<div dir="ltr">
<hr>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">From:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:yngve@spec-work.net">Yngve N. Pettersen</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Sent:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">ý7/ý19/ý2013 12:36 PM</span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">To:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:public@cabforum.org">public@cabforum.org</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Subject:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">Re: [cabfpub] August 1st Deadline for No "Good" Reponse to Non-Issued Certificate</span><br>
<br>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText"><br>
Kelvin, the requirement is there to prevent a CA from responding "this <br>
certificate is not revoked" for a certificate that the CA in question have <br>
absolutely no idea *exists*. The worst possible reason for such a query to <br>
be received is that the CA's issuing system have been compromised, and the <br>
attacker removed all traces of the certificate having been issued, which <br>
is what happened during the DigiNotar incident.<br>
<br>
Changing this into a recommendation would mean that browsers would never <br>
be able to reliably determine that a certificate exists and is not <br>
revoked, and there would be no way to prevent a repetition of the <br>
DigiNotar incident.<br>
<br>
On Fri, 19 Jul 2013 21:18:14 +0200, Kelvin Yiu <br>
<kelviny@exchange.microsoft.com> wrote:<br>
<br>
> My preference is to change the OCSP behavior into a recommendation <br>
> instead of a requirement with no deadline. The problem with moving the <br>
> deadline to January is that CAs are still under pressure to meet the <br>
> requirement. We need to ensure the new deadline takes into account <br>
> sufficient time to obtain sufficient commercial vendor support and for <br>
> CAs to integrate the new software.<br>
><br>
> We can still work towards resolving the issue according to Ben’s <br>
> proposed timeline, but January 2014 is just too soon to be practical.<br>
><br>
> Kelvin<br>
><br>
> From: public-bounces@cabforum.org [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<br>
> On Behalf Of Eddy Nigg (StartCom Ltd.)<br>
> Sent: Friday, July 19, 2013 9:48 AM<br>
> To: public@cabforum.org<br>
> Subject: Re: [cabfpub] August 1st Deadline for No "Good" Reponse to <br>
> Non-Issued Certificate<br>
><br>
><br>
> On 07/19/2013 07:41 PM, From Ben Wilson:<br>
> Should we move the deadline from August 1 to January 1 and request that <br>
> any CA / OCSP software provider with a problem provide us with a <br>
> statement of progress, hurdles to overcome, and/or proposed milestones, <br>
> with a response deadline of October 15 . Then, based on those responses <br>
> received, if any, we determine whether the deadline should be moved out <br>
> further?<br>
> If there is interest in this proposal, then we should create a new <br>
> ballot and we would need a sponsor and two endorsers. Also, to the <br>
> extent that the timing of the review and voting periods would extend <br>
> beyond August 1, we would have to suspend the rules in order for voting <br>
> to be completed before August 1.<br>
><br>
> I would agree with both - e.g. split the ballots into two and the <br>
> January first deadline for OCSP.<br>
><br>
> Regards<br>
><br>
><br>
><br>
> Signer:<br>
><br>
> Eddy Nigg, COO/CTO<br>
><br>
><br>
><br>
> StartCom Ltd.<<a href="http://www.startcom.org">http://www.startcom.org</a>><br>
><br>
> XMPP:<br>
><br>
> startcom@startcom.org<xmpp:startcom@startcom.org><br>
><br>
> Blog:<br>
><br>
> Join the Revolution!<<a href="http://blog.startcom.org">http://blog.startcom.org</a>><br>
><br>
> Twitter:<br>
><br>
> Follow Me<<a href="http://twitter.com/eddy_nigg">http://twitter.com/eddy_nigg</a>><br>
><br>
><br>
><br>
><br>
<br>
<br>
-- <br>
Sincerely,<br>
Yngve N. Pettersen<br>
<br>
Using Opera's mail client: <a href="http://www.opera.com/mail/">http://www.opera.com/mail/</a><br>
_______________________________________________<br>
Public mailing list<br>
Public@cabforum.org<br>
<a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><br>
</div>
</span></font>
</body>
</html>