<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Symantec ABSTAINS.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Symantec believes there are strong arguments on both sides of the issue. Although we feel it’s incorrect to return a “good” status for an unknown certificate, full compliance by all CAs would do little to deter a hacker who can choose any serial number for a fake certificate.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Dean Coclin<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Robin Alden<br><b>Sent:</b> Friday, July 26, 2013 2:26 AM<br><b>To:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfpub] Ballot 106 - Extended deadline to prohibit OCSP good response for non-issued certificates<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>Comodo ABSTAINs from voting.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>It is regrettable that this deficiency of OCSP should remain exploitable with responders apparently being used by some CAs almost two years after exactly this same flaw was plugged at DigiNotar as part of the response to the breach there.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>We understand that the BRs should not set unattainable standards, but feel that more rapid progress should be made.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>We would vote in favour of future motions to shorten the timescale in which this deficiency should be addressed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>We will vote against future motions to lengthen the timescale in which this deficiency should be addressed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>Regards<br>Robin Alden<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>Comodo<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span><a href="mailto:public-bounces@cabforum.org"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>public-bounces@cabforum.org</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> [</span><a href="mailto:public-bounces@cabforum.org"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>mailto:public-bounces@cabforum.org</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>] <b>On Behalf Of </b>Ben Wilson<br><b>Sent:</b> 23 July 2013 17:44<br><b>To:</b> </span><a href="mailto:public@cabforum.org"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>public@cabforum.org</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br><b>Subject:</b> [cabfpub] Ballot 106 - Extended deadline to prohibit OCSP good response for non-issued certificates<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal>Ballot 106 – Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Given that several CAs have notified the CA/Browser Forum that they will be unable to comply with the 1-August-2013 deadline by which OCSP responders MUST NOT respond with a "good" status for unissued certificates, and that a one-year extension of this deadline is an appropriate timeframe by which these CAs should be able to come into compliance;<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Kelvin Yiu made the following motion, and Eddy Nigg from StartCom, Ryan Hurst from GlobalSign, and Iida Yosiaki from SECOM<span style='color:#1F497D'> [snip] </span>endorsed it: <o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D'>etc</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>