<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.hoenzb
{mso-style-name:hoenzb;}
span.im
{mso-style-name:im;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Well, Nov 1 2016 is the date that the certs should be revoked. Nov 2015 is the date of no more issuance.
<o:p></o:p></span></a></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m not really interested in ceasing all support for Tor. Having a special cut-off for onion seems like a slap in the face to their browser after they posted
their support for the project, especially since Google doesn’t use .onion names.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Wednesday, November 19, 2014 1:45 PM<br>
<b>To:</b> Jeremy Rowley<br>
<b>Cc:</b> Brian Smith; Gervase Markham; public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] .onion proposal<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Nov 19, 2014 at 12:36 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">How do you address this concern other than by modifying the way the onion names are assigned? I guess either not permit conflicting services by only routing to the service with the oldest identified service (instead of evicting the old
service) or having Tor move to a SHA-2 hash. I know Tor is looking at the issue and will likely have more insight they can share.<br>
<br>
While a solution is in flux, the Forum should still have validation rules in place for onion that last until 2016 (the revocation date of all internal names) so that current certs undergo a set process for issuance rather than issue as internal names.<br>
<span style="color:#888888"><br>
<span class="hoenzb">Jeremy</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You mean 1 November 2015. That's been the date that no BR-conforming CA is allowed to set the expiration date past. (9.2.1 of BR 1.2.2)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">PROPOSAL: Effectively immediately, CAs MUST NOT issue certificates for the .onion TLD and MUST revoke all certificates issued for the .onion TLD<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Then we work out a proposal to set up rules for validating .onion names, which may or may not be blocked on Tor work at the protocol or browser level, and also work - with the broader Tor community - to see if there is any interim steps
that can be accepted.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<span class="im">-----Original Message-----</span><br>
<span class="im">From: Brian Smith [mailto:<a href="mailto:brian@briansmith.org">brian@briansmith.org</a>]</span><br>
<span class="im">Sent: Wednesday, November 19, 2014 1:26 PM</span><br>
<span class="im">To: Gervase Markham</span><br>
<span class="im">Cc: Jeremy Rowley; <a href="mailto:public@cabforum.org">public@cabforum.org</a></span><br>
<span class="im">Subject: Re: [cabfpub] .onion proposal</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">Gervase Markham <<a href="mailto:gerv@mozilla.org">gerv@mozilla.org</a>> wrote:<br>
> I'm in support of this in principle. There are two issues with 'normal'<br>
> internal server names:<br>
><br>
> 1) It's not possible to prove exclusive ownership of them (because they<br>
> aren't exclusively owned);<br>
<br>
<snip><br>
<br>
> For .onion names, problem 1) does not apply.<br>
<br>
That is only true assuming you can rely on the second-preimage resistance of truncated SHA-1, like Ryan pointed out. I think his point is that the second-preimage resistance of truncated SHA-1 is not strong enough to make claims like this. (Ryan: Sorry if I'm
misunderstanding you. Corrections appreciated.) I think that concern should be addressed. This is one reason I suggested to limit the maximum lifetime of .onion certificates.<br>
<br>
Cheers,<br>
Brian<br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>