<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I definitely agree with the “within 24 hours a CA must begin investigating”. It ensures the CA is responsive to reports of a key compromise and is taking the
report seriously. I also like having actions tied to public disclosure time frames. 72 hours seems reasonably, except in the case of industry-wide events like heartbleed where the CAs didn’t receive notice. For events like heartbleed, 72 hours is a short
window to replace every cert out there for most CAs. For the preliminary decision, I’d say it should be the MUST take action within a reasonable timeframe that is decided in collaboration with the entity who reported the compromised key and the certificate
holder (but not to exceed 14 days). If revocation is required within 72 hours of a public disclosure, you still have the upper bounds on when revocation will happen.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Jeremy<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Thursday, March 19, 2015 11:01 AM<br>
<b>To:</b> Jeremy Rowley<br>
<b>Cc:</b> public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] Revocation revamp<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Mar 19, 2015 at 7:20 AM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hi everyone,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I think the Baseline Requirements need improvements on how CAs are required to handle certificate revocations, especially
if the certificate issue is reported by security researchers. There needs to be a distinction between private keys exposed through an attack and where private keys are made vulnerable through an exploit (such as heartbleed).
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">For incidents where the vulnerability has not been made public or where there is an exploit affecting the general
user base, there should be a longer time period for revocation than 24 hours. For private keys being malicious misused, we should still have the 24 hour window.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The length of time we permit for revocation should be strict enough to prevent abuse but flexible enough to permit
investigation and patching in a timely manner. Plus, a less strict revocation deadline would encourage CA participation in the remediation efforts and reduce the panic created by a high-profile vulnerability. Right now, the 24 hour requirement is actually
an incentive to exclude CAs from the remediation process as not giving CAs notice provides more time to remediate.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">One idea to make the revocation period flexible, something like requiring the CA to provide notice that the certificate
will be revoked because of the reasons specified in Section 13.1.5 and then requiring revocation within one week after the announcement of an industry vulnerability and within 72 hours after public disclosure of the vulnerability is made. This gives CAs time
to participate in the discussions and ensures we still have a short revocation window for publicly disclosed threats. Another idea is to simply expand the time by up to two weeks if the revocation is part of on-going investigation into an issue or a planned
patch process.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thoughts?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#888888"> </span><span style="color:#888888"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#888888">Jeremy</span><span style="color:#888888"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for bringing this up, Jeremy.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think you're right, the current BRs put CAs in a nasty spot with respect to investigating issues, which I think puts customers in a nasty spot with regards to certs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For example, 13.1.3 allows 24 hours for a CA to *begin* investigating an incident, while 13.1.5 allows 24 hours for a CA to *revoke* a certificate. When you combine the two periods, it would seem as if a CA only has 24 hours to make a decision
and, if they're unable to get sufficient information, must err on the side of revoking, because failing to revoke may constitute a breach of 13.1.5.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For the sake of discussion, here's several hypotheticals:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1) A CA is informed that a certificate for <a href="http://example.com">
example.com</a> misrepresents the Organization/Locality information. The CA needs time to examine the claim, the vetting performed, and whether or not the claim is correct. However, 13.1.5 (8) / 13.1.5 (10) requires revocation 24 hours after a CA is "made aware".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2) A copy of a court ruling regarding a domain name is sent to the CA, pursuant with 13.1.5 (6). However, the CA needs to authenticate the document to confirm its legitimacy and the status of the ruling.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3) A CA is notified of a possible phishing/fraudulent site using a wildcard, pursuant with 13.1.5 (7). However, the site is inaccessible with the CA tries to access it, and thus they're unable to initially confirm the report.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Each of these cases have situations where a CA may have a Relying Party report something as a concern, but require time to investigate. 13.1.3 recognizes the need for investigation, but leaves a gap for when investigation and revocation
happen. If the CA is unable to complete investigation within the appropriate time, or when there are complicating factors, a responsible CA will have to err on the side of caution (and avoiding a qualified finding) by revoking the certificate.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That's probably not ideal.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On the other extreme, I can see cases where an Applicant/Subscriber misrepresents the information to the CA in order to obtain a certificate, under conditions that may cause the CA difficulty to investigate. The Applicant/Subscriber would
prefer the CA not revoke the certificate (we're assuming a secretly nefarious Subscriber), and so the CA shouldn't simply "not revoke" because it will cause the (nefarious) Subscriber difficulty.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In between are cases where there is a (good) Subscriber who would prefer the CA not revoke within 24 hours due to organizational complexity, cost, and disruption to Relying Parties, and the Subscriber is willing to accept those risks.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There are also cases where a (good, but uninformed) Subscriber would be willing to accept the risks while or after a CA investigates a claim, but where Browsers or Relying Parties would view the Risks as unacceptably high.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Random dates/times for discussion:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Within 24 hours of a report, a CA must begin investigating.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Within 24 hours of an investigation starting, a CA MUST make a preliminary decision known to the reporter and the Subscriber.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Within 72 hours of a public disclosure of an issue, a CA MUST take action. [Sets the upper bound at 72 hours of public disclosure; e.g. Heartbleed type scenarios]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Within 7 days of a preliminary decision, a CA MUST take action. [Sets the upper bound at 1 day response + 1 day initial finding + 7 days final finding]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- [Needs better wording] A CA must maintain a record of the investigation, including communications with Relying Parties and Subscribers during the course of an investigation. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Some sort of special set of conditions in which a Subscriber MAY request an extension, up to 7 days, but only for certain conditions. We'd probably need to go down the list of 13.1.5 and consider security risks of an 'evil' Subscriber
and which cases the risk of harm to a 'good' Subscriber outweigh those risks.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Basically, we want to find a solution that allows a "good" Subscriber flexibility, without creating incentives for an "evil" Subscriber or an "security incompetent" CA (e.g. who classifies everything as 'low/no risk'), yet recognizing also
that rational security professionals can and do disagree about degrees of severities.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The above dates aren't necessarily things I think we'd be happy with, but I'm just throwing them out to provide a more concrete point for discussion.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>