<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif}
span.emailstyle18
{font-family:"Calibri",sans-serif;
color:#1F497D}
span.EmailStyle20
{font-family:"Calibri",sans-serif;
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt;
font-family:"Calibri",sans-serif}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div>
<div>My point is the security benefits from having different validity periods is fictional. The same ease of use arguments for keeping three year certs apply equally in favor extending ev to three years.</div>
</div>
<br>
<br>
Bruce Morton <bruce.morton@entrust.com> wrote:<br>
<br>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">My main point is that adding wildcard will provide same-ness with OV/DV without increasing security. This may appear to be a change for marketing purposes and
not for security issues. I think that it is hard to increase security, so we need to be careful if we are planning to reduce it.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Bruce.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Jeremy Rowley [mailto:jeremy.rowley@digicert.com]
<br>
<b>Sent:</b> Friday, March 20, 2015 9:51 AM<br>
<b>To:</b> Bruce Morton<br>
<b>Cc:</b> Ryan Sleevi; CABFPub<br>
<b>Subject:</b> Re: [cabfpub] EV Wildcards</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<div>
<p class="MsoNormal">It seems awfully speculative to say EV would have prevented this under the current EV requirements.</p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
Bruce Morton <<a href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>> wrote:</p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Here is my recollection from an event.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">We were informed that a site with a certificate we issued was blacklisted. We informed the customer which had a wildcard certificate and they had a site which
they did not know about. Not sure if it was an internal attack or how it was posted. The result was not that we had a bad subscriber, but we had a subscriber which was attacked, but did not know it yet.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Bruce.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Ryan Sleevi [<a href="mailto:sleevi@google.com">mailto:sleevi@google.com</a>]
<br>
<b>Sent:</b> Friday, March 20, 2015 9:31 AM<br>
<b>To:</b> Bruce Morton<br>
<b>Cc:</b> CABFPub; jeremy rowley<br>
<b>Subject:</b> Re: [cabfpub] EV Wildcards</span></p>
<p class="MsoNormal"> </p>
<p><br>
On Mar 20, 2015 6:27 AM, "Bruce Morton" <<a href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>> wrote:<br>
><br>
> Hi Jeremy,<br>
><br>
> <br>
><br>
> Thanks for bringing this up. Our position is that we would like EV certificates to be better than OV and DV. I think that was what we tried to do when the original specification was created.<br>
><br>
> <br>
><br>
> We believe that wildcard certificates have a higher security risk. Another example of a risk is that if a subscriber wants to protect 10 subdomains then a wildcard certificate can be used. But what if an attacker adds an 11th subdomain, then the certificate
can still be used. Seems like a risk we can avoid with the current EV spec.<br>
><br>
> <br>
><br>
> As such, based on this risk and other examples which have been brought up, we would not be in favor of adding wildcard to EV.<br>
><br>
> <br>
><br>
> Thanks, Bruce.</p>
<p>Hi Bruce,</p>
<p>I am having trouble understanding your attack scenario. Could you elaborate on what it means for an attacker to add a subdomain - how that might happen and what might be done by an attacker who could?</p>
</div>
</div>
</div>
</div>
</body>
</html>