<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Bradley Hand ITC";
panose-1:3 7 4 2 5 3 2 3 2 3;}
@font-face
{font-family:"\@MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">The definition of Random Value on the domain validation draft ballot reads as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Random Value: A value specified by a CA to the Applicant that exhibits
<u>128 bits of entropy</u>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The problem is, one of the most common random number generating tool is the MS GUID generator, and my understanding is that it falls just short of 128 bits of entropy.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#1F497D"><a href="http://en.wikipedia.org/wiki/Globally_unique_identifier">http://en.wikipedia.org/wiki/Globally_unique_identifier</a><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">GUIDs are usually stored as 128-bit values, and are commonly displayed as 32<span class="apple-converted-space"> </span></span><a href="http://en.wikipedia.org/wiki/Hexadecimal" title="Hexadecimal"><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#0B0080;background:white;text-decoration:none">hexadecimal</span></a><span class="apple-converted-space"><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white"> </span></span><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">digits
with groups separated by hyphens, such as<span class="apple-converted-space"> </span></span><tt><span style="font-size:10.5pt;color:#252525;background:white">{21EC2020-3AEA-4069-A2DD-08002B30309D}</span></tt><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">.
They may or may not be generated from random (or<span class="apple-converted-space"> </span></span><a href="http://en.wikipedia.org/wiki/Pseudo-random" title="Pseudo-random"><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#0B0080;background:white;text-decoration:none">pseudo-random</span></a><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">)
numbers. GUIDs generated from random numbers <span style="background:yellow;mso-highlight:yellow">
normally contain 6 fixed bits (these indicate that the GUID is random) and 122 random bits</span>; the total number of unique such GUIDs is 2</span><sup><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">122</span></sup><span class="apple-converted-space"><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white"> </span></span><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">(approximately
5.3×10</span><sup><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">36</span></sup><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#252525;background:white">). This number is so large that the
probability of the same number being generated randomly twice is negligible; however other GUID versions have different uniqueness properties and probabilities, ranging from guaranteed uniqueness to likely duplicates. Assuming uniform probability for simplicity,
the probability of one duplicate would be about 50% if every person on earth as of 2014 owned 600 million GUIDs.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think we did some testing and found the random numbers from the MS GUID generator had something like 120 bits of entropy. Jody and Anoosh – what can you tell us?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><u>Can we change the required level of entropy in the new definition to something like 120 bits instead</u>? That’s still pretty high.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0F243E">Kirk R. Hall<o:p></o:p></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<o:p></o:p></p>
<p class="MsoNormal">Trend Micro<o:p></o:p></p>
<p class="MsoNormal">+1.503.753.3088<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>