<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>When I said security, I was thinking of availability, but that would be a contractual issue between the CA and the CDN – right now the requirement in section 4.10.2 is 10 seconds -- “The CA SHALL operate and maintain its CRL and OCSP capability with resources sufficient to provide a response time of ten seconds or less under normal operating conditions. The CA SHALL maintain an online 24x7 Repository that application software can use to automatically check the current status of all unexpired Certificates issued by the CA.”<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Erwann Abalea [mailto:eabalea@gmail.com] <br><b>Sent:</b> Friday, August 21, 2015 1:12 PM<br><b>To:</b> Bruce Morton <bruce.morton@entrust.com><br><b>Cc:</b> Ben Wilson <ben.wilson@digicert.com>; public@cabforum.org; Adam Langley <agl@google.com><br><b>Subject:</b> Re: [cabfpub] Fwd: [CABFORUM] Questions on the network & certificate system security requirements<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p>I agree with Bruce. CDNs can't alter signed objects without being detected, they can only remove/replay/replace them, as any attacker can do. And we can't set security requirements on attackers.<o:p></o:p></p><p>There are also some transparent caches which can be seen as CDNs (mobile telco networks, for example).<o:p></o:p></p><p>What needs to be obviously protected is the unsigned certificate status, stored at the CA database level.<o:p></o:p></p><p>(written while lying in my hammock)<o:p></o:p></p><div style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt'><p class=MsoNormal>Ben,<br><br>I disagree. We do not need to set security requirements for CDNs.<br><br>The CDN and the server providing an OCSP Stapling response are both providing signed responses. These responses are signed similar to the server certificate. If the CDN or server provides a signed response which fails validation then an error will occur per design. As such, it is the signer that must comply with the security requirements.<br><br>Bruce.<br><br>-----Original Message-----<br>From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Ben Wilson<br>Sent: Friday, August 21, 2015 1:25 PM<br>To: Adam Langley <<a href="mailto:agl@google.com">agl@google.com</a>><br>Cc: CABFPub <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>Subject: Re: [cabfpub] Fwd: [CABFORUM] Questions on the network & certificate system security requirements<br><br>It might be good for a working group to write up the security expectations of CDNs based on a threat-risk assessment.<br><br>-----Original Message-----<br>From: Adam Langley [mailto:<a href="mailto:agl@google.com">agl@google.com</a>]<br>Sent: Friday, August 21, 2015 11:13 AM<br>To: Ben Wilson <<a href="mailto:ben.wilson@digicert.com">ben.wilson@digicert.com</a>><br>Cc: Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>>; CABFPub <<a href="mailto:public@cabforum.org">public@cabforum.org</a>>; Peter Bowen <<a href="mailto:pzbowen@gmail.com">pzbowen@gmail.com</a>><br>Subject: Re: [cabfpub] Fwd: [CABFORUM] Questions on the network & certificate system security requirements<br><br>On Fri, Aug 21, 2015 at 6:24 AM, Ben Wilson <<a href="mailto:ben.wilson@digicert.com">ben.wilson@digicert.com</a>> wrote:<br>> That being said, CDNs still need to meet security standards because<br>> they provide status information to end users. One might expect<br>> auditors to ask CAs to provide a copy of the CDNs’ SOC 2 / SSAE 16<br>> reports, and that CAs should be requesting copies of those from CDNs<br>> on an annual basis.<br><br>On that basis, aren't all servers that perform OCSP stapling "provid[ing] status information to end users" and thus subject to the same requirements?<br><br><br>Cheers<br><br>AGL<br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p></div></div></body></html>