<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi again,
<div class=""><br class="">
</div>
<div class="">We would like to clarify a bit about scope vs compliance. Can it be, that<br class="">
<br class="">
1) Under root participating in root programs there’s a subordinate that issues certificates which are out of scope of BR-s (i.e. not intended for public web server authentication)?<br class="">
1a) Does being technically constrainted change anything?<br class="">
2) These out-of-scope certificates intentionally do not follow the requirements in BR?<br class="">
3) These certificates are not considered violation of BR-s and don’t need to be reported?<br class="">
<br class="">
To be clear - we don’t have anything against disclosing misissued certificates, we just don’t want situations where requirements can be interpreted in a way that considers any certificate not intended for public web server authentication as a misissuance.<br class="">
<br class="">
We would also like to repeat the example given about OCSP requirements - maybe this should be a separate discussion.<br class="">
Is there a particular reason why strict complance to obsolete RFC 2560 is requested in BR section 4.9.9? Microsoft has declared that starting from June 2016 Windows will not accept OCSP signatures based on SHA-1. RFC 2560 refers to RFC 2459 (also obsolete)
that lists MD2, MD5 and SHA-1 as only acceptable hash schemes to be used with RSA. These requirements seem conflicting. Anyone willing to write a ballot that at least introduces an option to comply with RFC 6960 to BR-s?<br class="">
<div apple-content-edited="true" class=""><br class="">
</div>
<div apple-content-edited="true" class=""><br class="">
</div>
<div apple-content-edited="true" class="">BR, <br class="">
<br class="">
Eneli Kirme<br class="">
<br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 14 Jan 2016, at 05:32, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)" class="">
<style class=""><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple" class="">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D" class="">Not all malformations are violations of the BRs but most of them are since 7.1.2.4 requires ”</span>All other fields and extensions MUST be set in accordance
with RFC 5280.”<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D" class=""><o:p class=""></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose" class=""><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D" class=""> </span></a></p>
<p class="MsoNormal"><b class=""><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" class="">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" class="">
<a href="mailto:public-bounces@cabforum.org" class="">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org" class="">mailto:public-bounces@cabforum.org</a>]
<b class="">On Behalf Of </b>Eric Mill<br class="">
<b class="">Sent:</b> Wednesday, January 13, 2016 8:24 PM<br class="">
<b class="">To:</b> Eneli Kirme<br class="">
<b class="">Cc:</b> <a href="mailto:public@cabforum.org" class="">public@cabforum.org</a><br class="">
<b class="">Subject:</b> Re: [cabfpub] Misissuance of certificates<o:p class=""></o:p></span></p>
<p class="MsoNormal"><o:p class=""> </o:p></p>
<div class="">
<div class="">
<div class="">
<p class="MsoNormal">On Wed, Jan 13, 2016 at 6:14 AM, Eneli Kirme <<a href="mailto:Eneli.Kirme@sk.ee" target="_blank" class="">Eneli.Kirme@sk.ee</a>> wrote:<o:p class=""></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" class="">
<p class="MsoNormal"><br class="">
There’s also been discussion that malformed certificates are in scope. The problem with these is that not all technical errors have an impact on security and some of them can go unnoticed for quite some time and involve large amounts of certificates.<o:p class=""></o:p></p>
</blockquote>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class="">
<p class="MsoNormal">Not all malformations of x.509 certificates are violations of the BRs.<o:p class=""></o:p></p>
</div>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class="">
<p class="MsoNormal">If a CA is systematically issuing large tranches of certificates in violation of the BRs, that points to a significant potential security gap in the CA's code and/or audits, regardless of whether the particular discovered technical error
poses an immediate security threat to users at that moment.<o:p class=""></o:p></p>
</div>
<div class="">
<p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" class="">
<p class="MsoNormal">Putting all of them onto the Internet without unified means for automated querying would lower the value of such reporting.<o:p class=""></o:p></p>
</blockquote>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class="">
<p class="MsoNormal">I don't think that's true. Bulk data for expert users to sort out, and to potentially design their own search interface for themselves or the public to use, is of high value.<o:p class=""></o:p></p>
</div>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class="">
<p class="MsoNormal">-- Eric<o:p class=""></o:p></p>
</div>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class="">
<p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" class="">
<div class="">
<div class="">
<p class="MsoNormal">> On 05 Jan 2016, at 17:19, Sigbjørn Vik <<a href="mailto:sigbjorn@opera.com" class="">sigbjorn@opera.com</a>> wrote:<br class="">
><br class="">
> How about the following:<br class="">
><br class="">
> <a href="mailto:public@cabforum.org" class="">public@cabforum.org</a> SHALL be informed about the report. If the CA cannot<br class="">
> post directly, it SHALL inform <a href="mailto:questions@cabforum.org" class="">
questions@cabforum.org</a>, and the CA/B<br class="">
> Forum chair SHALL forward to the list.<br class="">
><br class="">
> On 05-Jan-16 16:10, Dean Coclin wrote:<br class="">
>> Commenting on this part:<br class="">
>><br class="">
>> "<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a> SHALL be informed about the report, if the CA cannot<br class="">
>> post directly, it SHALL inform the CA/B Forum chair who SHALL inform the<br class="">
>> list."<br class="">
>><br class="">
>> If a CA is not a member of the forum, they won't have public list posting<br class="">
>> privileges and may not know the email address of the Chair/Vice Chair (they<br class="">
>> are not posted on our website). Hence I would suggest they email the<br class="">
>> "questions" list<br class="">
>><br class="">
>> Dean<br class="">
>><br class="">
>> -----Original Message-----<br class="">
>> From: <a href="mailto:public-bounces@cabforum.org" class="">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" class="">public-bounces@cabforum.org</a>] On<br class="">
>> Behalf Of Sigbjørn Vik<br class="">
>> Sent: Friday, December 18, 2015 9:08 AM<br class="">
>> To: <a href="mailto:public@cabforum.org" class="">public@cabforum.org</a><br class="">
>> Subject: Re: [cabfpub] Misissuance of certificates<br class="">
>><br class="">
>> Hi,<br class="">
>><br class="">
>> The discussion on this topic seems to have died down, I hope that means we<br class="">
>> can proceed to a ballot. Anyone willing to endorse?<br class="">
>><br class="">
>> The suggested exception for constrained intermediates did not seem to solve<br class="">
>> the problem it was intended to solve, and nobody spoke up for it, so I have<br class="">
>> removed it. The text would then be:<br class="">
>><br class="">
>><br class="">
>> 2.2.1 Information of incorrect issuance<br class="">
>><br class="">
>> In the event that a CA issues a certificate in violation of these<br class="">
>> requirements, the CA SHALL publicly disclose a report within one week of<br class="">
>> becoming aware of the violation.<br class="">
>><br class="">
>> <a href="mailto:public@cabforum.org" class="">public@cabforum.org</a> SHALL be informed about the report, if the CA cannot<br class="">
>> post directly, it SHALL inform the CA/B Forum chair who SHALL inform the<br class="">
>> list.<br class="">
>><br class="">
>> The report SHALL publicize details about what the error was, what caused the<br class="">
>> error, time of issuance and discovery, and public certificates for all<br class="">
>> issuer certificates in the trust chain.<br class="">
>><br class="">
>> The report SHALL publicize the full public certificate, with the following<br class="">
>> exception: For certificates issued prior to 01-Mar-16 the report MAY leave<br class="">
>> out Subject Distinguished Name fields and subjectAltName extension values.<br class="">
>><br class="">
>> The report SHALL be made available to the CAs Qualified Auditor for the next<br class="">
>> Audit Report.<br class="">
>><br class="">
>> --<br class="">
>> Sigbjørn Vik<br class="">
>> Opera Software<br class="">
>> _______________________________________________<br class="">
>> Public mailing list<br class="">
>> <a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
>> <a href="https://cabforum.org/mailman/listinfo/public" target="_blank" class="">
https://cabforum.org/mailman/listinfo/public</a><br class="">
>><br class="">
><br class="">
><br class="">
> --<br class="">
> Sigbjørn Vik<br class="">
> Opera Software<br class="">
> _______________________________________________<br class="">
> Public mailing list<br class="">
> <a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
> <a href="https://cabforum.org/mailman/listinfo/public" target="_blank" class="">
https://cabforum.org/mailman/listinfo/public</a><br class="">
<br class="">
_______________________________________________<br class="">
Public mailing list<br class="">
<a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank" class="">https://cabforum.org/mailman/listinfo/public</a><o:p class=""></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br class="">
<br clear="all" class="">
<o:p class=""></o:p></p>
<div class="">
<p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p class=""></o:p></p>
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<p class="MsoNormal"><a href="https://konklone.com/" target="_blank" class="">konklone.com</a> |
<a href="https://twitter.com/konklone" target="_blank" class="">@konklone</a><o:p class=""></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>