<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NO-BOK" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I do not understand the reason for this entropy requirement for certificates signed by a Root CA. It does not hurt, of course, to require this
- neither would it hurt to increase the requirement to 30 bits of entropy. <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">But a Root CA and its private key must be kept offline or air gapped and will not be exposed to the same threats as an “online CA” issuing Subscriber
certificates. The main cause for the entropy requirement is to protect against (hash) collision attacks and I do not see this as a real threat to a Root CA.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">A Root CA may also issue certificates using other systems and procedures than used for online CAs, so it does not necessarily say anything about
how the “online CA” will handle the entropy requirement when issuing Subscriber certificates.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mads<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> 10. februar 2016 00:04<br>
<b>To:</b> Brown, Wendy (10421)<br>
<b>Cc:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Fwd: Discussion about RFC5280 and BR in Mozilla-dev-security<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">1) 20 bits of entropy is not a requirement, at present. Only a SHOULD [Yes, we should fix that]<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">2) The RFC 5280 compliance was always a requirement, and zero is, apparently, questionable (I argue it's clearly wrong, but hey, some disagree)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">3) Mozilla's suggestion, is, at least, that everything created after the BR compliance dates, or which is audited to BR compliance, should be BR compliant.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Even if a Root Certificate was generated before 20 bits of entropy became a requirement, the CA could certainly bring that key out of offline storage and re-generate it. They have to have the key still (so they can revoke
the intermediates or generate the short-lived responder certificates), and while it means the certificate generation ceremony must be followed, it does not strictly seem like an unreasonable requirement to conduct during the next audit, where your auditors
are already on site.<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On Tue, Feb 9, 2016 at 2:46 PM, Brown, Wendy (10421) <</span><a href="mailto:wendy.brown@protiviti.com" target="_blank"><span lang="EN-US">wendy.brown@protiviti.com</span></a><span lang="EN-US">> wrote:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Jeremy -<br>
One potential issue is if the Root Certificate was generated before the 20 bits of entropy became a requirement- are you really saying those CAs had to modify their root certificate retroactively?<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><br>
-----Original Message-----<br>
From: </span><a href="mailto:public-bounces@cabforum.org"><span lang="EN-US">public-bounces@cabforum.org</span></a><span lang="EN-US"> [mailto:</span><a href="mailto:public-bounces@cabforum.org"><span lang="EN-US">public-bounces@cabforum.org</span></a><span lang="EN-US">]
On Behalf Of Jeremy Rowley<br>
Sent: Tuesday, February 9, 2016 5:15 PM<br>
To: Dimitris Zacharopoulos <</span><a href="mailto:jimmy@it.auth.gr"><span lang="EN-US">jimmy@it.auth.gr</span></a><span lang="EN-US">>;
</span><a href="mailto:public@cabforum.org"><span lang="EN-US">public@cabforum.org</span></a><span lang="EN-US"><br>
Subject: Re: [cabfpub] Fwd: Discussion about RFC5280 and BR in Mozilla-dev-security<br>
<br>
What does it hurt to require RootCAs to have 20 bits of entropy in the serial? We certainly didn't create an exemption for entropy from the serial number. Plus it seems like a good indicator on whether your end entity certs and sub CAs will likely have 20
bits of entropy in the serial number, doesn't it?<br>
<br>
Jeremy<br>
<br>
-----Original Message-----<br>
From: </span><a href="mailto:public-bounces@cabforum.org"><span lang="EN-US">public-bounces@cabforum.org</span></a><span lang="EN-US"> [mailto:</span><a href="mailto:public-bounces@cabforum.org"><span lang="EN-US">public-bounces@cabforum.org</span></a><span lang="EN-US">]
On Behalf Of Dimitris Zacharopoulos<br>
Sent: Tuesday, February 9, 2016 5:26 AM<br>
To: </span><a href="mailto:public@cabforum.org"><span lang="EN-US">public@cabforum.org</span></a><span lang="EN-US"><br>
Subject: [cabfpub] Fwd: Discussion about RFC5280 and BR in Mozilla-dev-security<br>
<br>
<br>
Re-posting to the public list (and apologies for those receiving it twice).<br>
<br>
Begin forwarded message:<br>
<br>
<br>
Dear CA/B Forum members,<br>
<br>
There is a discussion in Mozilla-dev-security mailing list regarding the interpretation of some sections from the BR (mainly 7.1) and RFC5280 (mainly<br>
4.2.1) regarding the "serial number" of "trust anchors" (as defined in RFC5280). Now, trust anchors are usually self-signed certificates known as RootCA certificates.<br>
<br>
According to the verification algorithm, as described in RFC5280, "Trust anchors" are treated as input to the algorithm. This means that the serial number of the RootCA certificate is ignored, together with other elements (for example policy OIDs).<br>
<br>
Also, the BR required serial numbers to have 20bits of entropy to prevent hash collision attacks. Was there ever a requirement or intension for trust anchors to RootCA certificates to have 20bits of entropy?<br>
<br>
It would be interesting for people with good technical knowledge of RFC5280 and people who defined section 7.1 of the BR to engage in the public discussion in moz-dev-sec under thread "New requirement:certlint testing".<br>
<br>
<br>
Best regards,<br>
Dimitris Zacharopoulos.<br>
<br>
_______________________________________________<br>
Public mailing list<br>
</span><a href="mailto:Public@cabforum.org"><span lang="EN-US">Public@cabforum.org</span></a><span lang="EN-US"><br>
</span><a href="https://cabforum.org/mailman/listinfo/public" target="_blank"><span lang="EN-US">https://cabforum.org/mailman/listinfo/public</span></a><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US">NOTICE: Protiviti is a global consulting and internal audit firm composed of experts specializing in risk and advisory services. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions
on financial statements or offer attestation services. This electronic mail message is intended exclusively for the individual or entity to which it is addressed. This message, together with any attachment, may contain confidential and privileged information.
Any views, opinions or conclusions expressed in this message are those of the individual sender and do not necessarily reflect the views of Protiviti Inc. or its affiliates. Any unauthorized review, use, printing, copying, retention, disclosure or distribution
is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email message to the sender and delete all copies of this message. Thank you.<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
Public mailing list<br>
</span><a href="mailto:Public@cabforum.org"><span lang="EN-US">Public@cabforum.org</span></a><span lang="EN-US"><br>
</span><a href="https://cabforum.org/mailman/listinfo/public" target="_blank"><span lang="EN-US">https://cabforum.org/mailman/listinfo/public</span></a><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>