<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Bonjour,
<div class=""><br class="">
</div>
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 24 févr. 2016 à 19:56, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
I’ve been playing around with Peter Bowen’s certlint (an excellent tool) and, looking at the cert universe as a whole, there are some noticeable issues with the BRs and RFC 5280 that I though merited a public CAB Forum discussion. Some of this is likely me
not knowing the entire history of 5280, so I appreciated any explanation. If there’s exceptions we would like to make to RFC5280, we should probably also push a bis with IETF at the same time.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
Here’s what I’m noticing are common issues:<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">1)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>Org names, common names,
and address fields are limited to 64 characters. Very few international companies can comply with this restriction. It’s even worse if you are converting an IDN to a printable string. I don’t think any browsers limit this to 64 characters? Is there a strong
objection to permitting longer strings in these fields?<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">2)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>keyAgreement isn’t specifically
prohibited in the BRs or 5280. However, keyAgreement should no longer be used in ECC certs because of security issues as explained by Ryan Sleevi in previous emails . We should update the BRs to prohibit keyAgreement.</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>keyAgreement isn’t forbidden in 5280 because (EC)DH certificates can exist, and this would be the only valid key usage.</div>
<div>Referring to BR scope, which is TLS certificates, the EC key included in a certificate isn’t used to establish the PreMesterSecret, but only to sign an ephemeral (or not) DH key that itself will be used to establish this PMS. So declaring keyAgreement
in the certificate is useless.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">3)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>Years ago, we discussed
that 2047 bit certs were equivalent to 2048 bit certs (although the discussion may have occurred solely on the Mozilla mailing list). We should codify this exception.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">4)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>Why is teletext string
not permissible on a lot of these fields? I also don’t understand the weird requirement to use printablestring over UTRF8 for some fields. Specifically, requiring a printable string for subject:serialNumber could cause issues with the EV Guidelines if a country
uses an IDN as part of their registration number. <o:p class=""></o:p></div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class="">serialNumber, in X.520, is defined as being a PrintableString only, not a choice of different string types as others fields.</div>
<div class="">That’s the same situation with domainComponent (IA5String only), defined by LDAP RFCs, and countryName (defined in X.520) which is also limited to PrintableString and is exactly 2 characters long.</div>
<div class="">You can’t change the definition of an attribute.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</body>
</html>