<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<blockquote type="cite" class="">That said, if there's concern about timing, arguably it's useful to know concretely what the timing is. <br class="">
</blockquote>
<br class="">
We have asked our developer and we don’t have a problem with extending the requirement from 20 to 64 bits.<br class="">
<br class="">
That said, we are still happy to see that discussion about how to audit the quality of RNG has started.<br class="">
<div apple-content-edited="true" class=""> </div>
<div apple-content-edited="true" class=""><br class="">
</div>
<div apple-content-edited="true" class="">Best regards, <br class="">
<br class="">
Eneli Kirme<br class="">
<br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 28 Apr 2016, at 19:07, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class=""><br class="">
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Thu, Apr 28, 2016 at 5:16 AM, Eneli Kirme <span dir="ltr" class="">
<<a href="mailto:Eneli.Kirme@sk.ee" class="">Eneli.Kirme@sk.ee</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div style="word-wrap:break-word" class="">Hi,
<div class=""><br class="">
</div>
<div class="">The current requirement was part of root program conditions already before first version of BR-s were published and could be taken as a requirement while developing or purchasing the CA software.
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">Actually, at the time the BRs were published, the requirement was 64 bits. The BRs were looser (to 20 bits) than what Microsoft was requiring.</div>
<div class=""> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div style="word-wrap:break-word" class="">
<div class="">As the vendor claimed compliance, we believe to be compliant.<br class="">
Changing to 64 bits may or may not make a difference - we have to check with the vendor. Adding some other restrictions on the types of acceptable RNGs is another change in requirements that may or may not make a difference.<br class="">
We also have to check with the auditors about what evidence they would like to see to believe that long enough seemingly random number comes from an acceptable source.<br class="">
<br class="">
But the question is more general - to which level you expect a CA to have control over the software it is using and to which level auditors should have access to it? </div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">The expectation is that all CAs will be following the latest-published BRs, per Section 2.2 of the BRs, specifically:</div>
<div class=""><br class="">
</div>
<div class="">[Name of CA] conforms to the current version of the Baseline Requirements for the Issuance and Management of Publicly‐Trusted Certificates published at
<a href="http://www.cabforum.org/" class="">http://www.cabforum.org</a>. In the event of any inconsistency between this document and those Requirements, those Requirements take precedence over this document. <br class="">
</div>
<div class=""><br class="">
</div>
<div class="">To the extent a given CA has concerns about the BRs, such as the timing of the deployment of updated software, that's useful information to bring forward during the discussion of the proposed changes, and may inform the voting on the ballot. But
once a ballot has passed, the expectation is that the CA will adopt it operationally "immediately", even if the audit criteria for it is developed, and the audit expectation of compliance is not enforced until the audit criteria are adopted.</div>
<div class=""><br class="">
</div>
<div class="">This was discussed during the Scottsdale F2F as understanding when ballots come into effect - when the consensus about the understanding that the above clause represents an expectation to adopt immediately. That naturally follows that CAs should
be prepared to adopt the Ballots as they're published, or their effective date, or to understand what challenges might exist to prevent that.</div>
<div class=""><br class="">
</div>
<div class="">That said, if there's concern about timing, arguably it's useful to know concretely what the timing is. </div>
</div>
</div>
</div>
_______________________________________________<br class="">
Public mailing list<br class="">
<a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
https://cabforum.org/mailman/listinfo/public<br class="">
</div>
</blockquote>
</div>
<br class="">
</body>
</html>