<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, May 3, 2016 at 12:49 PM, Ben Wilson <span dir="ltr"><<a href="mailto:ben.wilson@digicert.com" target="_blank">ben.wilson@digicert.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">What are your thoughts about language suggested on the Mozilla Dev Security Policy list under the topic, Undisclosed CA Certificates, “at least 64 bits in the certificate serial number SHALL be generated using a CSPRNG�</span></p></div></div></blockquote><div><br></div><div>There was also a sub-thread on this topic here on the CA/Browser Forum in which I proposed similar language, along with a definition of CSPRNG as requested by Tim:</div><div><br></div><span style="font-size:12.8px">> "CAs SHALL use a Certificate serialNumber greater than zero (0) containing at least 64 bits of output from a CSPRNG"</span><br style="font-size:12.8px"><div><span style="font-size:12.8px">> "CSPRNG: A random number generator </span><span class="" style="font-size:12.8px;background-color:rgb(255,255,255)">intended</span><span style="font-size:12.8px"> </span><span class="" style="font-size:12.8px;background-color:rgb(255,255,255)">for</span><span style="font-size:12.8px"> use in cryptographic system"</span> </div></div></div></div>