<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Bonjour Rick,</div>
<div class=""><br class="">
</div>
<div class="">As said, in the first set of 8 tested objects, these are really the tbsCertificate first proposed (with the magical dust in OU).</div>
<div class=""><br class="">
</div>
<div class="">But in the second set of 7 tested objects, these are in fact the complete certificates (the original ones), and not the tbsCertificate proposed to replace them (with the same key and name, but different serial number and dates).<br class="">
<br class="">
</div>
<div class="">—</div>
<div class=""><span style="orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><font color="#222222" face="Arial, Helvetica, sans-serif" size="2" class="">[…]</font></span></div>
<div class=""><span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">[stevens TSYS2]$ time ../detectcoll_allDVs *.der </span><br style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">
<span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">sha1 f75716390925b752b403a7bbf6acb3</span><wbr style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">49de9d8d09
ssl1.tsys.1.txt.der</span></div>
<div class="">[…]</div>
<div class="">—</div>
<div class=""><br class="">
</div>
<div class="">The displayed SHA1 hash is identical with the one of the certificate found at <a href="https://crt.sh/?id=12924024" class="">https://crt.sh/?id=12924024</a>, on which the proposed tbsCertificate is based.</div>
<div class=""><br class="">
</div>
<div class="">A perfectly understandable mistake.</div>
<br class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 28 juil. 2016 à 00:08, Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" class="">Rick_Andrews@symantec.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">Erwann,<br class="">
<br class="">
Marc Stevens said "certs" but he meant "TBSCertificates". We didn't sign<br class="">
certificates; we published TBSCertificates.<br class="">
<br class="">
-Rick<br class="">
<br class="">
--------------------------<br class="">
<br class="">
From: Erwann Abalea <<a href="mailto:eabalea@gmail.com" class="">eabalea@gmail.com</a>><br class="">
Date: July 27, 2016 at 12:41:27 PM GMT-5<br class="">
To: Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" class="">Dean_Coclin@symantec.com</a>><br class="">
Subject: Re: [cabfpub] Application for SHA-1 Issuance<br class="">
He tested the full certificates of the second set, not their tbs, in fact. <br class="">
<br class="">
Le mercredi 27 juillet 2016, Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" class="">Dean_Coclin@symantec.com</a>> a<br class="">
écrit :<br class="">
I saw an email from Marc Stevens on the Mozilla list a few days ago which<br class="">
indicated he tested both the original set of TBS certs and the 2nd set and<br class="">
did not see any issues. <br class="">
(See:<br class="">
<a href="https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/sku5NYXd" class="">https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/sku5NYXd</a><br class="">
pOM)<br class="">
<br class="">
Are there other questions that folks would like to ask or concerns that can<br class="">
be addressed?<br class="">
<br class="">
Symantec is awaiting approval from browsers to schedule the signing ceremony<br class="">
this weekend if possible.<br class="">
<br class="">
Thanks,<br class="">
Dean<br class="">
<br class="">
From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On<br class="">
Behalf Of Ryan Sleevi<br class="">
Sent: Monday, July 25, 2016 4:26 PM<br class="">
To: Rob Stradling <rob.stradling@comodo.com><br class="">
Cc: Dean Coclin <Dean_Coclin@symantec.com>; CABFPub <public@cabforum.org><br class="">
Subject: Re: [cabfpub] Application for SHA-1 Issuance<br class="">
<br class="">
<br class="">
<br class="">
On Mon, Jul 25, 2016 at 2:20 PM, Rob Stradling <rob.stradling@comodo.com><br class="">
wrote:<br class="">
IINM, both Gerv and Ryan indicated (or at least strongly implied) that<br class="">
rigid construction was a prerequisite for their (Mozilla's and Google's)<br class="">
approval of TSYS's request. Did I misread something?<br class="">
<br class="">
From https://cabforum.org/pipermail/public/2016-July/008096.html<br class="">
<br class="">
"Certificates whose contents are entirely predictable or in line with<br class="">
precedent would also be acceptable; but it seemed like there were<br class="">
several questions about that floating around, and doing the serial<br class="">
numbers by strict construction makes them all moot. If you want to try<br class="">
dealing with all the questions about the contents instead, you are<br class="">
welcome to try."<br class="">
<br class="">
Also, I don't see the relevance of "strong consensus". AIUI, there must<br class="">
be unanimous agreement. If just one root program operator rejects<br class="">
TSYS's request, then you can't issue the SHA-1 certs. Similarly, if<br class="">
just one root program operator says rigidly constructed serial numbers<br class="">
are required, then you can't use random serial numbers.<br class="">
<br class="">
<br class="">
-- <br class="">
Erwann.<br class="">
</div>
</blockquote>
</div>
<br class="">
</body>
</html>