<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>“</span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>…hoping to use the precedent of the previous failure to follow policy as an indicator that the policy has been changed.”</span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>I assume this is in reference to the TSYS certs which were granted an expiration in Feb 2017. This was not a failure to follow policy nor “Symantec’s previous mistake” and in fact you may recall all the reasons TSYS spelled out for extending to that date due to merchant holiday peak periods (which have been enumerated again on behalf of First Data). This was discussed and approved by the browsers on the public list after a reasonable discussion. I don’t consider this a “failure”; rather a rationale response to a reasonable request to insure continued payment processing for a set of merchants. </span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Ryan Sleevi [<a href="mailto:sleevi@google.com">mailto:sleevi@google.com</a>] <br><b>Sent:</b> Tuesday, October 18, 2016 4:29 PM<br><b>To:</b> Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com">Dean_Coclin@symantec.com</a>><br><b>Cc:</b> Gervase Markham <<a href="mailto:gerv@mozilla.org">gerv@mozilla.org</a>>; CABFPub <<a href="mailto:public@cabforum.org">public@cabforum.org</a>>; Halliday, Morgan <<a href="mailto:Morgan.Halliday@firstdata.com">Morgan.Halliday@firstdata.com</a>>; Sidoriak, Evan S <<a href="mailto:Evan.Sidoriak@firstdata.com">Evan.Sidoriak@firstdata.com</a>><br><b>Subject:</b> Re: [cabfpub] SHA-1 exception request</span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal>On Tue, Oct 18, 2016 at 4:10 PM, Dean Coclin via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><p class=MsoNormal>Given that the current TBS certs have passed cryptanalysis, could you allow<br>the issuance of the TBS certs as presented, and mandate that the CA revoke<br>those<br>certs on 12/31 (or the next business day). This is an auditable event and<br>browsers can push that revocation out to their clients via their own methods.<br><br>I believe this meets the intent of the affected browsers by protecting their<br>users after that date. It also avoids disruption to First Data clients on<br>October 27th.<o:p></o:p></p></blockquote><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>Symantec has suggested this several times, for other incidents, as have other members of the CA/Browser Forum.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>Our position is that revocation, while it can be useful in reducing risk to (some of) our immediate user populations, does not represent a sufficient or suitable solution for protecting the broader ecosystem or reducing the moral hazards of various proposals.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>My understanding is that these certificates begin expiring October 27, and the current urgency was and is created by Symantec hoping to use the precedent of the previous failure to follow policy as an indicator that the policy has been changed. While unfortunate, I agree with Gerv's remarks on the moral hazard of this line of reasoning and this line of utility, and while I appreciate Symantec's exceptional efforts to work on an alternative solution for their customer, I think it's best to follow the policy as outlined some time ago. We discussed and gathered feedback on this precisely to avoid the situation we're in now - we wanted to have an objective, rather subjective, process, which you're now asking that we undermine because Symantec made an assumption, based on Symantec's previous mistake which was not caught (amidst all the other issues Symantec had with the previous request).<o:p></o:p></p></div></div></div></div></div></body></html>