<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 17, 2016, at 9:01 AM, Gervase Markham via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 17/11/16 16:44, Andrew Ayer wrote:<br class=""><blockquote type="cite" class="">If CAs really have to keep signing attacker-controlled non-certificate<br class="">data with SHA-1,<br class=""></blockquote><br class="">Perhaps what we need is a collection of use cases?<br class=""><br class="">What do people need to sign which is not a cert?<br class=""><br class="">* OCSP response<br class="">* CRL<br class=""><br class="">What else? And what parts of those things could be attacker-controlled?<br class="">And how can the risk of signature transfer be mitigated?</div></div></blockquote><br class=""></div><div>Things that CA keys sign:</div><div><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- Self-signed CA Certificate</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- Transitive CA Certificate (that is a CA certificate where the Issuer is not the same as the Subject; what RFC 5280 and X.509 call a “cross certificate”)</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- End-entity Certificate</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- Certificate Revocation Lists (as defined in RFC 5280)</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- OCSP response (as defined in RFC 6960)</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">- Precertificate (as defined in draft-ietf-trans-rfc6962-bis)</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""></div><div><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">End-entity (EE) certificates can be broken down into:</span></div><div style="orphans: 2; widows: 2;"><font color="#222222" face="arial, sans-serif" class=""><span style="font-size: 12.800000190734863px; background-color: rgb(255, 255, 255);" class="">- </span></font><span style="font-size: 13.3333px;" class="">OCSP response signer certificates (includes </span><font size="2" class="">id-kp-OCSPSigning and no other KP’s in the EKU extension and does not include keyCertSign or cRLSign in the KU extension)</font></div><div style="orphans: 2; widows: 2;"><span style="font-size: 13.3333px;" class="">- Other EE certs</span></div><div style="orphans: 2; widows: 2;"><span style="font-size: 13.3333px;" class=""><br class=""></span></div><div style="orphans: 2; widows: 2;"><font size="2" class="">I think that should cover all uses of CA keys. Anyone have others?</font></div><div style="orphans: 2; widows: 2;"><font size="2" class=""><br class=""></font></div><div style="orphans: 2; widows: 2;"><font size="2" class="">Thanks,</font></div><div style="orphans: 2; widows: 2;"><font size="2" class="">Peter</font></div><div style="orphans: 2; widows: 2;"><span style="font-size: 13.3333px;" class=""><br class=""></span></div><div style="orphans: 2; widows: 2;"><span style="font-size: 13.3333px;" class=""><br class=""></span></div><div class=""><br class=""></div></body></html>