<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Feb 5, 2017 at 6:44 PM, Kirk Hall <span dir="ltr"><<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>></span> wrote:<span style="color:rgb(31,73,125);font-family:calibri,sans-serif;font-size:11pt"> </span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="m_-5979246713724868914m_-5897898821892036754gmail-m_314122583282377831WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">I don’t understand what problem this proposal is intended to address. If a CA sticks with “13 months” it should always end up with fewer than 398 days.</span></p></div></div></blockquote><div><br></div><div>Yes, that's exactly why the proposal exists.</div><div> <span style="color:rgb(31,73,125);font-family:calibri,sans-serif;font-size:11pt"> </span></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="m_-5979246713724868914m_-5897898821892036754gmail-m_314122583282377831WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">If one goal of the proposal is to try to get to a more uniform interpretation of what 13 (or 39) months is, we can add a rule to the BRs like the following:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">If any provision in these requirements permits or requires a time period stated in months, CAs shall calculate the time period as follows:<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">(a) The hour, minute, and second of the end of the time period shall be the same as for the start of the time period.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">(b) The month of the end of the time period shall be the specified number of months ahead of the month of the start of the time period.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">(c) The date of the end of the time period shall be the same date as the start of the time period, unless there is no equivalent date
for the month at the end of the time period. In that event, the CA shall choose the closest available date that exists for the month at the end of the time period.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Examples: 13 Month Period (Start of Period – End of Period)<u></u><u></u></span></u></p>
<p class="MsoNormal" style="margin-left:0.5in"><u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u><span style="text-decoration:none"> </span><u></u></span></u></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">2016-04-16 12:00:01 - 2017-05-16 12:00:01<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">2016-03-31 12:35:16 - 2016-04-30 12:35:16<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">2015-01-31 04-06-55 - 2015-02-29 04-06-55<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">2016-01-31 04-06-55 - 2017-02-28 04-06-55<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Something like that should bring uniformity among all CAs.</span></p></div></div></blockquote><div><br></div><div>Besides the impact to removing timestamps as a potential source of entropy, encoding that as logic -- on the CA side as an issuance check, or the client side as an enforcement check -- is going to be more complicated than a flat maximum of days. It will be more subject to error and arguments.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="m_-5979246713724868914m_-5897898821892036754gmail-m_314122583282377831WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Look, I’m not passionate about this, but I don’t understand where the proposal is coming from. Has anyone been asking for validity periods or revetting periods
to be set in number of days rather than months?</span></p></div></div></blockquote><div><br></div><div>Peter is, and he described the conversation that sparked that request:</div><div><br></div></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_extra"><div class="gmail_quote"><div>It actually started when I got complaints that the calculation I used in cablint was wrong. The rule in cablint is that April 18, 2017 to April 19, 2018 is longer than 12 months. But people complained for 27 or 39 months that I should count from the end of the month — e.g. April 30, 2016 to July 31, 2019 should be 39 months.<br></div></div></div></blockquote><div><br></div>It makes sense that Peter would be the first to raise this specifically, since he maintains cablint (a tool that automatically checks certificates for various BR violations). Cablint has only in the last year or so started playing a prominent role in the CA ecosystem, by virtue of integration into crt.sh (and into other processes, such as the SHA-1 exception process).<div><br></div><div>The proposal to use days for the formal requirement, instead of a human-friendly requirement, is to make measurements by tools like cablint more uniform and less prone to bugs or arguments. It doesn't constrain CAs from using more human-friendly approaches to issuance dates.</div><div><br></div><div>-- Eric<br><div class="gmail_extra"><div class="gmail_quote"><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="m_-5979246713724868914m_-5897898821892036754gmail-m_314122583282377831WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:calibri,sans-serif"> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforu<wbr>m.org</a>]
<b>On Behalf Of </b>Eric Mill via Public<br>
<b>Sent:</b> Sunday, February 5, 2017 3:05 PM<span class="m_-5979246713724868914m_-5897898821892036754gmail-"><br>
<b>To:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
</span><b>Cc:</b> Eric Mill <<a href="mailto:eric@konklone.com" target="_blank">eric@konklone.com</a>><br>
<b>Subject:</b> Re: [cabfpub] Durations<u></u><u></u></span></p><div><div class="m_-5979246713724868914m_-5897898821892036754gmail-h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Just to try to +1 Jacob's point by summing it up -- by requiring a maximum of 398 days, CAs can continue to safely issue any "human-friendly" form of 13 month renewals, in ways that don't cause calendar drift. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Any such human-intuitive strategy will be guaranteed to stay under 398 days, and then clients/tools that enforce compliance can take the computer-intuitive strategy of checking if the cert's valid for 398 days or less.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">-- Eric<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Sun, Feb 5, 2017 at 4:56 PM, Jacob Hoffman-Andrews via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal">On Sun, Feb 5, 2017 at 1:34 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Many of us have complex validation and issuance programming already based on months and anniversaries, and there doesn't seem to be a good reason to reprogram all this to a set number of days<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Peter's proposal wouldn't require you to reprogram any of that, because it is strictly more permissive than the months / anniversaries code you already have. The best approach would be to continue what you are doing, and always issue on
the first of the month or some other anniversary. Then you get the human-readable benefit, and would be sure that you are within the 398 day period.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">- plus, again, it's harder for humans to calculate the last time or the next time a task had to be done. That's my opinion.<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The 398 day period (vs 365 days) is specifically intended to give the wiggle room needed for subscribers and CAs to be able to schedule a renewal at the same time each year. If you always schedule your renewal for March 1 every year, you
would still be able to do that just fine, and have a month (or ~31 days) of leeway.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">> <span style="font-size:9.5pt">Should be easy to reach agreement on what 13 months means, and how to measure it.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">Yep, that's the topic of this thread! Peter is proposing that the easiest way to measure 13 months is to define it as 398 days. I think you will find broad consensus among programmers that it's easier to reliably
measure periods in terms of days than in terms of months.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">Another way to think of this: The goal is to renew every year (~365 days), but give people some leeway so they can keep the renewal on the same date. If we make that leeway 32 days, everything works out nicely.</span><u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12pt"><br>
______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/l<wbr>istinfo/public</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><a href="https://konklone.com" target="_blank">konklone.com</a> |
<a href="https://twitter.com/konklone" target="_blank">@konklone</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="m_-5979246713724868914m_-5897898821892036754gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><a href="https://konklone.com" target="_blank">konklone.com</a> | <a href="https://twitter.com/konklone" target="_blank">@konklone</a><br></div></div></div></div></div></div></div>
</div></div></div>