<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 24, 2017, at 11:38 AM, Eric Mill <<a href="mailto:eric@konklone.com" class="">eric@konklone.com</a>> wrote:</div><div class=""><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On Fri, Feb 24, 2017 at 10:46 AM,<span class="Apple-converted-space"> </span><a href="mailto:philliph@comodo.com" class="">philliph@comodo.com</a><span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><span class=""><div class=""><br class=""></div></span><div class="">You are misrepresenting what I am saying. Do not put words in my mouth again. You do not speak for me. Only I speak for me.</div><div class=""><br class=""></div><div class="">Is that totally clear?</div></div></blockquote><div class=""><br class=""></div><div class="">It's clear, but not relevant. As best as I can tell, it is an accurate representation of what you said, and nothing in the rest of your message indicated otherwise.</div></div></div></blockquote><div><br class=""></div><div>You are not me, you will not speak for me. not now, not ever.</div><div><br class=""></div><div>Your interpretation was wrong.</div><div><br class=""></div><div>The White House is looking for a new press spokesperson I hear.</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class=""> <br class=""></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><div class=""></div><div class="">There is a WebPKI mechanism for dealing with certificates that were issued to people who should not have them. It is called revocation. It has been part of the PKIX specification from the very start. </div><div class=""><br class=""></div><div class="">Revocation is required for much more than dealing with situations like DigiNotar. The vast majority of certificates that are revoked for cause were validly issued and then revoked because of actions by the subject like setting up a phishing site. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">If a browser provider decides not to support revocation as per the specification for the sake of shaving off a few milliseconds from their response, that is a choice they have made. They are the party that has decided to put their customers at risk. If they then go round pointing fingers at others for not mitigating the consequences of their decision, they are going to have the fingers pointed back to them.</div></div></blockquote><div class=""><br class=""></div><div class="">This just comes across as bitterness. While you may think their calculus is wrong, Chrome's rationale for dropping support for most end-entity revocation has been clearly expressed and defended, in blog posts, articles, and many mailing list posts here. Disagree, but don't suggest it's bad faith -- and don't use it as an excuse to not budge on improving the security of another aspect of the Web PKI.</div></div></blockquote><div><br class=""></div><div>There is an open standard that was agreed by a wide technical community. A community that includes people that know a lot more about PKI than either you or Mr Sleevi have demonstrated to date.</div><div><br class=""></div><div>I think that it is entirely reasonable to point out that the WebPKI is not a science project that individuals can adapt to their own whims no matter who they happen to be working for at the time. </div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><div class="">In the PKIX architecture, the choice of certificate validity interval has no security consequences whatsoever. The only consequence of a longer or shorter validity interval is that the revocation infrastructure has to track certificate status for longer or shorter periods of time.</div></div></blockquote><div class=""><br class=""></div><div class="">That's flatly wrong, and dangerous. Even if we were in a world where revocation was fully enforced and hard-failed by all relying parties -- a world we're so very far away from -- revocation requires that someone *know* to revoke the certificate. You can only use revocation to mitigate a known attack. </div></div></blockquote><div><br class=""></div><div>Lets say that there was a CA ‘LaxCA’ that decided to have the absolute minimum validation check and not do revocation. That CA could operate very cheaply. When it is notified that a certificate is being used on a phishing site it does nothing, it merely waits for the certificate to expire. And then it automatically re-issues a new cert to the subject when it expires.</div><div><br class=""></div><div>What is the difference between LaxCA and a 100 year cert? None that I can see. Certificate validity only has effect if you are going to do something different on expiry. </div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="">Expiration will remove a compromised certificate from being used in an attack, whether or not any human is aware of the compromise.</div></div></blockquote><div><br class=""></div><div>But will not prevent the malefactor being issued a new one. Because in your attack scenario, no CA would have reason not to re-issue.</div><div><br class=""></div><div>It is very easy to devise attack scenarios in which a failure occurs. But they have no real significance unless you can show that your proposed course of action results in a different outcome.</div><div><br class=""></div><div>This scenario does not.</div><div><br class=""></div><div><br class=""></div></div><br class=""></body></html>