<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:30.5pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Friday, August 18, 2017 10:33 AM<br>
<b>To:</b> Doug Beattie <doug.beattie@globalsign.com><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
<b>Subject:</b> Re: [cabfpub] Question on BR BR 7.1.4.2.2(j) - Other Subject Attributes<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.5pt">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2) The list of meta data characters is not spelled out clearly. We say parenthetically meta data characters such as ‘.’, ‘‐‘, and ‘ ‘ (i.e. space). I think there are 2 categories
of content we need to specifically disallow:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.5pt">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2.1) Fields that consist of only meta data characters are clearly not allowed. I think this is the list: ASCII 32 - 47, 58 - 64, 91 - 96, 123 – 126. This is easy to specify and
then audit against.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.5pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.5pt">I think this is a good step, but it's worth noting that these fields can also contain Unicode data (e.g. UTF8String), and as a result, has a variety of metacharacters in a variety of languages (the number of ways
to represent a 'period / full-stop' in Unicode is... surprising). The danger in specifying to this extent is that we're imply that these other sets _are_ acceptable, but I don't believe that's the intent.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sure, so we could frame this for this specified character set as a better example of the fields maybe?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.5pt">Of course, this itself is a symptom of allowing CAs arbitrary flexibility for additional attributes. It would be useful to know whether CAs have availed themselves of this flexibility, as perhaps we can cut this
Gordian Knot simply by prohibiting additional fields.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.5pt"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.5pt">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2.1) The harder one is to say don’t put nonsense into any fields like N/A, NA, test, “not applicable” etc. The descriptions of all the fields in BR section 7.1.4.2.2 items a-h are
clear on the content. Item i) OU and j) Other subject attributes, might need to more clearly specify what is permitted and what is prohibited.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.5pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.5pt">Harder in what sense? I suspect you mean regarding programatic auditing, but I wanted to make sure I'm not confusing the issue. I think that as long as we allow CA discretion, we won't be able to solve the programatic
auditing, and so our best hope is to provide the procedural guidance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Yes, harder to programmatically audit/check. Guidance is pretty good for most fields, but the OU field description remains a bit open, perhaps by design.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.5pt">Or were you suggesting that, similarly to what I remarked above, we should restrict/eliminate the blanket provision, instead specify the additional fields, and their necessary content?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="color:#1F497D">If CAs are not using any other Subject fields, then we should probably disallow them. Someone with better programming skills could certainly parse the CT logs looking for additional subject fields – if there
are only a few, then why not include them and preclude all others?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>