<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.m5337851204740303527im
{mso-style-name:m_5337851204740303527im;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><b>From:</b> Ryan Sleevi [mailto:sleevi@google.com] <br><b>Sent:</b> Friday, March 2, 2018 11:22 AM<br><b>To:</b> Phillip <philliph@comodo.com><br><b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Paul Hoffman <paul.hoffman@icann.org>; Ben Wilson <ben.wilson@digicert.com><br><b>Subject:</b> Re: [cabfpub] [Ext] BR Authorized Ports, add 8443<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'>More importantly though, how many validation approaches do we need? I would rather work on reducing them rather than increasing them further.<o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:.5in'>And 64KB should be enough for everybody, no one will need more than one monitor, XGA is plenty resolution, etc.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:.5in'>I would not obsess about the number of validation methods, I would rather us focus on ensuring a consistent level of assurance, and then work to help ensure that anyone and everyone on the Web can easily get a certificate and facilitate greater adoption of encryption.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p></div></div><p class=MsoNormal>Unlike 640K, a cryptographic digest is actually sufficient to authenticate any sequence of bits.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Since we require that any validation mechanism be described objectively, it follows that it can be described as a sequence of bits and thus that a cryptographic digest is sufficient.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So I am pretty sure that we can use a CAA record as the hook for pretty much any new validation mechanism we might propose. But as Ryan is pointing out, such mechanisms are not necessarily good ones or ones we should accept.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To be more precise in what was concerning me: I think that we should attempt to limit the number of Internet services, accounts, etc. that operators need to be concerned about restricting access to in order to prevent a malicious request for validation.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is the concern that makes port 8443 unacceptable to me. Most of the billions of hosts on the net do not regard that port as privileged so we should not attempt to make it so. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Rather than adding to the ports, accounts, etc. that we are requiring people to watch, I would like us to choose one affordance that has been created for the express purpose of being a gating point for issue. That is the CAA record.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If we need more flexibility in issue mechanisms, the most flexible approach I know of is to use a public key to validate the request. And I already use UDFs to authenticate public keys.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>There clearly needs to be some part of any validation mechanism for a DNS based protocol that uses information that comes either directly or indirectly from the DNS system.<o:p></o:p></p></div></div></div></body></html>