<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ryan wrote:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> it still seems like specifying the result is the correct approach, regardless of the tool the CA takes.
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
+1</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It wouldn't hurt for the BRs to suggest suitable tools/resources though.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Ryan Sleevi <sleevi@google.com><br>
<b>Sent:</b> 06 January 2021 00:43<br>
<b>To:</b> Jacob Hoffman-Andrews <jsha@letsencrypt.org>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Cc:</b> Rob Stradling <rob@sectigo.com><br>
<b>Subject:</b> Re: [Servercert-wg] SCXX Ballot proposal: Debian Weak keys</font>
<div> </div>
</div>
<div>
<p></p>
<div style="background-color:#FAFA03; width:100%; border-style:solid; border-color:#000000; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:000000">CAUTION:</span> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<p></p>
<div>
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Tue, Jan 5, 2021 at 7:34 PM Jacob Hoffman-Andrews via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div dir="ltr">On Tue, Jan 5, 2021 at 9:09 AM Rob Stradling <<a href="mailto:rob@sectigo.com" target="_blank">rob@sectigo.com</a>> wrote:<br>
</div>
<div class="x_gmail_quote">
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="font-size:12pt">Since I still had a copy of my code lying around (and since there wasn't much else going on during Twixmas
</span>😉<span style="font-size:12pt"> ), I figured I could turn it into a tool that's much easier for anyone to use...</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FCVE-2008-0166&data=04%7C01%7Crob%40sectigo.com%7C7743c38f6e3844cafa5208d8b1dc3175%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637454906578126761%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3gqYppDuYCL1%2F4c672DghX27fExpZBuymn1ZdH6ElAs%3D&reserved=0" originalsrc="https://github.com/CVE-2008-0166" shash="gdy/xCmOb3tUsjCytka5EUf6l+UpMMsGM0IksQs+uBIvigKS15Z6ue+OD+vCYbCRjL3710+bcJmJAoxIKUklcNP9l5lOGyieLSfcEx+AzswMXXMqTtfsmsgNCAyCtRLJYT5BjCQnLwsRQSIbavVqd6oUvMOBTm57bsjDvW9BLAs=" target="_blank">https://github.com/CVE-2008-0166</a></div>
</div>
</blockquote>
<div><br>
This is excellent, Rob! Thanks for making this. So, question for the list: Assuming we satisfy ourselves (by code review and examination of the output) that these tools generate the same keys that would have been generated on an affected Debian system, are
folks here supportive of normatively specifying the Debian weak key check as a tool-based approach that substitutes these tools for the current implicit tool of "a complete Debian system?"</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>I'm not sure I understand the benefit/objective you're trying to achieve here. Maybe I'm misunderstanding, but it seems you're asking should we specify the process or the result, and it still seems like specifying the result is the correct approach, regardless
of the tool the CA takes. </div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>