<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
Hello,<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
A diff for our proposed changes may be found here: <a href="https://github.com/cabforum/servercert/compare/2c63814...9ecc201?diff=split" id="LPNoLPOWALinkPreview">https://github.com/cabforum/servercert/compare/2c63814...9ecc201?diff=split</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
This compares the current BR branch (2c63814) with our latest updates. Ben Wilson and Martijn Katerbarg have offered extremely useful suggestions, some of which we have accommodated and others we offer for discussion. Specifically, in 6.1.1.3:<br>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<ul>
<li class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof">Our version removes the provision "2. There is clear evidence that the specific method used to generate the Private Key was flawed" as we believe that this case is essentially
the same as the next one (i.e. "clear evidence" of a flawed method must lead to awareness of the "demonstrated or proven method")<br>
</span></li><li class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof">The four items 4 (b) (i though iv) are inclusive (i.e all parameters combined) and are now joined by an "and"<br>
</span></li><li class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof">As this ballot covers various weak key issues, "Debian" has been removed where not specifically required</span></li><li class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof ContentPasted4 ContentPasted5">The directive that "CAs MUST check for Debian weak keys for all RSA modulus lengths and exponents that they accept" was added via discussion
in our SCWG calls and in our view reinforces and extends the provision in 4(b). It should be decided if there will be a cutoff point or not. If a CA wants to support 16384-bit RSA keys, do they have to generate first all Debian weak keys of that size or could
it be assumed that such Debian weak keys are not expected to have been generated before?</span></li><li class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof ContentPasted4 ContentPasted5 ContentPasted6">We had included links to specific tools but now see that these (and more!) may be found at https://cabforum.org/resources/tools/
under "Check for Bad Private Keys". We have edited the section to direct to this resource.<br>
</span></li></ul>
<div class="elementToProof"><span class="ContentPasted2 ContentPasted3 elementToProof ContentPasted4 ContentPasted5 ContentPasted6">Regards,<br>
<br>
Chris K</span></div>
<div class="elementToProof"><br>
</div>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<div class="elementToProof"><br>
</div>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<br>
</div>
</body>
</html>