<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I support Paul’s idea to change this to SHOULD. Why should we create new recommendations against RFC when this extension is useful in several use cases and almost everybody is using it now.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Pekka<o:p></o:p></p>
<p class="MsoNormal">Telia Company <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> Validation <validation-bounces@cabforum.org> <b>
On Behalf Of </b>Aaron Gable via Validation<br>
<b>Sent:</b> torstai 1. joulukuuta 2022 3.11<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Subject:</b> Re: [cabf_validation] RFC 5280 conflict for SKI in subscriber certificates<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">"SHOULD" <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-3">
means</a> that "there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.". In the profiles draft, the subjectKeyIdentifier is
profiled as a MUST for all CA certificates, and only as NOT RECOMMENDED for end-entity certificates.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In my opinion, the better way to resolve this discrepancy between RFC 5280 and the BRs is to document in Section 7.1.2.11.4
<i>why</i> this field is not useful for end-entity certs: namely, that no other certificate will ever contain the same value in its Authority Key Identifier extension, so it serves little-to-no purpose and simply increases the size of the certificate with usually-redundant
(i.e. derived from the public key by a simple hash function) data.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Aaron<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Nov 30, 2022 at 12:36 PM Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black">Section 7.1.2.7.6 (Subscriber Certificate Extensions) of the new certificate profiles state that the inclusion of the subjectKeyIdentifier is NOT RECOMMENDED, this contradicts
section 4.2.1.2 (Subject Key Identifier) of RFC 5280 that states that entity certificates SHOULD include the SKI: <o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> For end entity certificates, the subject key identifier extension </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> provides a means for identifying certificates containing the </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> particular public key used in an application. Where an end entity </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> has obtained multiple certificates, especially from multiple CAs, the </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> subject key identifier provides a means to quickly identify the set </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> of certificates containing a particular public key.
<span style="background:yellow">To assist </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black;background:yellow"> applications in identifying the appropriate end entity certificate, </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Courier New";color:black;background:yellow"> this extension SHOULD be included in all end entity certificates.</span><span style="font-size:10.0pt;font-family:"Courier New";color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black">Looking at the data from Censys we also see that almost all end-entity certificates include the SKI: <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black"><a href="https://search.censys.io/certificates?q=%28tags.raw%3A+%22precert%22+AND+tags.raw%3A+%22trusted%22%29+AND+NOT+parsed.extensions.subject_key_id%3A+%2A" target="_blank">(tags.raw:
"precert" AND tags.raw: "trusted") AND NOT parsed.extensions.subject_key_id: * - Censys</a> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black">Can we align the profile with RFC 5280 and change the inclusion of the SKI to a SHOULD instead of the current NOT RECOMMENDED? <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;background:white"><span style="color:black">Paul <o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute
or disclose of the information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
<o:p></o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Validation mailing list<br>
<a href="mailto:Validation@cabforum.org" target="_blank">Validation@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/validation" target="_blank">https://lists.cabforum.org/mailman/listinfo/validation</a><o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
<div style="font-size:9pt; font-family: 'Calibri',sans-serif;"><br>
<i>This email may contain information which is privileged or protected against unauthorized disclosure or communication. If you are not the intended recipient, please notify the sender and delete this message and any attachments from your system without producing,
distributing or retaining copies thereof or disclosing its contents to any other person.
<br>
<br>
Telia Company processes emails and other files that may contain personal data in accordance with Telia Company’s
<a href="https://www.teliacompany.com/en/about-the-company/privacy/">Privacy Policy</a>.</i>
<br>
<br>
<br>
</div>
</body>
</html>