[cabfpub] Ballot 99: Add support for DSA keys

[Dean Coclin]

All,

Voting on this ballot has commenced and will close this Friday.

 

Dean

 

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On
Behalf Of Rick Andrews
Sent: Thursday, April 18, 2013 1:22 PM
To: public at cabforum.org
Subject: [cabfpub] Ballot 99: Add support for DSA keys

 

Rick Andrews made the following motion, and Adam Langley from Google and
Erwann Abalea from Keynectis endorsed it: 

... Motion Begins ... 

... Erratum Begins ... 

 

In the Baseline Requirements for the Issuance and Management of
Publicly-Trusted Certificates, Appendix A, add to each of the tables (1)
Root CA Certificates, (2) Subordinate CA Certificates, and (3) Subscriber
Certificates a new row with these three column entries (comma-separated):

Minimum DSA modulus and divisor size (bits) ***, L= 2048, N= 224 or L= 2048,
N= 256, L= 2048, N= 224 or L= 2048, N= 256 

 

Following Table 3, change the first sentence to read (++added language++):

* SHA-1 MAY be used ++with RSA keys++ until SHA-256 is supported widely by
browsers used by a substantial portion of relying-parties worldwide. 

 

After "** A Root CA Certificate issued...", add: 

*** L and N (the bit lengths of modulus p and divisor q, respectively) are
described in the Digital Signature Standard, FIPS 186-3
(http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf). 

 

To Section "(4) General requirements for public keys", add: 

DSA: Although FIPS 800-57 says that domain parameters may be made available
at some accessible site, compliant DSA certificates MUST include all domain
parameters. This is to insure maximum interoperability among relying party
software. The CA MUST confirm that the value of the public key has the
unique correct representation and range in the field, and that the key has
the correct order in the subgroup. [Source: Section 5.3.1, NIST SP 800-89]. 

 

ECC: The CA SHOULD confirm the validity of all keys using either the ECC
Full Public Key Validation Routine or the ECC Partial Public Key Validation
Routine. [Source: Sections 5.6.2.5 and 5.6.2.6, respectively, NIST SP
800-56A]. 

 

... Erratum Ends ... 

 

PDF and Word versions of the proposed changes in redline are posted as
attachments to the wiki page
(https://www.cabforum.org/wiki/99%20-%20Add%20DSA%20Keys) and attached to
this email for easier reading.

 

The review period for this ballot shall commence at 21:00 UTC on 19 April
2013 and will close at 21:00 UTC on 26 April 2013. Unless the motion is
withdrawn during the review period, the voting period will start immediately
thereafter and will close at 21:00 UTC on 3 May 2013. Votes must be cast by
posting an on-list reply to this thread. 

 

... Motion ends ... 

 

A vote in favor of the motion must indicate a clear 'yes' in the response. 

 

A vote against must indicate a clear 'no' in the response. A vote to abstain
must indicate a clear 'abstain' in the response. Unclear responses will not
be counted. The latest vote received from any representative of a voting
member before the close of the voting period will be counted. 

Voting members are listed here: http://www.cabforum.org/forum.html 

 

In order for the motion to be adopted, two thirds or more of the votes cast
by members in the CA category and one half or more of the votes cast by
members in the browser category must be in favor. Also, at least six members
must participate in the ballot, either by voting in favor, voting against or
abstaining. 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20130429/6cd6eba7/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6083 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20130429/6cd6eba7/attachment-0001.p7s>