[cabfpub] Teleconference Agenda

[Ben Wilson]

If you had 20 or 30 minutes to discuss these items, how would you suggest that we divide the time?

-------- Original message --------
From: Erwann Abalea <erwann.abalea at keynectis.com> 
Date: 11/06/2013  7:09 AM  (GMT-08:00) 
To: public at cabforum.org 
Subject: Re: [cabfpub] Teleconference Agenda 
 
Le 06/11/2013 14:59, Håvard Molland a écrit :
On 11/05/2013 10:16 PM, Ben Wilson wrote:
Besides reviewing working group status, new web site, and draft bylaws, which I'll send out soon, what other hot topics should we add to Thursday's discussion?  Remember, it will be an hour earlier for most of you.

I would like that we discuss that some CAs generate the site       certificate's private key for their customers.  It is my opinion that this breaks the trust model and, especially in the light of recent events, I believe this is a bad practice. 

In the light of older published results (weak Debian keys, lack of entropy on some devices as explained in the "Mining your P's and Q's" and subsequent papers), it can also be seen as a good practice. We at Keynectis don't do that, but I can accept the positive arguments for such practices.

We could also discuss elliptic curves and recent worries that certain curve constants might have been manipulated: http://slashdot.org/submission/2947823/are-the-nist-standard-elliptic-curves-back-doored

Please distinguish the Dual_EC_DRBG and NIST curves concerns. Dual_EC_DRBG has certainly been weakened, while there's still some doubts regarding NIST curves. Maybe it's time to allow for other curves, Brainpool ones come to mind (RFC5639).

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20131106/5f2776c9/attachment-0003.html>