On Monday, 10 April 2017 20:28:53 UTC+1, [email protected] wrote: > A couple points of clarification please: > > 1) Mr. Byrne clarified his post to note that the flaws in the Symantec API > would allow: retrieval of certificates that included private keys, not the > private keys alone. Was this possible?
"certificates that included private keys" would presumably mean PKCS#12 files which consist of one or more certificates plus the private key corresponding to the public key in the leaf certificate. PKCS#12 is a convenient choice for some TLS server software because everything is bundled together. It is not very helpful for end users because it's difficult to reason about it correctly, the certificates are public documents but the private key mustn't be revealed to anyone. >From Symantec's point of view this is a trivial mechanical difference from >delivering just the private key, it's the same data in a different format. So >if they say they never even have private keys I think we shouldn't keep >badgering them about that unless we have evidence to the contrary. The X.509 certificate itself can't include a private key, if that's what Mr Byrne meant then he simply knows nothing about the technology and we should discount his opinion anywhere it goes beyond the presented evidence. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
