On 5/4/2018 12:26 πμ, Wayne Thayer via dev-security-policy wrote:
CAs MUST not distribute or transfer certificates in PKCS#12 form through
insecure electronic channels. If a PKCS#12 file is distributed via a
physical data storage device, then:
* The storage must be packaged in a way that the opening of the package
causes irrecoverable physical damage. (e.g. a security seal)
* The PKCS#12 file must have a sufficiently secure password, and the
password must not be transferred together with the storage.
I would appreciate everyone's input on this topic.
This is:https://github.com/mozilla/pkipolicy/issues/107
I think the description for the PKCS#12 distribution via a physical data
storage device is overly prescriptive for a Policy document. I can think
of different ways to securely deliver such a file without needing the
first bullet. The intent of the policy is generally captured in the
first sentence "CAs MUST NOT distribute or transfer certificates in
PKCS#12 form through insecure electronic channels" and could include the
"physical" distribution by either removing the word "electronic" or by
adding the "physical" in the same sentence.
My proposal is "CAs MUST NOT distribute or transfer private keys and
associated certificates in PKCS#12 form through insecure physical or
electronic channels " and remove the rest.
Dimitris.
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy
