Re: DarkMatter Concerns

2019-03-03 Thread Ryan Sleevi via dev-security-policy
On Sun, Mar 3, 2019 at 5:54 PM Matthew Hardeman via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > On Sun, Mar 3, 2019 at 2:17 PM bxward85--- via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > > > > > Insane that this is even being debated. If the

Re: DarkMatter Concerns

2019-03-03 Thread Matthew Hardeman via dev-security-policy
On Sun, Mar 3, 2019 at 2:17 PM bxward85--- via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > Insane that this is even being debated. If the floodgates are opened here > you will NOT be able to get things back under control. > While I can appreciate the passion of

Re: DarkMatter Concerns

2019-03-03 Thread bxward85--- via dev-security-policy
On Friday, February 22, 2019 at 2:21:24 PM UTC-7, Wayne Thayer wrote: > The recent Reuters report on DarkMatter [1] has prompted numerous questions > about their root inclusion request [2]. The questions that are being raised > are equally applicable to their current status as a subordinate CA

Re: Incident report for DarkMatter CA - change to 128-bit serialNumbers

2019-03-03 Thread Scott Rea via dev-security-policy
Thanks Ryan! Honestly I would prefer things to be clean, but obviously new Root ceremonies also come at a significant cost... I am happy to be guided by Kathleen and Co on this to ensure the community standards are maintained without playing favorites. But if it becomes necessary for the

Re: Incident report for DarkMatter CA - change to 128-bit serialNumbers

2019-03-03 Thread Ryan Sleevi via dev-security-policy
This is a question for Kathleen, as Module Owner. In the past, CAs which have had BR violations in their root certificates - such as negative serial numbers, improper DER encodings, or RFC5280 violations (such as keyUsages) - have been required to create new roots before inclusion progresses.

Re: Incident report for DarkMatter CA - change to 128-bit serialNumbers

2019-03-03 Thread Scott Rea via dev-security-policy
G’day Folks, we have updated https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 with the latest actions taken by DarkMatter A question I am posing to this list relates to the trust anchors produced with 64-bit serial numbers... A Root certificate is included by explicit trust, and