Re: [FORGED] TeletexString

2018-07-08 Thread Ryan Sleevi via dev-security-policy
On Sat, Jul 7, 2018 at 4:43 AM, Kurt Roeckx via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > On Sat, Jul 07, 2018 at 01:23:24AM +, Peter Gutmann via > dev-security-policy wrote: > > > > So for certlint I'd always warn for T61String with anything other than > ASCII > >

Re: [FORGED] TeletexString

2018-07-08 Thread Kurt Roeckx via dev-security-policy
On Sun, Jul 08, 2018 at 04:41:27PM -0400, Ryan Sleevi wrote: > > Is that because you believe it forbidden by spec, or simply unwise? It's because nobody implements the spec. Those the claim some support for it are just broken. I have yet to see a certificate that doesn't just put latin1 in it,

Re: [FORGED] TeletexString

2018-07-08 Thread Peter Bowen via dev-security-policy
On Sun, Jul 8, 2018 at 2:34 PM Kurt Roeckx wrote: > On Sun, Jul 08, 2018 at 04:41:27PM -0400, Ryan Sleevi wrote: > > > > Is that because you believe it forbidden by spec, or simply unwise? > > It's because nobody implements the spec. Those the claim some > support for it are just broken. I have

Re: [FORGED] Re: [FORGED] TeletexString

2018-07-08 Thread Peter Gutmann via dev-security-policy
​Ryan Sleevi writes: >Is that because you believe it forbidden by spec, or simply unwise? The spec allows almost anything, and in particular because there isn't any one definitive "spec" you can have ten incompatible interpretations that are all compliant to something that can claim to be the

Re: [FORGED] TeletexString

2018-07-08 Thread Peter Gutmann via dev-security-policy
Kurt Roeckx writes: >I have yet to see a certificate that doesn't just put latin1 in it, which >should get rejected. There were some Deutsche Telekom certificates from the late 1990s that used T61String floating diacritics for which I had some custom code to identify the two-character sequences

Re: [FORGED] TeletexString

2018-07-08 Thread Peter Gutmann via dev-security-policy
Kurt Roeckx writes: >I think it should generate an error on any character not defined in 102 and >the space character. So any time you try to use anything in C0, C1 and G1, >and those 6 in 102 that are not defined. Yep, sounds good. With a possible check for latin-1 validity as well in case

Re: Chunghwa Telecom eCA Root Inclusion Request

2018-07-08 Thread lcchen.cissp--- via dev-security-policy
Dear Wayne, The previous email has some typos, corrected as follows. 1. When I was back to my office after the travlelling from England and disussed with my colleauges, I mailed the situation and the plan to Wayne and Kathleen on June 15. > When I was back to my office after the