On Fri, June 19, 2015 11:10 am, Brian Smith wrote:
The current set of roots is already too big for small devices to
reasonably
manage, and that problem will get worse as more roots are added. Thus,
small devices have to take a subset of Mozilla's/Microsoft's/Apple's
roots.
Without
On 17/06/15 22:50, Brian Smith wrote:
By small scope, I'm referring to CAs who limit their scope to a certain
geographical region, language, or type of institution.
I'm not sure how that neuters my objection. CAs who do more than DV will
need to have local infrastructure in place for identity
On 18/6/2015 12:50 πμ, Brian Smith wrote:
I did, in my original message. HARICA's constraint includes *.org, which is
much broader in scope than they intend to issue certificates for. dNSName
constraints can't describe HARICA's scope.
Cheers,
Brian
Hi Brian,
It is very common for projects,
Gervase Markham g...@mozilla.org wrote:
On 06/06/15 02:12, Brian Smith wrote:
Richard Barnes rbar...@mozilla.com wrote:
Small CAs are a bad risk/reward trade-off.
Why do CAs with small scope even get added to Mozilla's root program in
the
first place? Why not just say your scope is
Are https://technet.microsoft.com/en-us/library/cc751157.aspx and
http://aka.ms/auditreqs the MSFT components (previously?) under NDA?
Government CAs must restrict server authentication to .gov domains and
may only issues other certificates to the ISO3166 country codes that
the country has
On Fri, Jun 12, 2015 at 3:46 PM, Tom Ritter t...@ritter.vg wrote:
Are https://technet.microsoft.com/en-us/library/cc751157.aspx and
http://aka.ms/auditreqs the MSFT components (previously?) under NDA?
The published requirements are not under NDA. Microsoft released a
draft version under NDA
On 06/06/15 02:12, Brian Smith wrote:
Richard Barnes rbar...@mozilla.com wrote:
Small CAs are a bad risk/reward trade-off.
Why do CAs with small scope even get added to Mozilla's root program in the
first place? Why not just say your scope is too limited to be worthwhile
for us to
On 31/05/15 23:43, Ryan Sleevi wrote:
I agree, this is the strongest argument against government CAs presented
in this thread, and I wish this, rather than the musings of secret courts
and maybe impossibles, was the core of your argument.
These arguments apply not just to government CAs
On Tuesday 09 June 2015 11:57:40 Rick Andrews wrote:
On Tuesday, June 9, 2015 at 3:05:30 AM UTC-7, Hubert Kario wrote:
True, OTOH, if a third party says that there was a misissuance, that means
there was one.
I disagree. Only the domain owner knows for sure what is a misissuance, and
what
On Tue, Jun 09, 2015 at 12:00:23PM -0700, Rick Andrews wrote:
On Tuesday, June 9, 2015 at 7:45:05 AM UTC-7, Kurt Roeckx wrote:
On 2015-06-09 15:26, Peter Kurrasch wrote:
3) How frequently might such tools run? Or to put it differently, how
much time do I probably have between when I
On Tue, Jun 09, 2015 at 08:26:55AM -0500, Peter Kurrasch wrote:
1) How to exclude domains from the search? For example I want to find
gmail certs but exclude something like eggmail which could be a false
positive.
Constrain your search to domains which have a name part which is exactly
On 10/06/15 01:54, Matt Palmer wrote:
On Tue, Jun 09, 2015 at 10:44:58AM +0100, Rob Stradling wrote:
On 09/06/15 04:05, Clint Wilson wrote:
To further support your claims here, Chris, there are already tools coming out
which actively monitor domains in CT logs and can be set up with
I don't understand. The domain owner/admin is not a third party.
-Rick
On Jun 10, 2015, at 4:01 AM, Hubert Kario hka...@redhat.com wrote:
On Tuesday 09 June 2015 11:57:40 Rick Andrews wrote:
On Tuesday, June 9, 2015 at 3:05:30 AM UTC-7, Hubert Kario wrote:
True, OTOH, if a third party
On Wednesday 10 June 2015 07:28:06 Rick Andrews wrote:
I don't understand. The domain owner/admin is not a third party.
the third party in question was an entity running the CT service
and since they can produce a certificate signed by a trusted CA as a proof of
misissuance, the data itself
On 09/06/15 04:05, Clint Wilson wrote:
To further support your claims here, Chris, there are already tools coming out
which actively monitor domains in CT logs and can be set up with notifications
of misissuance:
https://www.digicert.com/certificate-monitoring/
On 2015-06-09 15:26, Peter Kurrasch wrote:
3) How frequently might such tools run? Or to put it differently, how much time
do I probably have between when I issue a gmail cert and when someone figures
it out (and of course how much longer before my illegitimate cert is no longer
valid)? I
On Tuesday, June 9, 2015 at 3:05:30 AM UTC-7, Hubert Kario wrote:
True, OTOH, if a third party says that there was a misissuance, that means
there was one.
I disagree. Only the domain owner knows for sure what is a misissuance, and
what isn't. It seems likely that I might turn over all known
On Tuesday, June 9, 2015 at 7:45:05 AM UTC-7, Kurt Roeckx wrote:
On 2015-06-09 15:26, Peter Kurrasch wrote:
3) How frequently might such tools run? Or to put it differently, how much
time do I probably have between when I issue a gmail cert and when someone
figures it out (and of course
On Tue, Jun 09, 2015 at 12:00:23PM -0700, Rick Andrews wrote:
On Tuesday, June 9, 2015 at 7:45:05 AM UTC-7, Kurt Roeckx wrote:
On 2015-06-09 15:26, Peter Kurrasch wrote:
3) How frequently might such tools run? Or to put it differently, how
much time do I probably have between when I
On Tuesday, June 9, 2015 at 12:23:57 PM UTC-7, Kurt Roeckx wrote:
On Tue, Jun 09, 2015 at 12:00:23PM -0700, Rick Andrews wrote:
On Tuesday, June 9, 2015 at 7:45:05 AM UTC-7, Kurt Roeckx wrote:
On 2015-06-09 15:26, Peter Kurrasch wrote:
3) How frequently might such tools run? Or to put it
On Fri, Jun 5, 2015 at 8:04 AM, Peter Kurrasch fhw...@gmail.com wrote:
Certificate Transparency gets us what we want, I think. CT works
globally, and is safer, and significantly changes the trust equation:
* Reduces to marginal/effectively destroys the attack value of mis-issuance
Please
My point is that you cannot say CT effectively destroys the attack value of
mis-issuance and then as justification say that you are assuming someone will
notice. This is the gap I'm talking about: the space between when a
mis-issuance takes place and when someone notices.
For the sake of
To further support your claims here, Chris, there are already tools coming out
which actively monitor domains in CT logs and can be set up with notifications
of misissuance:
https://www.digicert.com/certificate-monitoring/
You have a lot of ideas in here, Richard!
Asking the question what is the increased risk we face by introducing new CA's
and new roots into the trust store? is a good idea. How we go about answering
that gets tricky. It might be helpful to articulate some threat models facing
CA's, both
Richard Barnes rbar...@mozilla.com wrote:
Small CAs are a bad risk/reward trade-off.
Why do CAs with small scope even get added to Mozilla's root program in the
first place? Why not just say your scope is too limited to be worthwhile
for us to include?
One way to balance this equation
On Thu, Jun 4, 2015 at 9:18 PM, Chris Palmer pal...@google.com wrote:
Certificate Transparency gets us what we want, I think. CT works
globally, and is safer, and significantly changes the trust equation:
* Reduces to marginal/effectively destroys the attack value of mis-issuance
* Makes it
Hi Richard,
On Thu, Jun 04, 2015 at 02:44:00PM -0400, Richard Barnes wrote:
The thing that was driving my earlier proposal with regard to name
constraints was a feeling of imbalance. With every CA we add to our
program we add risk for every site on the web. That cost is supposed to be
I'd like to try to up-level some of the discussions we're having about name
constraints, to see if we can find some higher-level consensus.
The thing that was driving my earlier proposal with regard to name
constraints was a feeling of imbalance. With every CA we add to our
program we add risk
On Sun, May 31, 2015 at 6:43 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
On Sat, May 30, 2015 2:47 pm, Brian Smith wrote:
The main sticks that browsers have in enforcing their CA policies is the
threat of removal. However, such a threat seem completely empty when
removal
On Sat, May 30, 2015 2:47 pm, Brian Smith wrote:
It seems reasonable to assume that governments that have publicly-trusted
roots will provide essential government services from websites secured
using certificates that depend on those roots staying publicly-trusted.
Further, it is likely
On Sun, May 31, 2015 at 3:43 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
On Sat, May 30, 2015 2:47 pm, Brian Smith wrote:
IIRC, in the past, we've seen CAs that lapse in compliance with Mozilla's
CA policies and that have claimed they cannot do the work to become
compliant again
On Sun, May 31, 2015 at 12:43 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
However, that you later bring in the idea that government's may pass laws
that make it illegal for browsers to take enforcement is, arguably,
without merit or evidence. If we accept that governments may pass
Gervase Markham g...@mozilla.org wrote:
1) Is the security analysis relating to government CAs, as a class,
different to that relating to commercial CAs? If so, how exactly?
It seems reasonable to assume that governments that have publicly-trusted
roots will provide essential government
On 21/05/15 13:56, Peter Kurrasch wrote:
Returning to your original post, Gerv
Thank you :-)
So here is where the difference really lies between government and
commercial CAs: control. Governments and, therefore, government CAs
wield a level of control that commercial entities normally
On 19/05/15 12:14, Matt Palmer wrote:
The *leverage* that can be applied to any particular CA doesn't change based
on who operates it. Regardless of the operator, the only leverage we have
is removal of the CA's root certs from the trust store (or otherwise
neutering them). That certain CAs
On 19/05/15 13:14, Kurt Roeckx wrote:
On 2015-05-14 17:25, Gervase Markham wrote:
CAs currently in Mozilla's program which may fit one or more definitions
of government CA are:
It might be a little out of scope of your question, but maybe we should
agree on what we think the (government)
On Mon, May 18, 2015 10:39 pm, Eric Mill wrote:
You said: I disagree that we, the browsers and standards bodies of the
Internet have
very different leverage [over governments than corporations]. My
description above wasn't to lay out the ills of the world, but to describe
why the kind of
On 2015-05-19 12:04, Gervase Markham wrote:
On 18/05/15 17:39, Kurt Roeckx wrote:
On the other hand, if it covers the whole country, they can abuse
it for domains in that country, but not for other domains. I'm
not sure why you would find it acceptable that they can abuse it
in their own
On 19/05/15 02:15, Matt Palmer wrote:
I disagree that we, the browsers and standards bodies of the Internet have
very different leverage. In either case, if a CA misbehaves, their root
certs can be pulled from the trust store (or otherwise neutered). That
doesn't change because the CA is run
On 18/05/15 17:39, Kurt Roeckx wrote:
On the other hand, if it covers the whole country, they can abuse
it for domains in that country, but not for other domains. I'm
not sure why you would find it acceptable that they can abuse it
in their own country.
Some countries, AIUI, do not have an
On 2015-05-14 17:25, Gervase Markham wrote:
CAs currently in Mozilla's program which may fit one or more definitions
of government CA are:
It might be a little out of scope of your question, but maybe we should
agree on what we think the (government) CAs should be able to do and
what not.
On 17/05/15 23:28, Peter Bowen wrote:
I'll bite.
What if Mozilla puts a simple rule in place?
All CAs must either:
- Have a WebTrust for BR and ETSI TS 102 042 assessment conducted by a
assessor who meets the requirements of BR 8.2 or
- Be named constrained
The result of that would be
On 2015-05-18 13:06, Matt Palmer wrote:
On Mon, May 18, 2015 at 12:26:26PM +0200, Kurt Roeckx wrote:
On 2015-05-14 17:25, Gervase Markham wrote:
2) If it is different, does name-constraining government CAs make
things better, or not?
I think it only makes sense to name constrain a government
On 17/05/15 02:12, Ryan Sleevi wrote:
I say this because knowing Gerv, and having participated with him on the
call, I suspect that in part this is motivated by
https://cabforum.org/2015/04/16/2015-04-16-minutes/ , in which Microsoft
has suggested they'll require government CAs (definition not
On 17/05/15 00:45, Eric Mill wrote:
Governments are not subject to the same kind of leverage, accountability or
market forces that corporations are. The legal constraints they operate
under are different, your likelihood of prevailing in a legal action
against them is different (and highly
On 18/05/15 14:45, Gervase Markham wrote:
On 17/05/15 23:28, Peter Bowen wrote:
I'll bite.
What if Mozilla puts a simple rule in place?
All CAs must either:
- Have a WebTrust for BR and ETSI TS 102 042 assessment conducted by a
assessor who meets the requirements of BR 8.2 or
- Be named
Before I reply, can I say that this level of informed and considered
debate is _exactly_ what I was looking for? Thanks to everyone who has
participated so far.
On 15/05/15 19:49, Ryan Sleevi wrote:
- By introducing a demarcation of power/privilege by government or not
(which still suffers from
On Tue, May 19, 2015 at 12:07 AM, Matt Palmer mpal...@hezmatt.org wrote:
On Mon, May 18, 2015 at 10:32:05PM -0400, Eric Mill wrote:
On Mon, May 18, 2015 at 9:15 PM, Matt Palmer mpal...@hezmatt.org
wrote:
I don't see the relevance of anything you wrote, to the perspective of we,
the
On Mon, May 18, 2015 at 10:32:05PM -0400, Eric Mill wrote:
On Mon, May 18, 2015 at 9:15 PM, Matt Palmer mpal...@hezmatt.org wrote:
I disagree that we, the browsers and standards bodies of the Internet
have
very different leverage. In either case, if a CA misbehaves, their root
certs can
On Mon, May 18, 2015 at 9:15 PM, Matt Palmer mpal...@hezmatt.org wrote:
I disagree that we, the browsers and standards bodies of the Internet
have
very different leverage. In either case, if a CA misbehaves, their root
certs can be pulled from the trust store (or otherwise neutered). That
On Mon, May 18, 2015 at 02:45:26PM +0100, Gervase Markham wrote:
On 17/05/15 23:28, Peter Bowen wrote:
This would seem to be a fairly simple rule.
Indeed. However, this has not addressed my question about whether the
security analysis for government CAs is different to that of commercial
On 2015-05-14 17:25, Gervase Markham wrote:
2) If it is different, does name-constraining government CAs make
things better, or not?
I think it only makes sense to name constrain a government CA if the
name constrained only covers government websites, and not all websites
in the country.
On Mon, May 18, 2015 at 12:26:26PM +0200, Kurt Roeckx wrote:
On 2015-05-14 17:25, Gervase Markham wrote:
2) If it is different, does name-constraining government CAs make
things better, or not?
I think it only makes sense to name constrain a government CA if the name
constrained only covers
On Sun, May 17, 2015 at 5:48 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
On Sun, May 17, 2015 3:28 pm, Peter Bowen wrote:
What if Mozilla puts a simple rule in place?
All CAs must either:
- Have a WebTrust for BR and ETSI TS 102 042 assessment conducted by a
assessor who meets
On Sun, May 17, 2015 6:06 pm, Peter Bowen wrote:
I was assuming this discussion was based on the concept that
Government CAs did not need to meet all the audit criteria. Otherwise
why are we having it?
Why indeed ;)
As I mentioned in my reply to Eric, my own suspicion is that this
On Sun, May 17, 2015 at 7:59 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
On Sun, May 17, 2015 6:06 pm, Peter Bowen wrote:
I was assuming this discussion was based on the concept that
Government CAs did not need to meet all the audit criteria. Otherwise
why are we having it?
On Sat, May 16, 2015 at 6:12 PM, Ryan Sleevi
ryan-mozdevsecpol...@sleevi.com wrote:
On Sat, May 16, 2015 4:45 pm, Eric Mill wrote:
Another factor is _why_ the government CA is applying to the trusted
root
program. If the government CA only intends to issue certs for its own
On Thu, May 14, 2015 at 8:25 AM, Gervase Markham g...@mozilla.org wrote:
The topic of name-constraining government CAs, probably to the TLD(s) of
their territory(ies), has come up numerous times. I'd like to try and
hash out, once and for all, whether we think this is actually a good
idea, so
(I guess we're all wearing our affiliations on our backs, but disclosure:
I'm a US federal government employee, but am not speaking on behalf of the
USG, and don't have any professional affiliation with the US FPKI run out
of the Treasury Department.)
On Fri, May 15, 2015 at 11:49 AM, Ryan Sleevi
On 15/05/15 00:01, Ryan Sleevi wrote:
On Thu, May 14, 2015 9:02 am, David E. Ross wrote:
With cyberwarfare constantly discussed in the news, U.S. Congress, and
other venues, it appears to me that government CAs should indeed be
restricted to the TLDs of their respective jurisdictions.
On 14/05/15 17:02, David E. Ross wrote:
There is an ongoing dispute between the U.S. and China whether the
government in China is behind attacks on both government and commercial
computer systems in the U.S. This is NOT to question the
trustworthiness of the government of China but to give
Everything that Ryan says below, is what I would have said if I were as
eloquent.
- Matt
On Fri, May 15, 2015 at 11:49:39AM -0700, Ryan Sleevi wrote:
On Fri, May 15, 2015 1:52 am, Gervase Markham wrote:
On 15/05/15 00:01, Ryan Sleevi wrote:
I think there's also the broader consideration
On Fri, May 15, 2015 1:52 am, Gervase Markham wrote:
On 15/05/15 00:01, Ryan Sleevi wrote:
I think there's also the broader consideration of whether Mozilla's
policy
interests are served by promoting borders on the Internet, which David's
proposal certainly does, but the broader question
On 5/14/2015 8:25 AM, Gervase Markham wrote:
Hi everyone,
The topic of name-constraining government CAs, probably to the TLD(s) of
their territory(ies), has come up numerous times. I'd like to try and
hash out, once and for all, whether we think this is actually a good
idea, so we can
64 matches
Mail list logo
