Rick - The CRL Timeout question had to do with behaviour in the event that no response to the CRL request is received. How long before the software decides it won't wait any longer and what does it do then?
All the best. Tim. -----Original Message----- From: Rick Andrews [mailto:[email protected]] Sent: Tuesday, December 03, 2013 8:06 PM To: t.petch Cc: [email protected]; Tim Moses Subject: RE: [wpkops] Early draft of vendor questionnaire Tom, You sent two emails with comments; I'm going to combine them together and address both at once. I'm attaching the latest version of the document. -Rick > -----Original Message----- > From: t.petch [mailto:[email protected]] > Sent: Wednesday, November 27, 2013 10:24 AM > > Tom. These are good points. They relate more to the TLS stack than > the PKI. But, they are relevant for all that. > > Can you provide specific questions? > > Tim > > Yes, my thoughts have a TLS bias but that is what I got from reading > the document! That's fine; I think the WG has a TLS bias. > And I find the document quite large already and am reluctant to add > more to it without removing something. That worries me a bit. The state of Web PKI today is complex. We're trying to find our way through that complexity, and I don't think we'll learn very much if we keep the questions short and/or simple. On the other hand, I don't want this to get too big to be unwieldy. > I think that Server Q1 is inappropriate for two reasons. > 1) Different versions of eg Windows Server have very different > capabilities and I would think it verging on the impossible to fill > this in for the different versions. Rather, people should be invited > to fill in a separate questionnaire for each version. And it is the > vendor who knows what makes sense as a version, thus, as I recall, > Windows Vista is the same as 2008R1, but 2008R2 is the same as 7 ie it > is the underlying SChannel that matters, not the terms that might be > used in marketing. > 2) Many, if not most organisations, will not disclose market share and > might stop and go no further - such data is often available but from > other sources such as Universities and large web sites, not from > vendors. I wrote some text in the introduction to encourage responders to make copies of the document for each version, if that's what they'd prefer, or just describe the different behavior of each version in each answer. Let me know if you think that's adequate. > And a second substantial point is Server Q2 which I find misguided - > yes you want to know what is supported but I think that this should be > in terms of TLS ciphersuites - after all, Q8 does not ask what > versions of SSH are in use! But this is the Web *PKI* Ops working group, and ciphersuites are not exclusively related to PKI. I'm inclined to avoid discussing ciphersuite support to keep the survey simpler. > And my third substantial point is Server Q8 which I think fundamental, > and which should come earlier, perhaps second (assuming that the > emphasis on TLS is correct); and it is a complex question, it is > really about the negotiation that takes place to find a version > acceptable to client and server which in turn affects the available > ciphersuites and so on. I am not sure how to rephrase this question > and will think some more. I'll move it if you feel it's important. I didn't pay much attention to the order of questions, since I expect that responders will answer all questions. ------------------------------------------------------------------------- > -----Original Message----- > From: t.petch [mailto:[email protected]] > Sent: Wednesday, November 27, 2013 2:31 AM > To: Rick Andrews; [email protected] > Subject: Re: [wpkops] Early draft of vendor questionnaire > > Complicated:-( Perhaps there is a danger of losing the wood for the > trees. > > Thus, I think of TLS in terms of cipher suites and think that software > vendors would too; the mix and match approach of algorithms in 2) > (where is RC4 or AEAD or AES-GCM?) seems likely to produce the wrong answers. See my answer above re: ciphersuites vs. PKI aspects. > I also think of TLS in terms of versions, of which there are two > values that appear separately in setting up a TLS connection, and many > software vendors would appear not to understand what the specification > says in that regard and so are in breach of it. Fallback attacks > derived therefrom are a significant part of using TLS. Can you craft a question to capture this concern? > And then there is Key Usage; some check, other do not. I added a question I got from Wayne: 18) Does the product enforce key usage constraints? __ Yes, via Key Usage __ Yes, via Extended Key Usage __ Yes, via metadata associated with the root Is that adequate, or do you have additional concerns? > And the hot topic of three years ago was Renego and support for it; > still significant today. Links into fallback attacks. I'm inclined to not include this a) because it's not PKI-related, strictly speaking, and b) to keep the survey simpler. > While a running sore is where does the software get its identifier > from; this document keeps talking of DN (I wonder how common that is). > RFC6125 should probably be in there somewhere. Can you craft a question to capture this concern? > And the treatment of user certs (I know what Microsoft does and it is > very sensible but suspect that it is unique). I think in a separate thread, we concluded that user certs were out of scope. > etc etc Please elaborate! If you know of additional questions to ask, please feed them to me. _______________________________________________ wpkops mailing list [email protected] https://www.ietf.org/mailman/listinfo/wpkops
