CA/Browser Forum posts
Posts by author Ben Wilson
2015-05-28 Minutes
May 28, 2015 by Ben WilsonCA/Browser Forum Minutes of May 28, 2015 Attendees: Atsushi Inaba, Atilla Biler, Ben Wilson, Billy VanCannon, Bruce Morton, Connie Enke, Dean Coclin, Doug Beattie, Gerv Markham, Jeremy Rowley, Jody Cloutier, Kubra Zaray, Mads Henriksveen, Mat Caughron, Patrick Tronnier, Peter Miscovic, Rick Andrews, Robin Alden, Ryan Sleevi, Sissel Hoel, Tim Hollebeek, Tim Shirley, Volkan Nergiz, Wayne Thayer Minutes of 14 May meeting were approved. These will be posted to the public list.
May 28, 2015 by Ben WilsonCA/Browser Forum Minutes of May 28, 2015 Attendees: Atsushi Inaba, Atilla Biler, Ben Wilson, Billy VanCannon, Bruce Morton, Connie Enke, Dean Coclin, Doug Beattie, Gerv Markham, Jeremy Rowley, Jody Cloutier, Kubra Zaray, Mads Henriksveen, Mat Caughron, Patrick Tronnier, Peter Miscovic, Rick Andrews, Robin Alden, Ryan Sleevi, Sissel Hoel, Tim Hollebeek, Tim Shirley, Volkan Nergiz, Wayne Thayer Minutes of 14 May meeting were approved. These will be posted to the public list.
2015-05-14 Minutes
May 14, 2015 by Ben WilsonMinutes May 14, 2015 Attendees: Dean Coclin, Ben Wilson, Doug Beattie, Gerv Markham, Atsushi Inaba, Kirk Hall, Atilla Biler, Bruce Morton, Burak Kalkan, Cecilia Kam, Davut Tokgoz, Volkan Nergiz, Rick Andrews, Moudrick Dadashov, Eddy Nigg, Mat Caughron, Tim Hollebeek, Patrick Tronnier, Billy VanCannon, Jeremy Rowley, Robin Alden, Ryan Sleevi Minutes of 30 April meeting were approved. These will be posted to the public list. Ballots: Ballot 149 (Bylaw updates from Kirk): Kirk wants to hold the ballot until the WebTrust audit team determines what the new name of the audit will be. Domain Validation Ballot*: There are a few open issues on this ballot:Working on revising #10 from the list. Some folks were concerned with the “test cert” provision. Tim H said the test cert should be allowed and that #10 needs to be tightened up. A longer discussion in the working group is warranted. Kirk also said it needs more details to make it more like methods 6-9 (which are explicit). Ryan also agreed. Jeremy said he put Doug’s proposed method in the proposal for now. The “random value” was 128 bits but Kirk wanted it back to 112 bits. Kirk said that 128 bits was overkill. The random value is provided by the CA to applicants so it’s not practically predictable by hackers. Kirk felt the lower value is adequate (and is commonly used for some other purpose). Ryan disagreed and said there were threats like reversible random number generators and things like passive observation which may allow for reconstruction of the RNG. He would like to see the standard to be 128 bits. Tim said he also had these concerns but after looking into Java Secure random generator (which apparently doesn’t do 128 bits) he felt it was cryptographically secure and is no longer concerned. Gerv said the cryptographic strength of the generator is more important than the bit size but feared that specifying a smaller key size would lead people to use a less secure RNG. Kirk challenged the security issue. Ryan further explained (and said we should err on the side of caution) that a network based adversary could observe traffic sent to a CA’s customer and (theoretically) predict a random number challenge sent to a future customer and cause a miss-issuance which is not the CA’s fault. Gerv suggested a compromise of specifying a cryptographically strong random number generator (with a lower key size) instead of specifying a higher key size (which would include the Java generator but not the Windows GUID generator). Doug said an adversary could submit an order and get a random string back w/o monitoring the network (Ryan’s example threat). Ryan said it depends on the type of cert (OV/EV vs DV). Rick said how would an auditor determine if a RNG is cryptographically secure. Ryan said in theory they should but in reality, recent reports and events prove they probably don’t. But he said it could be an auditable requirement. Tim H. said that in the financial industry, this type of thing gets audited all the time. Kirk said this is not the place we should be focusing this type of effort. Ryan asked what harm a requirement for 128 bits would cause. Kirk said what CAs are using today may not meet that requirement and it would be a wasted effort to get people to switch for no real benefit. Ryan said there are already requirements for cryptographically strong random number generators but Kirk said for this issue, it wasn’t that important. Discussion was terminated due to time constraints.
May 14, 2015 by Ben WilsonMinutes May 14, 2015 Attendees: Dean Coclin, Ben Wilson, Doug Beattie, Gerv Markham, Atsushi Inaba, Kirk Hall, Atilla Biler, Bruce Morton, Burak Kalkan, Cecilia Kam, Davut Tokgoz, Volkan Nergiz, Rick Andrews, Moudrick Dadashov, Eddy Nigg, Mat Caughron, Tim Hollebeek, Patrick Tronnier, Billy VanCannon, Jeremy Rowley, Robin Alden, Ryan Sleevi Minutes of 30 April meeting were approved. These will be posted to the public list. Ballots: Ballot 149 (Bylaw updates from Kirk): Kirk wants to hold the ballot until the WebTrust audit team determines what the new name of the audit will be. Domain Validation Ballot*: There are a few open issues on this ballot:Working on revising #10 from the list. Some folks were concerned with the “test cert” provision. Tim H said the test cert should be allowed and that #10 needs to be tightened up. A longer discussion in the working group is warranted. Kirk also said it needs more details to make it more like methods 6-9 (which are explicit). Ryan also agreed. Jeremy said he put Doug’s proposed method in the proposal for now. The “random value” was 128 bits but Kirk wanted it back to 112 bits. Kirk said that 128 bits was overkill. The random value is provided by the CA to applicants so it’s not practically predictable by hackers. Kirk felt the lower value is adequate (and is commonly used for some other purpose). Ryan disagreed and said there were threats like reversible random number generators and things like passive observation which may allow for reconstruction of the RNG. He would like to see the standard to be 128 bits. Tim said he also had these concerns but after looking into Java Secure random generator (which apparently doesn’t do 128 bits) he felt it was cryptographically secure and is no longer concerned. Gerv said the cryptographic strength of the generator is more important than the bit size but feared that specifying a smaller key size would lead people to use a less secure RNG. Kirk challenged the security issue. Ryan further explained (and said we should err on the side of caution) that a network based adversary could observe traffic sent to a CA’s customer and (theoretically) predict a random number challenge sent to a future customer and cause a miss-issuance which is not the CA’s fault. Gerv suggested a compromise of specifying a cryptographically strong random number generator (with a lower key size) instead of specifying a higher key size (which would include the Java generator but not the Windows GUID generator). Doug said an adversary could submit an order and get a random string back w/o monitoring the network (Ryan’s example threat). Ryan said it depends on the type of cert (OV/EV vs DV). Rick said how would an auditor determine if a RNG is cryptographically secure. Ryan said in theory they should but in reality, recent reports and events prove they probably don’t. But he said it could be an auditable requirement. Tim H. said that in the financial industry, this type of thing gets audited all the time. Kirk said this is not the place we should be focusing this type of effort. Ryan asked what harm a requirement for 128 bits would cause. Kirk said what CAs are using today may not meet that requirement and it would be a wasted effort to get people to switch for no real benefit. Ryan said there are already requirements for cryptographically strong random number generators but Kirk said for this issue, it wasn’t that important. Discussion was terminated due to time constraints.
2015-04-30 Minutes
April 30, 2015 by Ben WilsonAttendees: Dean Coclin, Ben Wilson, Doug Beattie, Gerv Markham, Atsushi Inaba, Kirk Hall, Volkan Nergiz, Rick Andrews, Moudrick Dadashov, Kubra Zeray, Eddy Nigg, Wayne Thayer, Mads Henriksveen, Sissel Hoel, Tim Hollebeek, Billy VanCannon, Jeremy Rowley, Tim Shirley, Peter Miskovic, Robin Alden, Ryan Sleevi Minutes of 16 April meeting were approved. These will be posted to the public list. Ballot 146 (Conversion of BRs): Ballot passed. Ballot 149 (Bylaw updates from Kirk): This ballot adds a WebTrust BR requirement for CAs and also requests that applicants provide an example URL of a site that uses their cert (among some minor procedural changes). Ryan said the ballot changes the WebTrust for CAs to Baseline Requirements which is a concern for Google. The BR audit is currently reflected in the requirements of root stores, membership of which is required for CA/B Forum admission. Ryan said that this new requirement significantly narrows membership to a work product of the forum. Kirk couldn’t understand why any CA would want to join the forum if they didn’t follow the BRs. Ryan said this was irrelevant to the topic and said the primary concern was that the public would have to be subject to rules which the public had no input on. Kirk countered that we require WebTrust for CAs which is in the same category (i.e. no public input). Ryan said this was not a work product of the forum. Gerv gave a scenario whereby some CA may have a problem with the BRs and would like to join to help correct the problem but would be prohibited under Kirk’s proposal. Gerv continued to say that membership in the forum shouldn’t be subject to a forum work product as it gives incumbent members some advantage. Kirk said such an example was not realistic. Gerv said that membership in the CA/B Forum isn’t equivalent to that or root programs. Eddy said before BR guidelines were effective, there was never a requirement to comply with the EV guidelines, as an example. Hence making a requirement to comply with BRs doesn’t make sense. Dean said that if this was the only potential “issue” in the ballot and if the ballot doesn’t pass, we may “decouple” the other issues and propose a separate ballot for those. Both Gerv and Ryan didn’t express concerns on the other parts of the ballot.
April 30, 2015 by Ben WilsonAttendees: Dean Coclin, Ben Wilson, Doug Beattie, Gerv Markham, Atsushi Inaba, Kirk Hall, Volkan Nergiz, Rick Andrews, Moudrick Dadashov, Kubra Zeray, Eddy Nigg, Wayne Thayer, Mads Henriksveen, Sissel Hoel, Tim Hollebeek, Billy VanCannon, Jeremy Rowley, Tim Shirley, Peter Miskovic, Robin Alden, Ryan Sleevi Minutes of 16 April meeting were approved. These will be posted to the public list. Ballot 146 (Conversion of BRs): Ballot passed. Ballot 149 (Bylaw updates from Kirk): This ballot adds a WebTrust BR requirement for CAs and also requests that applicants provide an example URL of a site that uses their cert (among some minor procedural changes). Ryan said the ballot changes the WebTrust for CAs to Baseline Requirements which is a concern for Google. The BR audit is currently reflected in the requirements of root stores, membership of which is required for CA/B Forum admission. Ryan said that this new requirement significantly narrows membership to a work product of the forum. Kirk couldn’t understand why any CA would want to join the forum if they didn’t follow the BRs. Ryan said this was irrelevant to the topic and said the primary concern was that the public would have to be subject to rules which the public had no input on. Kirk countered that we require WebTrust for CAs which is in the same category (i.e. no public input). Ryan said this was not a work product of the forum. Gerv gave a scenario whereby some CA may have a problem with the BRs and would like to join to help correct the problem but would be prohibited under Kirk’s proposal. Gerv continued to say that membership in the forum shouldn’t be subject to a forum work product as it gives incumbent members some advantage. Kirk said such an example was not realistic. Gerv said that membership in the CA/B Forum isn’t equivalent to that or root programs. Eddy said before BR guidelines were effective, there was never a requirement to comply with the EV guidelines, as an example. Hence making a requirement to comply with BRs doesn’t make sense. Dean said that if this was the only potential “issue” in the ballot and if the ballot doesn’t pass, we may “decouple” the other issues and propose a separate ballot for those. Both Gerv and Ryan didn’t express concerns on the other parts of the ballot.
2015-04-16 Minutes
April 16, 2015 by Ben WilsonCA/Browser Forum Minutes Apr. 16, 2015 Attendees: Dean Coclin, Bruce Morton, Atsushi Inaba, Doug Beattie, Kirk Hall, Gerv Markham, Jennifer Stanford, Ben Wilson, Atilla Biler, Volkan Nergiz, Wayne Thayer, Tim Shirley, Robin Alden, Patrick Tronnier, Mads Henriksveen, Ryan Sleevi, Burak Kalkan, Tim Hollebeek, Jody Cloutier, Eddy Nigg, Stephen Davidson, Jeremy Rowley Minutes of 2 April meeting were approved. These will be posted to the public list. Minutes of Cupertino face to face meeting also approved and will be posted. Ballot 146 (Conversion of BRs): Voting closing today. Appears it will pass. Kirk may submit ballot on bylaw changes shortly.
April 16, 2015 by Ben WilsonCA/Browser Forum Minutes Apr. 16, 2015 Attendees: Dean Coclin, Bruce Morton, Atsushi Inaba, Doug Beattie, Kirk Hall, Gerv Markham, Jennifer Stanford, Ben Wilson, Atilla Biler, Volkan Nergiz, Wayne Thayer, Tim Shirley, Robin Alden, Patrick Tronnier, Mads Henriksveen, Ryan Sleevi, Burak Kalkan, Tim Hollebeek, Jody Cloutier, Eddy Nigg, Stephen Davidson, Jeremy Rowley Minutes of 2 April meeting were approved. These will be posted to the public list. Minutes of Cupertino face to face meeting also approved and will be posted. Ballot 146 (Conversion of BRs): Voting closing today. Appears it will pass. Kirk may submit ballot on bylaw changes shortly.
Ballot 146 – Convert Baseline Requirements to RFC 3647 Framework
April 16, 2015 by Ben WilsonBallot 146 – Convert Baseline Requirements to RFC 3647 Framework Voting has closed on Ballot 146, “Convert Baseline Requirements”
April 16, 2015 by Ben WilsonBallot 146 – Convert Baseline Requirements to RFC 3647 Framework Voting has closed on Ballot 146, “Convert Baseline Requirements”
2015-04-02 Minutes
April 2, 2015 by Ben WilsonMinutes of CA-Browser Forum Meeting – 2 April 2015 Attendees: Atsushi Inaba (Globalsign), Ben Wilson (Digicert), Bruce Morton (Entrust), Burak Kalkan (TurkTrust), Davut Tokgöz (e-Tugra), Doug Beattie (Globalsign), Eddy Nigg (Startcom), Gervase Markham (Mozilla), Jeremy Rowley (Digicert), Kirk Hall (Trend Micro), Moudrick Dadashov (SSC), Patrick Tronnier (OATI), Rick Andrews (Symantec), Ryan Sleevi (Google), Wayne Thayer (GoDaddy).
April 2, 2015 by Ben WilsonMinutes of CA-Browser Forum Meeting – 2 April 2015 Attendees: Atsushi Inaba (Globalsign), Ben Wilson (Digicert), Bruce Morton (Entrust), Burak Kalkan (TurkTrust), Davut Tokgöz (e-Tugra), Doug Beattie (Globalsign), Eddy Nigg (Startcom), Gervase Markham (Mozilla), Jeremy Rowley (Digicert), Kirk Hall (Trend Micro), Moudrick Dadashov (SSC), Patrick Tronnier (OATI), Rick Andrews (Symantec), Ryan Sleevi (Google), Wayne Thayer (GoDaddy).
Ballot 148 – Issuer Field Correction
April 2, 2015 by Ben WilsonVoting on Ballot 148, Issuer Field Correction, closed on 2 April 2015. We received 13 YES votes from CAs, 0 NO votes and 0 Abstentions We received 1 YES vote from Browsers, 0 NO votes and 0 Abstentions Therefore the ballot passes. Several votes were received after the ballot closed and were not counted. Full details are on the ballot tracking wiki. Ballot 148 resulted in the adoption of BRv1.2.5
April 2, 2015 by Ben WilsonVoting on Ballot 148, Issuer Field Correction, closed on 2 April 2015. We received 13 YES votes from CAs, 0 NO votes and 0 Abstentions We received 1 YES vote from Browsers, 0 NO votes and 0 Abstentions Therefore the ballot passes. Several votes were received after the ballot closed and were not counted. Full details are on the ballot tracking wiki. Ballot 148 resulted in the adoption of BRv1.2.5
2015-03-19 Minutes
March 19, 2015 by Ben WilsonMinutes of March 19th CA/B Forum Meeting Attendees: Dean Coclin (Symantec), Tyler Myers (GoDaddy), Tim Shirley (Trustwave), Doug Beattie (GlobalSign), Patrick Tronnier (OATI), Kirk Hall (Trend Micro), Ben Wilson (DigiCert), Robin Alden (Comodo), Mads Henriksveen (BuyPass), Billy VanCannon (Trustwave), Tim Hollebeek (Trustwave), Atilla Biler (TurkTrust), Volkan Nergiz (TurkTrust), Eddy Nigg (Startcom), Jeremy Rowley (DigiCert), Atsushi Inaba (GlobalSign), Wayne Thayer (GoDaddy), Burak Kalkan (TurkTrust), Tyrone Welsh (Trustis), Ryan Sleevi (Google), Mat Caughron (Apple).
March 19, 2015 by Ben WilsonMinutes of March 19th CA/B Forum Meeting Attendees: Dean Coclin (Symantec), Tyler Myers (GoDaddy), Tim Shirley (Trustwave), Doug Beattie (GlobalSign), Patrick Tronnier (OATI), Kirk Hall (Trend Micro), Ben Wilson (DigiCert), Robin Alden (Comodo), Mads Henriksveen (BuyPass), Billy VanCannon (Trustwave), Tim Hollebeek (Trustwave), Atilla Biler (TurkTrust), Volkan Nergiz (TurkTrust), Eddy Nigg (Startcom), Jeremy Rowley (DigiCert), Atsushi Inaba (GlobalSign), Wayne Thayer (GoDaddy), Burak Kalkan (TurkTrust), Tyrone Welsh (Trustis), Ryan Sleevi (Google), Mat Caughron (Apple).
Minutes of the F2F 34 Meeting in Cupertino, California, 10-12 March 2015
March 11, 2015 by Ben WilsonMeeting 34 Minutes Attending at various times over 3 days: Dean Coclin (Symantec), Kirk Hall (Trend Micro), Wayne Thayer (GoDaddy), Robin Alden (Comodo), Michael Whittam (Comodo), Arno Fiedler (representing ETSI), Iñigo Barreira (IZENPE), Rashmi Tabada (Symantec), Tim Hollebeek (Trustwave), Li-Chun Chen (Chunghwa Telecom), Doug Beattie (Globalsign), Atsushi Inaba (Globalsign), Robert Ikeoka (E&Y), Ryan Sleevi (Google), Billy VanCannon (Trustwave), Bruce Morton (Entrust), Gervase Markham (Mozilla), Richard Barnes (Mozilla), Moudrick Dadashov (SSC), Cecilia Kam (Symantec), Jeremy Rowley (Digicert), Ben Wilson (Digicert), Rick Andrews (Symantec), Stephen Davidson (QuoVadis), Richard Wang (WoSign), Mat Caughron (Apple), John Wilander (Apple), Don Sheehy (representing WebTrust), Jeff Ward (representing WebTrust), Kathleen Wilson (Mozilla), Stephen Hillier (Trend Micro), Chris Bailey (Trend Micro), John Noll (Apple), Gigi Wang (Apple), Curt Spann (Apple), Anoosh Saboori (Microsoft), Deron O’Brien (Apple)
March 11, 2015 by Ben WilsonMeeting 34 Minutes Attending at various times over 3 days: Dean Coclin (Symantec), Kirk Hall (Trend Micro), Wayne Thayer (GoDaddy), Robin Alden (Comodo), Michael Whittam (Comodo), Arno Fiedler (representing ETSI), Iñigo Barreira (IZENPE), Rashmi Tabada (Symantec), Tim Hollebeek (Trustwave), Li-Chun Chen (Chunghwa Telecom), Doug Beattie (Globalsign), Atsushi Inaba (Globalsign), Robert Ikeoka (E&Y), Ryan Sleevi (Google), Billy VanCannon (Trustwave), Bruce Morton (Entrust), Gervase Markham (Mozilla), Richard Barnes (Mozilla), Moudrick Dadashov (SSC), Cecilia Kam (Symantec), Jeremy Rowley (Digicert), Ben Wilson (Digicert), Rick Andrews (Symantec), Stephen Davidson (QuoVadis), Richard Wang (WoSign), Mat Caughron (Apple), John Wilander (Apple), Don Sheehy (representing WebTrust), Jeff Ward (representing WebTrust), Kathleen Wilson (Mozilla), Stephen Hillier (Trend Micro), Chris Bailey (Trend Micro), John Noll (Apple), Gigi Wang (Apple), Curt Spann (Apple), Anoosh Saboori (Microsoft), Deron O’Brien (Apple)
2015-03-05 Minutes
March 5, 2015 by Ben WilsonMinutes of March 5, 2015 Attendees: Dean Coclin (Symantec), Doug Beattie (GlobalSign), Kirk Hall (Trend Micro), Bruce Morton (Entrust), Rick Andrews (Symantec), Ben Wilson (DigiCert), Robin Alden (Comodo), Mads Henriksveen (BuyPass), Billy VanCannon (Trustwave), Chris (didn’t catch last name) (Trustwave), Tim Hollebeek (Trustwave), Cornelia Enke (SwissSign), Atilla Biler (TurkTrust), Gerv Markham (Mozilla), Jeremy Rowley (DigiCert), Atsushi Inaba (GlobalSign), Kubra Zeray (TurkTrust), Burak Kalkan (TurkTrust), Cecilia Kam (Symantec), Jody Cloutier (Microsoft), Anoosh Saboori (Microsoft), Ryan Sleevi (Google)
March 5, 2015 by Ben WilsonMinutes of March 5, 2015 Attendees: Dean Coclin (Symantec), Doug Beattie (GlobalSign), Kirk Hall (Trend Micro), Bruce Morton (Entrust), Rick Andrews (Symantec), Ben Wilson (DigiCert), Robin Alden (Comodo), Mads Henriksveen (BuyPass), Billy VanCannon (Trustwave), Chris (didn’t catch last name) (Trustwave), Tim Hollebeek (Trustwave), Cornelia Enke (SwissSign), Atilla Biler (TurkTrust), Gerv Markham (Mozilla), Jeremy Rowley (DigiCert), Atsushi Inaba (GlobalSign), Kubra Zeray (TurkTrust), Burak Kalkan (TurkTrust), Cecilia Kam (Symantec), Jody Cloutier (Microsoft), Anoosh Saboori (Microsoft), Ryan Sleevi (Google)