On 13/03/2019 03:04, Peter Gutmann wrote: > Rob Stradling via dev-security-policy <dev-security-policy@lists.mozilla.org> > writes: > >> I've been working on an alternative proposal for a serial number generation >> scheme, for which I intend to write an I-D and propose to the LAMPS WG. > > This seems really, really complicated.
Yes, SNOT adds complexity, but this was necessary to achieve the security/transparency properties that I set out to achieve. Whether or not all of those security/transparency properties are desirable enough to warrant (some or all) CAs taking on the burden of this added complexity is of course worthy of discussion. CT, for example, is complicated, and yet the security/transparency properties have been deemed desirable enough to warrant burdening the ecosystem with the added complexity. > In all of the endless debate over this, the one thing that hasn't actually > come > under question is how to generate the random values themselves. What has come up over> and over is how to encapsulate those values as an ASN.1 integer. I'm not sure I agree that dropping 1-bit of entropy falls entirely into the "encapsulating those values as an ASN.1 integer" part. > So I really prefer the > Modest Proposal version, which directly addresses the bit-bagging problems > that are the real issue with 7.1. > > Peter. -- Rob Stradling Senior Research & Development Scientist Sectigo Limited _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
