On Wed, Jul 26, 2017 at 12:41 PM, Kirk Hall via Public <[email protected]> wrote: > Peter, Ben, and Ryan – do you have a response to the punycode issue raised > by CFCA, GDCA, and SHECA?
Kirk, Is a response needed? It's 1 AM in China. Are you expecting these CAs to change their votes? Are you expecting other CAs to share these concerns? They've established their position based on information not shared during discussion, and within hours to the vote closing, so there doesn't seem much to respond to? CFCA has indicated that it believes local browser UI is more important than ensuring the security of certificates by ensuring there is a consistent and unambiguous representation. The only reason given for voting against is that some (unspecified, local) browsers are presumably capable of displaying U-Labels in the address bar (or else they would, again presumably, run afoul of the unspecified local laws), but apparently incapable of displaying that same representation in a certificate viewer. Had this been raised during the discussion period, it certainly could have been an opportunity to obtain additional information to evaluate these claims, as well as explain the risk that exists with using the U-Label form - for all IDNA-aware browsers. That is, the use of U-Labels in the commonName creates several risks 1) IDNA display policies by browsers are hugely important, security-relevant matters. IDNA expressed in U-Label form creates meaningful divergence from the browsers' security mitigations. 2) U-Labels are not intended to be stable storage; the ACE-encoded A-label (punycode) represents a stable, wire-safe format 3) The presumed risk is a CA that displays U-labels in its address bar and A-labels in its certificate viewer - but that sounds like a "browser issue" more than a "CA must issue these" issue. These are reasons I would disagree with their assessment, but given the situation, it doesn't seem terribly productive to do so within hours of the vote. I'm assuming you asked because Entrust hasn't voted yet, and I do hope you'll consider these real technical and security concerns in consideration of the vote. If your concern is the local laws, as you know, the BRs have a provision for that, so it would in no way unduly burden those CAs that believe they're affected by this, should these explanations be insufficient. _______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
