Re: Key-destruction audit web-trust vs. ETSI (RE: SECURITY RELEVANT FOR CAs: The curious case of the Dangerous Delegated Responder Cert)

2020-07-04 Thread Ryan Sleevi via dev-security-policy
Indeed, you’re welcome to do so, but I also don’t think these are easily adjusted for or corrected. ETSI ESI is trying to solve a different need and use case, and it’s structure and design reflect that. And that’s ok! There’s nothing inherently wrong with that. They are trying to develop a set of

RE: Key-destruction audit web-trust vs. ETSI (RE: SECURITY RELEVANT FOR CAs: The curious case of the Dangerous Delegated Responder Cert)

2020-07-04 Thread Buschart, Rufus via dev-security-policy
Thank you Ryan for spending your 4th of July weekend answering my questions! From my purely technical understanding, without knowing too much about the history in the discussion between the ETSI community and you nor about the “Überbau” of the audit schemes, I would believe that most of the

Re: Key-destruction audit web-trust vs. ETSI (RE: SECURITY RELEVANT FOR CAs: The curious case of the Dangerous Delegated Responder Cert)

2020-07-04 Thread Ryan Sleevi via dev-security-policy
On Sat, Jul 4, 2020 at 9:17 AM Buschart, Rufus wrote: > Dear Ryan! > > > From: dev-security-policy > On Behalf Of Ryan Sleevi via dev-security-policy > > Sent: Freitag, 3. Juli 2020 23:30 > > To: Peter Bowen > > Cc: Ryan Sleevi ; Pedro Fuentes ; > mozilla-dev-security-pol...@lists.mozilla.org

Key-destruction audit web-trust vs. ETSI (RE: SECURITY RELEVANT FOR CAs: The curious case of the Dangerous Delegated Responder Cert)

2020-07-04 Thread Buschart, Rufus via dev-security-policy
Dear Ryan! > From: dev-security-policy On > Behalf Of Ryan Sleevi via dev-security-policy > Sent: Freitag, 3. Juli 2020 23:30 > To: Peter Bowen > Cc: Ryan Sleevi ; Pedro Fuentes ; > mozilla-dev-security-pol...@lists.mozilla.org > Subject: Re: SECURITY RELEVANT FOR CAs: The curious case of the