Re: [pkix] fyi: Sovereign Keys: an EFF proposal for more secure TLS

["Kemp, David P." <[e-mail]>]

-----Original Message-----
From: Stephen Kent
> From: Rob Stradling
>> Relaxing the decoding rules certainly doesn't alleviate the problem, 
>> but IMHO it doesn't necessarily make the problem any worse.  For 
>> example, if we'd decided instead to persist with only allowing 
>> correctly encoded CSRs, customers with broken CSR generation software

>> would've simply gone to a different CA that did accept their 
>> incorrectly encoded CSRs.  There would still be no incentive for the 
>> authors of the broken software to fix their code.
>
> The ability to go to a second CA that does not require correct
> syntax arises precisely because such CA behavior is not
> perceived as "bad." 

Accept/Reject is a false dichotomy.  Why is Flag not among the
alternatives:

"Warning: the certificate signing request submitted by browser <UA
string> is garbled.  We've done our best to interpret your request, but
please check to ensure that the certificate is acceptable before putting
it to use."

That ought to shame any vendor capable of feeling shame :-).

Dave