Re: [lamps] Call for adoption for draft-ito-documentsigning-eku

[Ryan Sleevi <[e-mail]>]

On Fri, Jul 30, 2021 at 10:37 AM Salz, Rich <rsalz=
[e-mail]> wrote:

> This is tougher than I thought. Ryan has more in-the-trenches experience
> with these things than most, and perhaps more than most of us combined. On
> the other hand, defining an EKU is pretty small potatoes, and there's
> likely not to be much cost to the s/w stacks because they already have to
> make the cert, ku, eku available to the application anyway.


The only value, for the stated goal, however, is if applications check
this. That's why the most relevant feedback is not from e-mail app
providers (which already check for emailProtection), or from TLS client
libs (which already check for id-kp-serverAuth), but from those that are
consuming digital signatures. This is why I suggested ETSI is wholly
appropriate if they wanted to specify an EKU for their specifications (as
the misuse of emailProtection is primarily coming from European CAs
targeting European relying parties implementing ETSI ESI specifications).
And, by and large, these apps aren't checking EKU at all - that is, they'd
be perfectly fine validating a document signed with a TLS certificate, if a
CA issued such a certificate. So the CA using a different EKU provides no
value without the relying party apps changing, and if you can identify who
that constituency is (of app implementors), you've necessarily identified
who can and should just get an EKU for their constituency.

This is why I'm trying to flag "implementor interest" is both critical, and
absent, for achieving the stated goals.


> On the third hand, the idea of CABforum starting to address email worries
> me -- will membership open up to allow email app providers? I guess that's
> really not our concern.
>

Yes, it already is, and yes, it should worry you :)

The CA/Browser Forum has two other Chartered WGs, and participation in
either CWG (as with TLS) allows participation in the overall CA/B Forum
(although not necessarily other CWGs)
- https://cabforum.org/working-groups/smime-certificate-wg/ (For e-mail app
providers)
- https://cabforum.org/code-signing-working-group/ (Effectively, the
Microsoft Code Signing WG)