[stir] Implications of using the web PKI
Richard Barnes <rlb@ipv.sx> Thu, 07 April 2016 20:02 UTC
Return-Path: <rlb@ipv.sx>
X-Original-To: stir@ietfa.amsl.com
Delivered-To: stir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 608CA12D18B for <stir@ietfa.amsl.com>; Thu, 7 Apr 2016 13:02:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 20G6_xLpZk6Y for <stir@ietfa.amsl.com>; Thu, 7 Apr 2016 13:02:20 -0700 (PDT)
Received: from mail-vk0-x231.google.com (mail-vk0-x231.google.com [IPv6:2607:f8b0:400c:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09A3D12D17D for <stir@ietf.org>; Thu, 7 Apr 2016 13:02:20 -0700 (PDT)
Received: by mail-vk0-x231.google.com with SMTP id k1so113488319vkb.0 for <stir@ietf.org>; Thu, 07 Apr 2016 13:02:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:date:message-id:subject:from:to; bh=rva/1rjC6sM17+P5xV9SyOYL2h1R0JIDz++kubpHEV0=; b=Qb9Wpk2Q7Kvz9nadTiIyNTtpZ0fn0LVIiv8qcfgjYmDXERCa5mXRnqDxt0py+c0QFg Htg17laF2bVSDCGQ4lpZFjhRIJuhQCV9+/7dXv0x6W6HRKiDKe1/PqVs4ZpC1OKVb7By MumA9c3L0kantmWQUcXHDSUl0LhHNgRu8EzLMy637QJsuMXbPtQwaB8JoGbvERnLmTqv NtnXak/mKOH9YHusE7uhpySc3LbtPRX73RvQOqAsqEUmXj3Z0+2fYbuQSKWC+wNDhd2b DLElsWzV3hNKJFlm8pAwM1+oFEP71WxyxDXOf4LofNi8MWboLtIKTn9xsjLF6aYyBryv bLCw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=rva/1rjC6sM17+P5xV9SyOYL2h1R0JIDz++kubpHEV0=; b=XECe3kGSwKbiTJk4qqfDTOngJwe06IP6GnNQcCnmMx/phwLEznkMxfFaFvrb7fWtDu 8TP+8GYen60aj6ERbaUB9DWEJUywXh3A6qVW1cN23PBH63+IMnpPASBkiA0bPh2m71b8 gwD4TxdKH9tCVq5zpHcdDckbRI+m69qZQffWkHaZ3WDEPK7T3caMAz6ov/kzFXbuRbpP cyHF7cn3jl1ONoQ4S9QxsSRQJdnR6jKAsJAOaEpbmpxk5XOteh3iwD8s2CqnBIQUlXnA /GiQ+1UuTUuB2B1CRmgNEsfcYMjtYgc7wI8V/sHtu2z7QbPe9rlGWmA0fhwkqLLcoOlk Yl7w==
X-Gm-Message-State: AD7BkJJk9j7ma0trR/Vq2j7uPL7rCS+oa/h75pJea63zmNnYEr9x+PCd+ugfCjWV9Ws9qjoKbEHZP3Rihu+Wrw==
MIME-Version: 1.0
X-Received: by 10.176.7.97 with SMTP id h88mr2296544uah.125.1460059339049; Thu, 07 Apr 2016 13:02:19 -0700 (PDT)
Received: by 10.31.151.85 with HTTP; Thu, 7 Apr 2016 13:02:19 -0700 (PDT)
Date: Thu, 07 Apr 2016 17:02:19 -0300
Message-ID: <CAL02cgRg5QbrpZFHjxrEA7-8pO_rP2pD=N-x_8GhhMzkBNHb6A@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: "stir@ietf.org" <stir@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c1231e6416661052fea8e51"
Archived-At: <http://mailarchive.ietf.org/arch/msg/stir/8GpG5bPr7y43hd00draDDFQHTBw>
Subject: [stir] Implications of using the web PKI
X-BeenThere: stir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Telephone Identity Revisited <stir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/stir>, <mailto:stir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/stir/>
List-Post: <mailto:stir@ietf.org>
List-Help: <mailto:stir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/stir>, <mailto:stir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Apr 2016 20:02:22 -0000
Hey all, I mentioned in the meeting the other day that there can be some negative implications of re-using WebPKI certs. Payment processors have been using WebPKI certificates for servers that payment terminals talk to. These terminals only support the obsolete SHA-1 algorithm, which is now forbidden by the CABF Baseline Requirements. So those payment processors have had to ask the browsers for permission just to keep their payment terminals operating. As though on call, a new instance of this problem cropped up this morning: https://cabforum.org/pipermail/public/2016-April/007182.html Those advocating for reuse of WebPKI certificates should imagine whether we want telcos in this position next time. --Richard
- [stir] Implications of using the web PKI Richard Barnes