Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Phillip Hallam-Baker <[e-mail]>]

First off, I think that people need to stop using the -gate suffix. Just
because a competitor decided that they would attempt to apply it does not
mean it is justified. That is an old game and a rather silly one in our
industry. The relevant cautionary text here being John 8:7.

What differentiates companies in our industry is not whether they are
breached, it is whether they give prompt, voluntary notice of breaches that
occur or not. The market leaders in the CA industry have a track record of
having done so.


As for CAA being a response to the Iranian attack, Ben, Rob and I developed
it a year earlier.

The point of proposals like CAA is not whether they are 'necessary' or not,
it is whether they mitigate risk. I have never seen a security control
involving a human element that is guaranteed to be operated with 100%
accuracy every time. So whenever there are humans involved I like to have
strength in depth.

There would be no problem here if browsers actually implemented revocation
checking either. But we have had that in PKIX specs for 15 years and it
still isn't deployed in hard fail mode. Which is rather sad when you
consider that about 70% of the complexity of PKI comes from the need for
revocation.