Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54E6C129BCF for ; Wed, 22 Mar 2017 12:31:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30Zop6CGXGDm for ; Wed, 22 Mar 2017 12:31:50 -0700 (PDT) Received: from asbsmtoutape02.symantec.com (asbsmtoutape02.symantec.com [155.64.138.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F793126BF6 for ; Wed, 22 Mar 2017 12:31:50 -0700 (PDT) Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat7.net.symantec.com [10.90.75.7]) by asbsmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 3A.1F.37454.521D2D85; Wed, 22 Mar 2017 19:31:49 +0000 (GMT) X-AuditID: 0a5af81a-8fa559a00000924e-8a-58d2d12576cd Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat3.net.symantec.com [10.90.75.3]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 05.59.04315.321D2D85; Wed, 22 Mar 2017 19:31:49 +0000 (GMT) Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Wed, 22 Mar 2017 12:31:46 -0700 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (10.44.128.7) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Wed, 22 Mar 2017 12:31:46 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=yUQX4RGyuCXve1yvL/yk60n+r2XChyKu5eSGnULY0G4=; b=Xs5PAPujLn/fT1W2pFUUrGycc4roWl1vdxTU4GZ9gNiqWXEARBrCl1AVoy6Mdicctfx1P8smWxiNm2EQ5zyyuQwalT7LJhgYOhAJ9N2UuYmPwFEPXwGoKO0n7aUGd9wLR5FI8GiC4x+9UvX2Relwpqf3U2f89nVL42ehvxEYm2w= Received: from BN3PR16MB0899.namprd16.prod.outlook.com (10.165.81.153) by BN3PR16MB0900.namprd16.prod.outlook.com (10.165.81.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.11; Wed, 22 Mar 2017 19:31:44 +0000 Received: from BN3PR16MB0899.namprd16.prod.outlook.com ([10.165.81.153]) by BN3PR16MB0899.namprd16.prod.outlook.com ([10.165.81.153]) with mapi id 15.01.0977.020; Wed, 22 Mar 2017 19:31:43 +0000 From: Tarah Wheeler To: "trans@ietf.org" Thread-Topic: Proposal to modularize pre certificate transformation Thread-Index: AQHSo0LvLcFxGd4fV0CeqEQxJK1Smg== Date: Wed, 22 Mar 2017 19:31:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.2.170228 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=symantec.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [155.64.38.27] x-microsoft-exchange-diagnostics: 1; BN3PR16MB0900; 7:4uw9QsVKfns4tJPj3ZqCcF16cCTvIgQOUr+pDprS/mg41l72Ua80LdOMxfWRLqzs9SgYSVhtex4QNMGEZ4UWbRBvGMvtlg5RRtGkN6CXBoQZzebBMnT3JKQfDItcZ2RA5fazDb+4MmmHi6OEBcQPWxMAWEbuJvc6w24ZSy7wb8fPPd27vievEst+oeuS7ogoNAwaHAmS8f5n1cPHEq1eQsS0+yPaefkhT8x2ML28y6hISoM6UtCfB3n5E8tzJI6nDJ+qt2S0eQFOCcgbN9IjbXYVt/vOGHQZMbA3uqFqpWjeUkPtAcVIkO2O+ZCqPn9ZqylhkMSDli5sYK0ndhrlhg== x-ms-office365-filtering-correlation-id: f6ffefca-1734-4610-2567-08d4715a1288 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075); SRVR:BN3PR16MB0900; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(164924216521020); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123564025)(20161123560025)(20161123555025)(20161123562025)(20161123558025)(6072148); SRVR:BN3PR16MB0900; BCL:0; PCL:0; RULEID:; SRVR:BN3PR16MB0900; x-forefront-prvs: 02543CD7CD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39450400003)(40134004)(85714005)(110136004)(54356999)(189998001)(38730400002)(7736002)(6116002)(102836003)(3846002)(122556002)(6486002)(575784001)(606005)(77096006)(6436002)(99936001)(6916009)(3280700002)(2900100001)(551944002)(7906003)(6506006)(733005)(2906002)(86362001)(66066001)(5640700003)(1730700003)(50986999)(5890100001)(81166006)(53936002)(6306002)(10290500002)(236005)(83506001)(2501003)(19618635001)(861006)(36756003)(99286003)(3660700001)(5660300001)(6512007)(8936002)(80792005)(54896002)(54556002)(4001350100001)(8676002)(25786009)(2351001); DIR:OUT; SFP:1101; SCL:1; SRVR:BN3PR16MB0900; H:BN3PR16MB0899.namprd16.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/related; boundary="_004_D4F8495D4F2Dtarahwheelersymanteccom_"; type="multipart/alternative" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2017 19:31:43.5648 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR16MB0900 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnk+LIzCtJLcpLzFFi42LhivJm11W9eCnC4NtsCYu1jy+yODB6LFny kymAMYrLJiU1J7MstUjfLoEr48rlbawFW/4zViw/ENfA+P4BYxcjJ4eEgInEhS/vmbsYuTiE BD4ySpzqeMcCk5i3YBYrROIbo8TTzp+MEM5RIOfpGqjMS0aJ9v0nWUAcFoFOZokDHy9ADZvG JHG06SRU2TFGiZdP1jF1MXJwsAkYSHy8EQWyRERAVeLz/RYmEFtYwE5i2Y5t7BBxZ4nGFysZ IWw9icO3J4PFWYDqr/atAYvzCphJzDv/GizOKCAm8f3UGrA5zALiEreezGeCeEJE4uHF02wQ tqjEy8f/WEFsUaCZ+/59ZQO5jVGgm1Fi65790ODQkTh7/QmUrSBxc2YL2DcSAj3MEh+mLWYE eUBCwFfi2T5eiJoYiY8bDzND2NkS255/hYZerMT0e9NZIXqXMkmsPfUGaqiMxO0ZHVCJ56wS B3ZNZ5rAqDMLyeUQdrnEq9UzWGaBfSoocXLmExaIeLTE+UlrGSFsHYkFuz+xQdjaEssWvmaG sc8ceAw1x0Ni/49GVkw13hJb+s+xQ9gOEhO6vwHN5AKygTE1s38aVLORxI5HX6AWK0pM6X7I voCRbxWjQmJxUnFuSX5pSWJBqoGRXnFlbjKISAQmzGS95PzcTYzgpPlDagfjkzs+hxgFOBiV eHhVj16KEGJNLAOqPMSoAjTy0YbVFxilWPLy81KVRHhzzwCleVMSK6tSi/Lji0pzUosPMUpz sCiJ807MuRAhJJCeWJKanZpakFoEk2Xi4JRqYORbN49X5L0ng+ScpYdeTONtVnq0R84hb/8C OzE3+UsT1wdVJ1kxTZq8v0u88Piv5szynWK2N4yUCl35Tx5cd3qSj/zkd+s+s/icLck3fXa3 QKzsxfpkRsdXlwqCj3lwaEyL62+N/dUX+0Bz5yr3TeXX384TieaX1O6czvJnZpfkmugD1j5H TyuxFGckGmoxFxUnAgC43EYBogMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA2WSfUhTURjGObv3btdLy9vy49UM/EDQMp0hYlAiRDFRIYRiaJk3vaToTDaz rH80xNJFmoVTCZtohqWZpiJ96FC0ZpofaZkflTnbTKHWUpNM23ZvEPTP5fc+73Pec55zD4lJ jIQ7mZqRxSozmHRvIYVTcVHYHt+RUbl0YFoQ1jg3gkcgWW3tmuAIiqP2J7PpqdmsMig8kUoZ e91OZLZuovN3dQm56OtHVIQcSKBDoEpbSRQhipTQKwjmC9cQV/Rai/kGvrOA4HKXHrcVOF2I gc48jHGdMgH0XtLztj4EC4YHgiJEkkJaCuaJONsmTrQvWD7kC2y8nQ6Huo52EacfhDxTPeI4 EHqmbth13Oofv9Zg18V0KFQNLdp1RLvAan+DfQ5Gu8Kk4baAC+EEsyMvhRw7w8LcBmFjZ+vM zo1loe1siFYjaHvaxacOgMG3Bp494V1Fvj0N0Fcx+FZWg2wBgI6Bz51iznMczM09GMdp0G5c xjk+AZr3GoJbe0cAjf1L/FAPmCq/wjeMBOgea/j47jAzVog49gDT9DOiBPlV/pOI43Pw5X45 Xmm/gW2grzDgnB4PQ6WNiOMA0D75LuR4N9RVL2J/eUA3x8+RQdfPPOJ/TxS0Fr8ScRwBJeoV 60zKytY/WFFcxi/eCx2ffvAbe8FN9axIi7beQ56M6pRKkaXIYpjMVGlwoCpHkWT7MNZ3mRSY dEbRguwv85dLB9KtR3cjmkTeW8Ty56NyCcFkW53daAeJe7uKJ4Jb5BL6NJPFprFsJqs8qTyb zqq6kYB0cM9FtW5psrWmA0svtI5NOfFRg9FeLtLJhwV4glloerRanqxsS9msvhV0yKSrx4W5 TTK5/3qNus7f4oSuL6pmxi2M42HKk74Y6Re77BMSltTZp9FZRH5i/fJR0XAzuBn2xVzwhdDE N78LCMojttTHpy3vWGzkSudiUPmgeadR642rUpjgXZhSxfwBcQRHmXoDAAA= X-CFilter-Loop: ASB01 Archived-At: Subject: [Trans] Proposal to modularize pre certificate transformation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 19:31:53 -0000 --_004_D4F8495D4F2Dtarahwheelersymanteccom_ Content-Type: multipart/alternative; boundary="_000_D4F8495D4F2Dtarahwheelersymanteccom_" --_000_D4F8495D4F2Dtarahwheelersymanteccom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Peter Bowen and I have been collaborating on a possible solution for certif= icate privacy. Thoughts? ++++++++++ Precertificate Transformation Extension Many of the concerns around certificate privacy (the ability to privatize s= ome certificate fields) are due to fears that multiple final certs could be= generated for the same precertificate. This solution uses a random key in = the final certificate which can be matched against the hashed redacted info= rmation in the precertificate to demonstrate that the precertificate was un= ique. The precert contains a hash of the original information; without the = key in the full certificate, the hash is not transformable, and if the key = works to transform the hash (as a one way function), the pre certificate ca= n be proven to have been the correct one issued for the full cert. This sol= ves the difficult problem of ensuring that a given precert is the one that = was indeed issued for the full certificate. In order to give domain registrants options for what domain name labels are= disclosed in precertificates, we propose a new certificate extension: Prec= ertifcate Transformation. This extension is found in both the final certif= icate and in the precertificate. The extension specifies a transformation = algorithm, genneral parameters for the algorithm, and a count of disclosed = component per subject alternative name. There are two transformation algorithms initially defined. The basic algor= ithm is as described in 6962 and 6962bis. It has no parameters and the san= DisclosedComponents component is not used. This algorithm is the default. The second is the partialhm256 algorithm. This extends the basic algorithm= by including transformation of the subjectAlternativeName extension. The = Parms is a 128-bit value that is used as K for a HMAC (cf RFC 2104) that us= es H =3D SHA256. For each entry in the subjectAlternativeName extension, a= n entry in the sanPartialComponents sequence must exist. Matching is done = by order. Let the disclosed components count for the entry in question be = N. If N is -1, then the SAN entry is unmodified. If it is greater than or= equal to zero, then the following transformations occur: (1) If the GeneralName type is not dNSName or iPAddress, the result is unde= fined and an error must be thrown (2) If the GeneralName type is dNSName, then the entry is replaced with an = otherName entry of type id-ct-partialGN-dNSName with a value created by cop= ying the N labels closest to the root to the new name and prepending them w= ith a value created by taking the remaining labels and calculating the HMAC= -SHA256 value and hex encoding it and prepending '#'. Note that a '*.' pre= fix on a name is not considered a label; it must be copied to the output as= is. For example, if the input is "*.beta.group.secret.demo.test" with key 0x4fa= 1cb4ce23db6e45caf727b0b1d85ed and the number of disclosed labels is 2, then= the resulting name is "*.#4d240f70beb97f4c402984e94ac6e1c8351c89ff13e8a94d= abfbc474ded4d3d4.demo.test" (3) If the GeneralName type is iPAddress, then the entry is replaced with a= n otherName entry of type id-ct-partialGN-iPAddress. The value is a IA5Str= ing in the format + "|" + . For the hashed part, the ad= dress first is converted to a text string. The format is dotted decimal, w= ith no leading zeroes, for IPv4 addresses and is as described in Section 4 = of RFC 5952 for IPv6 addresses (section 5 is not used in this case). The H= MAC-SHA256 value is calculated of this string as in (2) and is the= hex encoding of the result. Partial is formed by setting the bits other t= han N most significant bits to zero and the converting to string as describ= ed above. For example, if the input is "198.51.100.47" with key 0x4fa1cb4ce23db6e45ca= f727b0b1d85ed and the number of disclosed labels is 27, then the resulting = name is "198.51.100.32|8e38c51f339de29c05e543a099ba76468367043d5bc167c801ae= 0330a648925d". In the precertificate the transformation parameter is set to a zero length = bit string. If the subject contains a commonName type attribute and the value of the co= mmonName attribute value matches a dNSName in the SAN and the precertificat= e contains a partialGN otherName in place of that entry, then the commonNam= e attribute is replaced with a id-ct-partialGN-replacedCN type attribute wi= th the value being the otherName value. This algorithm provides the recipient of a full certificate the ability to = deterministically create the precertificate. It also ensures that the prec= ertificate can only reasonably match one full certificate. id-ct-precertificateTransformation ID ::=3D {1 3 187 97 1} id-ct-partialGN ID ::=3D {1 3 187 97 10} id-ct-partialGN-dNSName ID ::=3D {id-ct-redactedGN 2} # type IA5String id-ct-partialGN-iPAddress ID ::=3D {id-ct-redactedGN 7} # type IA5String id-ct-partialGN-replacedCN ID ::=3D {id-ct-redactedGN 127} # type IA5String id-ct-taAlgorithm ::=3D {1 3 187 97 20} id-ct-taAlgorithm-basic ::=3D {id-ct-taAlgorithm 1} id-ct-taAlgorithm-partialhm256 ::=3D {id-ct-taAlgorithm 2} precertificateTransformation EXTENSION ::=3D { SYNTAX PrecertificateTransformation IDENTIFIED BY id-ct-precertificateTransformation } PrecertificateTransformation ::=3D SEQUENCE { transformationAlgorithm TransformationAlgorithm DEFAULT id-ct-taAlgorthim= -basic, transformationParms TransformationParms BIT STRING OPTIONAL, sanPartialCount SEQUENCE SIZE (1..MAX) OF NamePartialCount OPTIONAL } TransformationAlgorithm ::=3D OBJECT IDENTIFIER TransformationParms ::=3D ANY NamePartialCount ::=3D INTEGER (-1..127) DEFAULT -1 -- Tarah M. Wheeler Principal Security Advocate and Sr Director of Engineering - Website Securi= ty - Delivering Confidence for Customers and Consumers by Securing Websites and = Applications Symantec Corporation www.symantec.com ________________________________ (206) 276-4920 tarah@symantec.com ________________________________ [cid:4524896B-C0DD-4A56-BA9D-E836A716603F] ________________________________ This message (including any attachments) is intended only for the use of th= e individual or entity to which it is addressed and may contain information= that is non-public, proprietary, privileged, confidential, and exempt from= disclosure under applicable law or may constitute as attorney work product= . If you are not the intended recipient, you are hereby notified that any u= se, dissemination, distribution, or copying of this communication is strict= ly prohibited. If you have received this communication in error, notify us = immediately by telephone and (i) destroy this message if a facsimile or (ii= ) delete this message immediately if this is an electronic communication. --_000_D4F8495D4F2Dtarahwheelersymanteccom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable
Peter Bowen and I have been collaborating on a possible solution for c= ertificate privacy. Thoughts?

++++++++++

Precertificate Transformation Extension

 

Many of the concerns around certificate privacy (the ability to privatize s= ome certificate fields) are due to fears that multiple final certs could be= generated for the same precertificate. This solution uses a random key in = the final certificate which can be matched against the hashed redacted information in the precertificate t= o demonstrate that the precertificate was unique. The precert contains a hash of the original= information; without the key in the full certificate, the hash is not transformable, and if the key works to transf= orm the hash (as a one way function), the pre certificate can be proven to = have been the correct one issued for the full cert. This solves the di= fficult problem of ensuring that a given precert is the one that was indeed issued for the full certificate. <= /span>


In order to give domain registrants options for what domain name labels are= disclosed in precertificates, we propose a new certificate extension: Prec= ertifcate Transformation.  This extension is found in both the final c= ertificate and in the precertificate.  The extension specifies a transformation algorithm, genneral parameters fo= r the algorithm, and a count of disclosed component per subject alternative= name.

 

There are two transformation algorithms initially defined.  The basic = algorithm is as described in 6962 and 6962bis.  It has no parameters a= nd the sanDisclosedComponents component is not used. This algorithm is the = default. 

 

The second is the partialhm256 algorithm.  This extends the basic algo= rithm by including transformation of the subjectAlternativeName extension.&= nbsp; The Parms is a 128-bit value that is used as K for a HMAC (cf RFC 210= 4) that uses H =3D SHA256.  For each entry in the subjectAlternativeName extension, an entry in the sanPartialComponents= sequence must exist.  Matching is done by order.  Let the disclo= sed components count for the entry in question be N.  If N is -1, then= the SAN entry is unmodified.  If it is greater than or equal to zero, then the following transformations occur:

(1) If the GeneralName type is not dNSName or iPAddress, the result is unde= fined and an error must be thrown

(2) If the GeneralName type is dNSName, then the entry is replaced with an = otherName entry of type id-ct-partialGN-dNSName with a value created by cop= ying the N labels closest to the root to the new name and prepending them w= ith a value created by taking the remaining labels and calculating the HMAC-SHA256 value and hex encoding it= and prepending '#'.  Note that a '*.' prefix on a name is not conside= red a label; it must be copied to the output as is.

 

For example, if the input is "*.beta.group.secret.demo.test" with= key 0x4fa1cb4ce23db6e45caf727b0b1d85ed and the number of disclosed labels = is 2, then the resulting name is "*.#4d240f70beb97f4c402984e94ac6e1c83= 51c89ff13e8a94dabfbc474ded4d3d4.demo.test"

 

(3) If the GeneralName type is iPAddress, then the entry is replaced with a= n otherName entry of type id-ct-partialGN-iPAddress.  The value is a I= A5String in the format <partial> + "|" + <hashed= >.   For the hashed part, the address first is converted to a = text string.  The format is dotted decimal, with no leading zeroes, for IP= v4 addresses and is as described in Section 4 of RFC 5952 for IPv6 addresse= s (section 5 is not used in this case).  The HMAC-SHA256 value is calc= ulated of this string as in (2) and <hashed> is the hex encoding of the result.  Partial is formed by setting the = bits other than N most significant bits to zero and the converting to strin= g as described above.

 

For example, if the input is "198.51.100.47" with key 0x4fa1cb4ce= 23db6e45caf727b0b1d85ed and the number of disclosed labels is 27, then the = resulting name is "198.51.100.32|8e38c51f339de29c05e543a099ba764683670= 43d5bc167c801ae0330a648925d".

 

In the precertificate the transformation parameter is set to a zero length = bit string.

 

If the subject contains a commonName type attribute and the value of the co= mmonName attribute value matches a dNSName in the SAN and the precertificat= e contains a partialGN otherName in place of that entry, then the commonNam= e attribute is replaced with a id-ct-partialGN-replacedCN type attribute with the value being the otherName value.

 

This algorithm provides the recipient of a full certificate the ability to = deterministically create the precertificate.  It also ensures that the= precertificate can only reasonably match one full certificate.

 

id-ct-precertificateTransformation ID ::=3D {1 3 187 97 1}

id-ct-partialGN ID ::=3D {1 3 187 97 10}

id-ct-partialGN-dNSName ID ::=3D {id-ct-redactedGN 2} # type IA5String

id-ct-partialGN-iPAddress ID ::=3D {id-ct-redactedGN 7} # type IA5String

id-ct-partialGN-replacedCN ID ::=3D {id-ct-redactedGN 127} # type IA5String=

id-ct-taAlgorithm ::=3D {1 3 187 97 20}

id-ct-taAlgorithm-basic ::=3D {id-ct-taAlgorithm 1}

id-ct-taAlgorithm-partialhm256 ::=3D {id-ct-taAlgorithm 2}

 

precertificateTransformation EXTENSION ::=3D {

  SYNTAX PrecertificateTransformation

  IDENTIFIED BY id-ct-precertificateTransformation

}

 

PrecertificateTransformation ::=3D SEQUENCE {

  transformationAlgorithm TransformationAlgorithm DEFAULT id-ct-taAlgo= rthim-basic,

  transformationParms TransformationParms BIT STRING OPTIONAL,

  sanPartialCount SEQUENCE SIZE (1..MAX) OF NamePartialCount OPTIONAL<= /p>

}

 

TransformationAlgorithm ::=3D OBJECT IDENTIFIER

 

TransformationParms ::=3D ANY

 

NamePartialCount ::=3D INTEGER (-1..127) DEFAULT -1

 





-- 

Tarah M. Wheeler


Princip= al Security Advocate and Sr Director of Engineering - Website Security - =

Delivering Confidence for C= ustomers and Consumers by Securing Websites and Applications

Symantec Corporation

www.symantec.com

________________________________

(206) 276-4920=
tarah@symantec.co= m 

________________________________=

________________________________

This message (including= any attachments) is inte= nded only for the use of the individual or entity to which it is addres= sed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applic= able law or may constitute as attorney work product. If you are not the int= ended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strict= ly prohibited. If you have received this communication in error, notify us = immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if thi= s is an electronic communication.
--_000_D4F8495D4F2Dtarahwheelersymanteccom_-- --_004_D4F8495D4F2Dtarahwheelersymanteccom_ Content-Type: image/png; name="7EDF6DD6-B748-44E0-A644-5EEFE097D244[9].png" Content-Description: 7EDF6DD6-B748-44E0-A644-5EEFE097D244[9].png Content-Disposition: inline; filename="7EDF6DD6-B748-44E0-A644-5EEFE097D244[9].png"; size=5688; creation-date="Wed, 22 Mar 2017 19:31:43 GMT"; modification-date="Wed, 22 Mar 2017 19:31:43 GMT" Content-ID: <4524896B-C0DD-4A56-BA9D-E836A716603F> Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAI4AAAAnCAYAAADZ7nAuAAAD8GlDQ1BJQ0MgUHJvZmlsZQAAOI2N Vd1v21QUP4lvXKQWP6Cxjg4Vi69VU1u5GxqtxgZJk6XpQhq5zdgqpMl1bhpT1za2021Vn/YCbwz4 A4CyBx6QeEIaDMT2su0BtElTQRXVJKQ9dNpAaJP2gqpwrq9Tu13GuJGvfznndz7v0TVAx1ea45hJ GWDe8l01n5GPn5iWO1YhCc9BJ/RAp6Z7TrpcLgIuxoVH1sNfIcHeNwfa6/9zdVappwMknkJsVz19 HvFpgJSpO64PIN5G+fAp30Hc8TziHS4miFhheJbjLMMzHB8POFPqKGKWi6TXtSriJcT9MzH5bAzz HIK1I08t6hq6zHpRdu2aYdJYuk9Q/881bzZa8Xrx6fLmJo/iu4/VXnfH1BB/rmu5ScQvI77m+Bkm fxXxvcZcJY14L0DymZp7pML5yTcW61PvIN6JuGr4halQvmjNlCa4bXJ5zj6qhpxrujeKPYMXEd+q 00KR5yNAlWZzrF+Ie+uNsdC/MO4tTOZafhbroyXuR3Df08bLiHsQf+ja6gTPWVimZl7l/oUrjl8O cxDWLbNU5D6JRL2gxkDu16fGuC054OMhclsyXTOOFEL+kmMGs4i5kfNuQ62EnBuam8tzP+Q+tSqh z9SuqpZlvR1EfBiOJTSgYMMM7jpYsAEyqJCHDL4dcFFTAwNMlFDUUpQYiadhDmXteeWAw3HEmA2s 15k1RmnP4RHuhBybdBOF7MfnICmSQ2SYjIBM3iRvkcMki9IRcnDTthyLz2Ld2fTzPjTQK+Mdg8y5 nkZfFO+se9LQr3/09xZr+5GcaSufeAfAww60mAPx+q8u/bAr8rFCLrx7s+vqEkw8qb+p26n11Aru q6m1iJH6PbWGv1VIY25mkNE8PkaQhxfLIF7DZXx80HD/A3l2jLclYs061xNpWCfoB6WHJTjbH0mV 35Q/lRXlC+W8cndbl9t2SfhU+Fb4UfhO+F74GWThknBZ+Em4InwjXIyd1ePnY/Psg3pb1TJNu15T MKWMtFt6ScpKL0ivSMXIn9QtDUlj0h7U7N48t3i8eC0GnMC91dX2sTivgloDTgUVeEGHLTizbf5D a9JLhkhh29QOs1luMcScmBXTIIt7xRFxSBxnuJWfuAd1I7jntkyd/pgKaIwVr3MgmDo2q8x6IdB5 QH162mcX7ajtnHGN2bov71OU1+U0fqqoXLD0wX5ZM005UHmySz3qLtDqILDvIL+iH6jB9y2x83ok 898GOPQX3lk3Itl0A+BrD6D7tUjWh3fis58BXDigN9yF8M5PJH4B8Gr79/F/XRm8m241mw/wvur4 BGDj42bzn+Vmc+NL9L8GcMn8F1kAcXgSteGGAAASA0lEQVR4Ae2bCZgV1ZXHb1W93oAGRECUIBE/ QR3oBRgNoGExBBcQIgSDigxRoxM/SUaDOpkYJTEx7qiYmDFOEo0axUR0mCBLsyiKAgIqJmACRMGg yCoN3XS/VzW/f726r+s13S0YEEje4fv3ufecc/dzz71Vr3CCIDA5ys3A/s6Au78FDpp9RdlDwZyy Nw9a/bmKD+gMHBaO4zjOlTc8srGFY8zDB3R0ucoO2gwkDlrNn1AxzoKfmBGgAAxd/k7VFuO5uYjz CfN2uKidQ3HHwWcKEgnTp23LxLwdu/zaqj3+yKCitB/XrdOcs1YMOlwmJ9ePxmfg74s4U0d7pt2S PFNwrGPya5Km9+tJ04Qn4jA6GhVpji/Mc595dlKXZGV16urBE9fMNW5ynpNw8xrvak5zOM3AfkWc jdN7N2uXlzzdOMEXPM8tx0k68UzWEV/AAYMtQeC+77j+264JlhjHeckMWvF+fLA4zr+T7wfu8Fxn waRLO0yY/OxHV2/ekVyMv02I2+bSh/cM7JPjVE0v61hQ6FzhGOdC4sVJToHjGZ+B+biNnuYFG0s8 AkoyMH4y2IKDzfBrzc8TZ69YqGnAcXrAxoIzwZNgNHgFPI/jhDakc3QEzEDTjjOJ+NGn7HInz/ku 6CyHCFJAjtIE6SwKD6U8Yk9tUO2Y4LHRP3hv6tQFWy9ClQQfgM+BTeBBnOY9eI6OoBlo1HEqZ5W2 L/LcKZ7nfFXjIYI0OKzw2Uga1A1ZuAWuWfxWpTnnxjW7tu5MNcdyA3gC6GjqlnMaZuEIpIYdZ3bP 4wIveNrJc/sFNX5WhJGjODqOBDzFr+G8YvXdPNc1CWREJMHnKHPzXfObF7aYaQt3mN5di8ytj39o dlXrjAvpXf4OpOi6KJ9jR9AMcKmtRzN6tkslgqlentvX35NZ5NDIzePQSd9f3uTYmsmRtcRzg83J pPwvVewl3ZNTQfAl13P6EGmKd+32zZJVu83cFTvN0a0SJiVn4i7UpjixnQvxKCqV8+ToCJyB7Igz f2AiVbP9116Re1HcaVwCiQnvK/4iP+Xf5tXkVZihS3c3Nt7amd1L8wry/uPKu9Z/ZeqL21tu25nK mCaIVMse6rqpx4kFXzQD31idUTSR4FLdGnUzsAsP3dGEaU71Gc1AluOkZpVe5uV7v4hfgN3QawgW qeB2d3vtbearKyv3pW8s9liKPsBB1qqkS6GZcEF7c839G8wt4zqYiV87hgeu4DnjtR5lBszTZXkv onw7hOPBueAYoPvRTrAFLAHPgVdxpBp4jj7jGcg4zq7nexxT1CyxyE04J9iLcHSfSXIsTTRfWj55 X/vGol+C7STQRWXat06YM0tamB4nFJmJF7Y3zQp52kLOK8PhBYOXPS+bOFG+hPxvgB7fGyM53BAc Z25jBv9IcuZkAOM5D+j+8HPGvRZ+yEhvX0IqKPIu5l6ScRoJeZNrkjXB5P10mhMoei8InUb1bNqe rNxRmdrz7ZHtQqcheoWP6wkTXGde7531tpgJ0pH0MxB3mvfI63es9cCSjrnlNvNPwPX+6zvgetD5 UI83fTmecVKByWt+cfhCL+oRkcf4tf7y7dVVP2iLjAUdB+sOnsbbdVQ0RjehUJE4Lf39pM8vLi5O XB/UasPwQMYlm0t0X7OTN9HGLAyF6T+nwfpG+V3wb4HpQHcqOdWJYAx4nX5sg/+zkMZtqe7SaCWf MU87jteyu+cFp2oxLSnlBs6dbc9ftROnkd03gBb0m+Tvgf+IhauGZwj5F8joJV+cVpEZV5zvVAe1 qTGO53aydyi3wEn41eY8wl7cceITpDvMI7HKdMf5EOhtc0i0yU8eJj/K6vK8KUpbvS7WR0WyWvhG IHtM0/2nDo+8jsdOQPpl6MLFQaeIqOgn3XqwXAXhWYRdMYJu4Fig3SHbP2KadYeL6tN8JtGpP9qU KlsKtOHWIg+/EkCux5IC0AqoXkuFqIrIYLrXGrRHfgrQmP8G1IdKeINEPar/ZHA8UF83gD9RJqvf yLIJA5OaXXZrML88gIcI5pKeVbYumN2rlfQCNBRo4ZQRHgPNYnpNvu4rVi+uRRhmbVJzyiYHL/as a4c2k7PKXqb68K4VtXNprI63SR9lyzfE0etY2w4UfWaBvLgd+QcinfQPAzmIjr61QJPVC1QARTT1 uQo8A7RY/cECYHXivwOto77i82EUvg/+V6CydvxaLDl4/3r9uQWZFlT1yCk13j+BGqCyKjcVaOHl UC8BbRY5sq17M2nVsRIUR32RI90CtPBySNlqY6vusfE+2DTyYeA1oMhu61b7C8H5wLO29XnoFKnZ pcuCirTTyHmixX1iL2NjrqKy+ACeIB86D3wQkJfaDoi/Fq8jObNkmD+v3PfnRA5aIWct3xjM69XW 2lFGC2knUXXMB0NAxkmtrTg0Etg2NQEnWj1pHW3LY3odceXAj2TT4B9FaVuH5VqwjxvRTYrabo5+ cSM2tp4t6EtifdJDhnRydrVv7erzO9C1AHKQ+jqbl4PIufKB1sLKG+JX2z5Efb8EezlWQ7aS/RmE ThkvZ9PaMZBTqje9dUQ512i3ZxGFHkKg3WVJC/ETwl0Cfh1Q1LEkJ7rNZsSTvnmH364+TkdgScI+ N6+pqe2gXERa6KdtBt4fzACvUe4u0BcohFvSAmuXieQoA8NU+o+OF4Vh0VYgW/VVzi8aDtqCReBe oMmydAYJu+M15jVWAR9FF/KZDznqryL5WviD4FqgRd8JRG3AlWEq/cfOdCuyal95Rer7wXpg6QIS cojvgruAnMSSbecaBOrD14HWQrQH3AS02eRMlm6mz5oPHY0nwuTABcpD68CPwI/BUqD5uZHx2TGQ rUfyIHtEWR4eWxXl10hXHxRvCVR5uOpwOcj/AA3AysSfBJkjKKznufLjaOPDIIw0RLZ0lKuseaGk Z7wdymkxG9uNmkBNdHdbhvR/A9v2kzH5v8XkFZJDfYDqsPZ3ki6MdF+LyTV53wcFke7imG4b6Y6R XEfKKNBGeQvyPwG2DYV+N7K/JybfRPr8WJmxMZ0c/aSozEmk7XGpOk+LldHix9fjFzFdC3R/AbYf V0T13RSTKSKyGJkricoMANlrFxubbMOIk7V/KRES9w6bjHMKfUx+ItBxIvLAeKDdbkmeeiu26nAd uX6DddYZpFMU20xqNLgUaNJ1d7CkiDEMzGDn9IyEz8K1c0V9kMu5Rf3SLPw7PZa2STn947SnkC3a mGbhX8meQqcdLNLRYknjKFQG/TbwDNhKu83BKeB8VNrVltqTUL/r0yrKaRNY2kDCjkP3Hzunlls7 3WcsfY7Ev0QZzXc4TvogR60kL6eydJrkZAZYAXwuditsXmXAfJC9dtYg4qHjYKIdWEfpt8Wt6wTZ Keqch+SpbGlW7lfYvJ0lIVOTSB3NVDMJWX3SWx27OJkilK8BjyHoD74ItIPXAEuasDuZCE3wK+Dd SNEJXhZNUO9Ipt06P0rXZypvKZwPm4Hnx9L1dZlB0FYJuBtbObkW4TkwCljSXah+eekoFj7RWbu4 jerPtGENGuAnILNHjtTfo84KeEXEz5QwIs2ZjsjjrQC+Kpbe52TY0SDw39CPj3EK/KBHPN9A+i5k 8uj6pIj00/pC5T3X7cpLxRaB3VPpUFeZX+W835C9ZDiPD5aC/yR7OnhY8og0Kaei2wGfGck0koGg I+gWyfRksTJKH1DG4lxNhS+Ca0EZkLNpPOuBpX1xAGu7v7wNBRQBReK9wCAwIOLHwS0prUgZ3xCN 32NsqQZ4GD6JXtP4TKJ35gVgLTHACc7YOb1b2+Khq3Vs7EUs1ptM2v+iGFNPORVdg16M/dn6JMP+ pKE96PjOX8yIZdvr1dFglnq3UMf3UA4FxwJFi87gDfAMuBxoTDqiNgAb0mdQNjuqovw7qZa+lFPH vcBGrdmktWmWgBFgCjjYpDuKHFNOoy15O1gNmN296CMkOoIFS3K8/abQcVK1wR/wFEKcLon0gl8m 3YTboVlR4XBqfKSJWn+J7kJgO6nFkWxvqijp4rjecINTZogjMXD8WXa7SM5iaDf0BwtYbHuPksqS 2rLtSWYnYRHptaAr0M4PxwZPAoXuA00a62BgnUZH8yj6rIircewRP0hkY7aq/zPQUWyPw5X04Qkp GiL6pem28yST0obsPkkWLkDe+oQaW+roQywoXFr+OIF7fSXf5zRRyXx0L8f0WrzXYvlMMuW7E518 t62PU4p0jeLTjZpUMvVCxiiduAT2B/ACYxwDPg90AddinAzTEXmM8pAW6a9K0H9N3nSlIfV5YJhK P2oqAhwMshFNdctRqpSgnwWwT7UgKt8Aqd6w7kjHXTFD75PSvFu6gfa72QzpruB+oEitedICzLV6 +EB0l4Bw8WG9wONA0bRRSu/KbyytdWaVP8ZqnhG5jdEPkfzo2bWZ8W9nJi5Ti/VrQaRwPQ75VaA1 uA+ZdngWpeaUjnQ97+v6mjBD+r5nT2pe3qKRy82X01Lq0vHzQ6B+aeEFhVc9sah9OcxRwNI0Etpx lv6PxLdA6GiRUI/hu6zBAeTadPF7kxzl9/RzDVx3r57gQJHmYBuwx8pttKPjuiMYA+4EmiuNuwQs RK/jW09jciKVq0HGx3fh74yPkteadQFycp0q+ikJFr4JL4br6VARVZtzLNDGULozdUwJIw4Z8/Fu frzck3pLX/lZ0kLzY+d4f3bZzVZWn1PJOnADuBL8sb4+OavXINf1fkqfeGGW1qp//F6V4r/I3G1u vjnmTeEj74NYfRCrR9FDg1e0iTuNotJ1tBnVSo7vc0C8D9LJLk4asz3GxOsGnH0EakKb0kk/A8wH Ii2aFlOO2xNsBHIiUX6ahX9t28rYY86q1Te7Jpn2GaKc5nfWCK65uAycDfRWehb8+8Ae7W1JnwX6 ADmNaD0I+4H9h6SvAH8DIsllK8hpROqn0goE2rBdwM/AAyAzgab1iOXb+S3pFnr9FAub0HKES6LI k3Bu9ivKOlXtSf5X83NXfqCC+0LUN95L8LbXddpkLsQU5MgyqerUo97gN+bE62FAVeR/jKc/Ch8F tHO7gfZAg1Pbq4AijX4SsRNFNgzDuymrS3KPUJBevFejtGXbSShUa6FTQLvIkl66LYgyujtVWgVc u146OZPke2hf7Y0mfSPQIh4H1McKMBmcAr4DVNZukNWkXwIiRYW446v9eUB9U5SMtz+J/B4wHBwP 9DQkxwyjKX3RvC0jPx6Ugg5gB1gH5gN9wyNnDon0XOwHkpkA+oHOQPUrgmtdpmCj/ujonS0ObQKK cum3g0pY4kfH+xLNvAl+3UflFMRQR0vSf4eL8wNuIvFbM2DpZlsmi0/tW2SO3n1mKuV82/PMOZpn e6+RnSIaTrSaL336m7Pekuc3SXRa4Va7TzuxmsGEE9VYIeyvRXd3pNdb5IvitugZTWZXS6XH/XDx 9lGn8ioip8sQZdXPQqA+7rYK5Nq5GXvyGocgysiVibUftoEo0zfpRdgUwQRFAn0NkNUPZLJpDlNf akGDNsgzhL1s1X85dyV1qu4mKXytnGWxqG9RsLvqaafAHRrgPOGMRgb6Rkf7je90CHvOIoa9MuBM T/lOTcL1j8XsVP7TXl9suvP/sFx+l8KkrvbIabamksE5eUNWLK7TfPoUg1Y4PQ9o0L3AVaBllD+X SZhJOkcHeAb2dhw1MLNvmyBR9Ws5j+F/OkQPQpmm+QCLQ06bAtKHWXIO5SXnmx77vU2oj/7ov8rw vc+7qdrk5Ykhb2YdUXG7/U3jODqW5ITaNXF6iMw3taXjwlz6wMyADZnZtQ15ZatT5V3I/5m6VydN /MIsQz1x6X9BCHoLrKXxiS463nSXiS+VnExOw0/jL9dWJ4cdSKeJOt0WrjuBSFHnA3AHuDbnNMzC QaKGI06ssVRF+Qh29U2ux5OCrgd8G5H9CUbMOEqGdyJFH8CT2RYcaYpbW3CPOefV+EV074KfQhId VSUU1eVZjrMGh9nwKarKFdmPGfhEx1Fdm58/ufiowqILuNKN4zet3rwoLNbVLH7plZ2Lr4TOQkTi 32py0/hB/BEzeLlu6jn6B5qBfXKc+HhrZpV2T+R5Xw5S/le4CP8r0YXvVTIW73C0zfBNanqiRbPF 5vQDH2EyLeUSh3QG9ttxDmlvc40fNjPw/yo9MJdW/21oAAAAAElFTkSuQmCC --_004_D4F8495D4F2Dtarahwheelersymanteccom_--