Re: Full Listing of Included CAs

2009-06-22 Thread Kathleen Wilson
I posted my response in mozilla.dev.security.policy. Let's continue the discussion there. Thanks, Kathleen -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto

Re: Full Listing of Included CAs

2009-06-22 Thread Ian G
On 22/6/09 22:23, Kyle Hamilton wrote: Is there an updated request in the queue for O=ABC.ECOM, INC? That one expires 7/9/2009, which is less than a month from now. Good question. Are we going to enforce a 2048-bit root requirement after Dec 31, 2010 (per NIST non-classified recommendation

Re: Full Listing of Included CAs

2009-06-22 Thread Kyle Hamilton
Am I correct in inferring that to the best of your knowledge, if a root does not have a bug number associated with it, it is a "legacy" root (one that was inherited from Netscape/AOL)? If so, this is an even more useful list so that we can see which roots need additional examination. :) -Kyle H

Re: Full Listing of Included CAs

2009-06-22 Thread Eddy Nigg
On 06/23/2009 12:51 AM, Kathleen Wilson: Is there an updated request in the queue for O=ABC.ECOM, INC? That one expires 7/9/2009, which is less than a month from now. I cannot find a request regarding ABA.ECOM in Bugzilla. That's an old legacy root. -- Regards Signer: Eddy Nigg, St

Re: Full Listing of Included CAs

2009-06-22 Thread Kathleen Wilson
> Is there an updated request in the queue for O=ABC.ECOM, INC? > That one expires 7/9/2009, which is less than a month from now. I cannot find a request regarding ABA.ECOM in Bugzilla. > Could I suggest that you also send a copy of this message > (including URLs) to dev-security-policy? Done T

Re: Full Listing of Included CAs

2009-06-22 Thread Kyle Hamilton
Could I suggest that you also send a copy of this message (including URLs) to dev-security-policy? Much appreciated. :) (And very good work!) -Kyle H On Mon, Jun 22, 2009 at 1:11 PM, Kathleen Wilson wrote: > Based on the Firefox 3.5 beta, I created a table of all of the CAs > that are Builtin O

Re: Full Listing of Included CAs

2009-06-22 Thread Eddy Nigg
On 06/22/2009 11:23 PM, Kyle Hamilton: We've already had discussion why MD5 on the root isn't worrisome or bothersome. I'm assuming that there are no attributes of the certificate which contains the trust anchor which are actually checked, and that the trust-bits are effectively set on the key i

Re: Full Listing of Included CAs

2009-06-22 Thread Eddy Nigg
On 06/22/2009 11:11 PM, Kathleen Wilson: Based on the Firefox 3.5 beta, I created a table of all of the CAs that are Builtin Object Tokens. It is posted at: https://wiki.mozilla.org/CA:Overview which has a link called "List of included root certificates" which points to https://wiki.mozilla.org/i

Re: Full Listing of Included CAs

2009-06-22 Thread Kyle Hamilton
Is there an updated request in the queue for O=ABC.ECOM, INC? That one expires 7/9/2009, which is less than a month from now. Are we going to enforce a 2048-bit root requirement after Dec 31, 2010 (per NIST non-classified recommendation)? If so, we need to get the Digital Signature Trust Co Glob

Full Listing of Included CAs

2009-06-22 Thread Kathleen Wilson
Based on the Firefox 3.5 beta, I created a table of all of the CAs that are Builtin Object Tokens. It is posted at: https://wiki.mozilla.org/CA:Overview which has a link called "List of included root certificates" which points to https://wiki.mozilla.org/images/c/ce/BuiltIn-CAs.pdf I look forward