Subject: [wpkops] Browser behaviour draft

From: Tim Moses <[email-masked]>
Date: Wed, 23 Jul 2014 20:22:47 +0000

Colleagues - I would like to advance the Browser Behaviour draft ...

http://datatracker.ietf.org/doc/draft-wilson-wpkops-browser-processing/

 ... to WG draft.

If you wish to comment, please do so by 2014-08-08.

Thank you.  All the best. Tim.

---

From: Gervase Markham <[email-masked]>
Date: Thu, 24 Jul 2014 10:20:39 +0100

Hi Tim,

> http://datatracker.ietf.org/doc/draft-wilson-wpkops-browser-processing/

This document (helpfully) states:

"This document reviews some of the certificate-processing features of
the following cryptolibraries: Network Security Services (NSS), in two
code sets, Classic (NSS-Classic) and PKIX (NSS-PKIX); ..."

However, as of two days ago, with the release of Firefox 31, Firefox
switched to using mozilla::pkix for certificate verification:
https://blog.mozilla.org/security/2014/04/24/exciting-updates-to-certificate-verification-in-gecko/
https://www.mozilla.org/en-US/firefox/31.0/releasenotes/

You will need to decide whether to hold the document while you update it
to take account of any changes.

I can tell you that mozilla::pkix also does not do AIA chasing.

"and most end users can manually add or remove root certificates"

Is that a statement about opportunity or capability? :-) Perhaps better
as: "most user agents give end users the opportunity to add or remove
root certificates".

Gerv

---

From: Tim Moses <[email-masked]>
Date: Thu, 24 Jul 2014 12:42:29 +0000

Hi Gerv.  It has to be "opportunity"; we all know that users don't possess the capability to manage security on their end systems.

Ooh!  I should put a smiley face after that.

;-)

We made a decision to record the state of Web PKI at a point in time.  (That being the end of 2013.)  The state is continuously evolving, and it would be a poor use of our time if we were to attempt to track it.  However, if completion is delayed much beyond the projected completion date, we may have to revisit that decision.

Thanks for your helpful input.

All the best.  Tim.

-----Original Message-----
From: Gervase Markham [mailto:[email-masked]] 
Sent: Thursday, July 24, 2014 5:21 AM
To: Tim Moses; [email-masked]
Subject: Re: [wpkops] Browser behaviour draft

Hi Tim,

"This document reviews some of the certificate-processing features of the following cryptolibraries: Network Security Services (NSS), in two code sets, Classic (NSS-Classic) and PKIX (NSS-PKIX); ..."

However, as of two days ago, with the release of Firefox 31, Firefox switched to using mozilla::pkix for certificate verification:
https://blog.mozilla.org/security/2014/04/24/exciting-updates-to-certificate-verification-in-gecko/
https://www.mozilla.org/en-US/firefox/31.0/releasenotes/

You will need to decide whether to hold the document while you update it to take account of any changes.

Is that a statement about opportunity or capability? :-) Perhaps better
as: "most user agents give end users the opportunity to add or remove root certificates".

Gerv

---

From: Ben Wilson <[email-masked]>
Date: Thu, 24 Jul 2014 15:44:44 +0000

We could add a clear statement in the document that says, "this document describes the state of the Web PKI circa 2013" or something like that.

-----Original Message-----
From: wpkops [mailto:[email-masked]] On Behalf Of Tim Moses
Sent: Thursday, July 24, 2014 6:42 AM
To: Gervase Markham; [email-masked]
Subject: Re: [wpkops] Browser behaviour draft

;-)

All the best.  Tim.

-----Original Message-----
From: Gervase Markham [mailto:[email-masked]] 
Sent: Thursday, July 24, 2014 5:21 AM
To: Tim Moses; [email-masked]
Subject: Re: [wpkops] Browser behaviour draft

Hi Tim,

Gerv
_______________________________________________
wpkops mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/wpkops