{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/pkipolicy/issues/13","repository_url":"https://api.github.com/repos/mozilla/pkipolicy","labels_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/13/comments","events_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/13/events","html_url":"https://github.com/mozilla/pkipolicy/issues/13","id":187702730,"number":13,"title":"Update entropy requirements for EE certificates","user":{"login":"gerv","id":299746,"avatar_url":"https://avatars.githubusercontent.com/u/299746?v=3","gravatar_id":"","url":"https://api.github.com/users/gerv","html_url":"https://github.com/gerv","followers_url":"https://api.github.com/users/gerv/followers","following_url":"https://api.github.com/users/gerv/following{/other_user}","gists_url":"https://api.github.com/users/gerv/gists{/gist_id}","starred_url":"https://api.github.com/users/gerv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gerv/subscriptions","organizations_url":"https://api.github.com/users/gerv/orgs","repos_url":"https://api.github.com/users/gerv/repos","events_url":"https://api.github.com/users/gerv/events{/privacy}","received_events_url":"https://api.github.com/users/gerv/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/mozilla/pkipolicy/milestones/2","html_url":"https://github.com/mozilla/pkipolicy/milestones/2.4","labels_url":"https://api.github.com/repos/mozilla/pkipolicy/milestones/2/labels","id":2118985,"number":2,"title":"2.4","description":null,"creator":{"login":"gerv","id":299746,"avatar_url":"https://avatars.githubusercontent.com/u/299746?v=3","gravatar_id":"","url":"https://api.github.com/users/gerv","html_url":"https://github.com/gerv","followers_url":"https://api.github.com/users/gerv/followers","following_url":"https://api.github.com/users/gerv/following{/other_user}","gists_url":"https://api.github.com/users/gerv/gists{/gist_id}","starred_url":"https://api.github.com/users/gerv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gerv/subscriptions","organizations_url":"https://api.github.com/users/gerv/orgs","repos_url":"https://api.github.com/users/gerv/repos","events_url":"https://api.github.com/users/gerv/events{/privacy}","received_events_url":"https://api.github.com/users/gerv/received_events","type":"User","site_admin":false},"open_issues":17,"closed_issues":0,"state":"open","created_at":"2016-11-07T13:41:58Z","updated_at":"2016-11-14T13:44:34Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2016-11-07T12:44:58Z","updated_at":"2016-11-17T19:00:06Z","closed_at":null,"body":"Currently, the policy says:\r\n\r\n<blockquote>\r\nall new end-entity certificates must contain at least 20 bits of unpredictable random data (preferably in the serial number).\r\n</blockquote>\r\n\r\nWe should require the random data to be in the serial number, and perhaps also update the number of bits required.\r\n\r\nThere was a discussion in m.d.s.policy:\r\nhttps://groups.google.com/d/msg/mozilla.dev.security.policy/3avqmSF4MVU/ZPFE0rIuAQAJ"},"comment":{"url":"https://api.github.com/repos/mozilla/pkipolicy/issues/comments/261336476","html_url":"https://github.com/mozilla/pkipolicy/issues/13#issuecomment-261336476","issue_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/13","id":261336476,"user":{"login":"briansmith","id":16816,"avatar_url":"https://avatars.githubusercontent.com/u/16816?v=3","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false},"created_at":"2016-11-17T19:00:06Z","updated_at":"2016-11-17T19:00:06Z","body":"> Wouldn't that be best addressed by some sort of requirement against key reuse? Keys used inside the Web PKI may not be used outside it?\r\n\r\nIt is hard to do. For example \"incide the Web PKI\" wouldn't include S/MIME but surely some CAs are using the same keys for S/MIME and server certificates. Also, even within the Web PKI, there are various possibilities for key reuse: Certificates, CT precert signing, OCSP, CRLs, RoughTime, etc. Some of these are the signing of things that are less likely to be under as much attacker control as certificates.\r\n\r\nAlso, it will not be easy (or possible?) to enforce that in any way."}}
{"actor":{"display_login":"briansmith"}}