4
edits
Security:EV: Difference between revisions
Jump to navigation
Jump to search
→Contra
(→Pro) |
(→Contra) |
||
| Line 31: | Line 31: | ||
* Wildcard certificates are not allowed, which leads to further income for commercial CA´s, but it does not provide real security value. | * Wildcard certificates are not allowed, which leads to further income for commercial CA´s, but it does not provide real security value. | ||
* D6a3: The OID´s (1.3.6.1.4.1.311.60.2.1.1, ...) which are referenced in the Guideline are from Microsoft, and are not documented properly: http://asn1.elibel.tm.fr/cgi-bin/oid/display?oid=1.3.6.1.4.1.311.60.2.1.3&submit=Display&action=display | * D6a3: The OID´s (1.3.6.1.4.1.311.60.2.1.1, ...) which are referenced in the Guideline are from Microsoft, and are not documented properly: http://asn1.elibel.tm.fr/cgi-bin/oid/display?oid=1.3.6.1.4.1.311.60.2.1.3&submit=Display&action=display | ||
* B3a2C: In the current versionof the EV Guidelines, only registered organisations are allowed to receive EV certificates | * B3a2C: In the current versionof the EV Guidelines, to ensure high quality vlaidation of subscriber data, only registered organisations are allowed to receive EV certificates. The CA/Browser Forum will expand the EV Guidelines to include indviduals and unregistered businesses in a future version when appropriate vetting steps and privacy protection can be addressed. | ||
* E12b2 demands a protection of private keys, but there is no possibility for anyone besides a developer to actually do that. | * E12b2 demands a protection of private keys, but there is no possibility for anyone besides a developer to actually do that. | ||
* E12b2 only demands the maintaining of the secrecy of the private key, but forgets the initial secrecy. This is a bad, but common practice. | * E12b2 only demands the maintaining of the secrecy of the private key, but forgets the initial secrecy. This is a bad, but common practice. | ||
* E12b2 Proof-of-Non-Possession is missing | * E12b2 Proof-of-Non-Possession is missing | ||
* K37 is likely problematic. (Systemic flaws like Man-in-the-Browser could be a problem here) | * K37 is likely problematic. (Systemic flaws like Man-in-the-Browser could be a problem here) | ||
* AppendixB2c: Privacy issues regarding OCSP over HTTP aren´t being taken care of | * AppendixB2c: Privacy issues regarding OCSP over HTTP aren´t being taken care of | ||