<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">FYI. Quietly ignoring fractional seconds makes sense to me.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">David McGrew <mcgrew@cisco.com><br>
<b>Date: </b>Saturday, August 11, 2018 at 9:45 AM<br>
<b>To: </b>Rich Salz <rsalz@akamai.com>, "Barry Fussell (bfussell)" <bfussell@cisco.com><br>
<b>Cc: </b>"Marty Loy (mloyjr)" <mloyjr@cisco.com>, "Jonathan Felten (jfelten)" <jfelten@cisco.com>, "Bill Sulzen (bsulzen)"
<a href="mailto:bsulzen@cisco.com">bsulzen@cisco.com</a><br>
<b>Subject: </b>Re: Certificate fractional time processing in upcoming openssl releases<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hi Barry and Rich,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for this. I think that having the rejection of fractional seconds be part of the “—strict” option makes sense.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As I understand it, there are fielded certs with fractional seconds in GeneralizedTime, which violates the RFC5280 profile but doesn’t introduce any vulnerability. That RFC aims to promote interoperability by making a profile of X509
formats and semantics, and fractional seconds is only formatting, and not semantics. So it seems counter to the spirit of the RFC to prevent openSSL from being able to interoperate with certs issued by IAIK or whatever noncompliant systems. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">David<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">"Salz, Rich" <<a href="mailto:rsalz@akamai.com">rsalz@akamai.com</a>><br>
<b>Date: </b>Friday, August 10, 2018 at 12:24 PM<br>
<b>To: </b>"Barry Fussell (bfussell)" <<a href="mailto:bfussell@cisco.com">bfussell@cisco.com</a>><br>
<b>Cc: </b>"Marty Loy (mloyjr)" <<a href="mailto:mloyjr@cisco.com">mloyjr@cisco.com</a>>, "Jonathan Felten (jfelten)" <<a href="mailto:jfelten@cisco.com">jfelten@cisco.com</a>>, mcgrew <<a href="mailto:mcgrew@cisco.com">mcgrew@cisco.com</a>>, "Bill Sulzen (bsulzen)"
<<a href="mailto:bsulzen@cisco.com">bsulzen@cisco.com</a>><br>
<b>Subject: </b>Re: Certificate fractional time processing in upcoming openssl releases<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<div>
<p class="MsoNormal">Please post to <a href="mailto:openssl-project@openssl.org">
openssl-project@openssl.org</a> It’s a moderated list, but the posting will get approved very quickly.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">"Barry Fussell (bfussell)" <<a href="mailto:bfussell@cisco.com">bfussell@cisco.com</a>><br>
<b>Date: </b>Friday, August 10, 2018 at 9:34 AM<br>
<b>To: </b>Rich Salz <<a href="mailto:rsalz@akamai.com">rsalz@akamai.com</a>><br>
<b>Cc: </b>"Marty Loy (mloyjr)" <<a href="mailto:mloyjr@cisco.com">mloyjr@cisco.com</a>>, "Jonathan Felten (jfelten)" <<a href="mailto:jfelten@cisco.com">jfelten@cisco.com</a>>, David McGrew <<a href="mailto:mcgrew@cisco.com">mcgrew@cisco.com</a>>, "Bill Sulzen
(bsulzen)" <<a href="mailto:bsulzen@cisco.com">bsulzen@cisco.com</a>><br>
<b>Subject: </b>Certificate fractional time processing in upcoming openssl releases</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">Rich,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">My team was recently made aware of a change in the time comparison<o:p></o:p></p>
<p class="MsoNormal">logic in openssl to adhere to RFC5280 requirements . This change will be in<o:p></o:p></p>
<p class="MsoNormal">the upcoming 1.0.2p and 1.1.0i releases. We’ve had discussions regarding<o:p></o:p></p>
<p class="MsoNormal">the impact to legacy devices in the field and feel the change could be<o:p></o:p></p>
<p class="MsoNormal">detrimental if enabled by default.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">We've seen fractional time used in many cases, for example the IAIK<o:p></o:p></p>
<p class="MsoNormal">crypto library generated fractional times for quite a while. I believe the<o:p></o:p></p>
<p class="MsoNormal">issue with the IAIK library has been fixed, but products still have those certs<o:p></o:p></p>
<p class="MsoNormal">embedded in them today.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">In reading the discussion linked below it seems the only impetus for<o:p></o:p></p>
<p class="MsoNormal">this change was to meet RFC5280, not that allowing fractional times<o:p></o:p></p>
<p class="MsoNormal">was any specific vulnerability.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openssl_openssl_issues_2620&d=DwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=Lwc9LOtfM8pc8gkaABxWdUutvh8gwoL2KvhYe2d4y3Q&s=7DMTtQYOol3SGlQwP-5nyNTMX8ulbcaYRt5_PF8ol7g&e=">https://github.com/openssl/openssl/issues/2620</a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Is there any option for this going forward, removal, compile-time<o:p></o:p></p>
<p class="MsoNormal">enabled or part of the strict checks ?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks !<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Barry Fussell<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="435" style="width:326.45pt;border:solid #CCCCCC 1.0pt">
<tbody>
<tr>
<td width="434" colspan="2" style="width:325.45pt;border:none;border-bottom:solid #CCCCCC 1.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><img border="0" width="401" height="47" style="width:4.177in;height:.4895in" id="Picture_x0020_1" src="cid:image001.jpg@01D43158.AF99C3C0" alt="http://www.cisco.com/web/europe/images/email/signature/tomorrow_anthem_H.png"></span><o:p></o:p></p>
</td>
<td width="1" style="width:.75pt;border:none;padding:0in 0in 0in 0in">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
<tr>
<td width="217" valign="top" style="width:162.55pt;border:none;padding:11.25pt 0in 11.25pt .25in">
<p class="MsoNormal"><b><span style="font-size:9.0pt">Barry Fussell</span></b><span style="font-size:9.0pt"><br>
Technical Leader<br>
Security & Trust Organization<br>
</span><a href="mailto:bfussell@cisco.com"><span style="font-size:9.0pt">bfussell@cisco.com</span></a><span style="font-size:9.0pt"><br>
Phone: <b>+1 919 392 2920</b></span><o:p></o:p></p>
</td>
<td width="217" valign="top" style="width:162.9pt;border:none;padding:11.25pt 0in 7.5pt 15.0pt">
<p class="MsoNormal"><b><span style="font-size:9.0pt">Cisco Systems, Inc.</span></b><span style="font-size:9.0pt"><br>
7025-2 Kit Creek Road<br>
Research Triangle Park, NC 27709<br>
United States<br>
</span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cisco.com_&d=DwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=Lwc9LOtfM8pc8gkaABxWdUutvh8gwoL2KvhYe2d4y3Q&s=jiXJrK_CCjJLudysdejd12bdgw7_tY1mj_o-AtgDeLw&e="><span style="font-size:9.0pt">Cisco.com</span></a><o:p></o:p></p>
</td>
<td width="1" style="width:1.0pt;border:none;padding:0in 0in 0in 0in"></td>
</tr>
<tr style="height:3.0pt">
<td width="434" colspan="2" style="width:325.45pt;border:none;padding:0in 0in 0in 0in;height:3.0pt">
</td>
<td width="1" style="width:.75pt;border:none;padding:0in 0in 0in 0in;height:3.0pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
<tr>
<td width="434" colspan="2" style="width:325.45pt;border:none;border-top:solid #CCCCCC 1.0pt;padding:3.75pt 15.0pt 3.75pt .25in">
<p class="MsoNormal"><span style="font-size:6.0pt"><img border="0" width="19" height="19" style="width:.1979in;height:.1979in" id="Picture_x0020_2" src="cid:image002.jpg@01D43158.AF99C3C0" alt="http://www.cisco.com/assets/swa/img/thinkbeforeyouprint.gif">Think
before you print.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:6.0pt">This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended
recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:6.0pt">Please </span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cisco.com_web_about_doing-5Fbusiness_legal_cri_index.html&d=DwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=Lwc9LOtfM8pc8gkaABxWdUutvh8gwoL2KvhYe2d4y3Q&s=gfKgERtaAUVlAA0GHdXitfmhgtPbojPDaeFPm99y5SU&e=" title="Legal Information"><span style="font-size:6.0pt">click
here</span></a><span style="font-size:6.0pt"> for Company Registration Information.</span><o:p></o:p></p>
</td>
<td width="1" style="width:.75pt;border:none;padding:0in 0in 0in 0in">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
<tr>
<td width="325" style="width:243.75pt;border:none;padding:0in 0in 0in 0in"></td>
<td width="326" style="width:244.5pt;border:none;padding:0in 0in 0in 0in"></td>
<td width="2" style="width:1.5pt;border:none;padding:0in 0in 0in 0in"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</body>
</html>