<div dir="ltr"><div>On Tue, Aug 14, 2018 at 2:17 PM Barry Fussell (bfussell) <<a href="mailto:bfussell@cisco.com">bfussell@cisco.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_379464175179570735WordSection1">
<p class="MsoNormal"><span style="color:#1f497d">As you might imagine we’ve continued investigating the overall impact. I’ve been told<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">that in addition to IAIK that Bouncy Castle had similar issues. We are also aware of<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">customers that will be impacted by the upcoming releases if certificates with fractional<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">time fails to verify.</span></p></div></div></blockquote><div><br></div><div><div>When you say Bouncy Castle has similar issues, do you mean that Bouncy Castle additionally tolerates such things, or that Bouncy Castle also generates non-compliant certificates? The former is not, in itself, a reason to accept them certificates in OpenSSL. If the latter, do you have a link to a bug filed with BouncyCastle? Whether or not OpenSSL accepts it, Bouncy Castle should be fixed to match RFC 5280 going forward.</div></div><div><br></div><div>Likewise, do you have plans to fix the issue in your implementation? I haven't confirmed this, but I don't believe Chrome or Firefox would accept such certificates today.</div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_379464175179570735WordSection1"><p class="MsoNormal"></p>
<p class="MsoNormal"><span style="color:#1f497d">I think it’s important to maintain interoperability even in the event that there are<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">minor profile violations. If there is anything I can do to help move this forward<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">please let me know.</span></p></div></div></blockquote><div><br></div><div><div>While this may indeed be a case where OpenSSL must accept non-compliant inputs, that is not good advice for implementations to follow in general. This is part of the common interpretation of Postel's Law ("..., be liberal in what you accept"), which has not fared well, particularly in the security space.</div></div><div><br></div><div>See this document which describes the problems with this approach.</div><div><a href="https://tools.ietf.org/html/draft-iab-protocol-maintenance-00">https://tools.ietf.org/html/draft-iab-protocol-maintenance-00</a></div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_379464175179570735WordSection1">
<p class="MsoNormal"><span style="color:#1f497d">Thanks !<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Barry<u></u><u></u></span></p></div></div><div lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_379464175179570735WordSection1">
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<table class="m_379464175179570735MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="0" style="width:326.45pt;border:solid #cccccc 1.0pt">
<tbody>
<tr>
<td width="434" colspan="2" style="width:325.45pt;border:none;border-bottom:solid #cccccc 1.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"></span></p><img src="cid:1653db582ab5b006a1" alt="image002.jpg" class="" style="max-width: 100%;"><u></u><u></u><p></p>
</td>
<td style="border:none;padding:0in 0in 0in 0in" width="1">
<p class="MsoNormal"> </p>
</td>
</tr>
<tr>
<td width="217" valign="top" style="width:162.55pt;border:none;padding:11.25pt 0in 11.25pt .25in">
<p class="MsoNormal"><b><span style="font-size:9.0pt">Barry Fussell</span></b><span style="font-size:9.0pt"><br>
Technical Leader<br>
Security & Trust Organization<br>
</span><a href="mailto:bfussell@cisco.com" target="_blank"><span style="font-size:9.0pt;color:#0563c1">bfussell@cisco.com</span></a><span style="font-size:9.0pt"><br>
Phone: <b><a href="tel:(919)%20392-2920" value="+19193922920" target="_blank">+1 919 392 2920</a></b><u></u><u></u></span></p>
</td>
<td width="217" valign="top" style="width:162.9pt;border:none;padding:11.25pt 0in 7.5pt 15.0pt">
<p class="MsoNormal"><b><span style="font-size:9.0pt">Cisco Systems, Inc.</span></b><span style="font-size:9.0pt"><br>
7025-2 Kit Creek Road<br>
Research Triangle Park, NC 27709<br>
United States<br>
</span><a href="http://www.cisco.com/" target="_blank"><span style="font-size:9.0pt;color:#0563c1">Cisco.com</span></a><span style="font-size:9.0pt"><u></u><u></u></span></p>
</td>
<td width="1" style="width:1.0pt;border:none;padding:0in 0in 0in 0in"></td>
</tr>
<tr style="height:3.0pt">
<td width="434" colspan="2" style="width:325.45pt;border:none;padding:0in 0in 0in 0in;height:3.0pt">
</td>
<td style="border:none;padding:0in 0in 0in 0in" width="1">
<p class="MsoNormal"> </p>
</td>
</tr>
<tr>
<td width="434" colspan="2" style="width:325.45pt;border:none;border-top:solid #cccccc 1.0pt;padding:3.75pt 15.0pt 3.75pt .25in">
<p class="MsoNormal"><span style="font-size:6.0pt"></span></p><img src="cid:1653db582ab772f6c2" alt="image004.jpg" class="" style="max-width: 100%;">Think before you print.<span style="font-size:6.0pt"><u></u><u></u></span><p></p>
<p class="MsoNormal"><span style="font-size:6.0pt">This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended
recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:6.0pt">Please </span><a href="http://www.cisco.com/web/about/doing_business/legal/cri/index.html" title="Legal Information" target="_blank"><span style="font-size:6.0pt;color:#0563c1">click here</span></a><span style="font-size:6.0pt">
for Company Registration Information.</span><u></u><u></u></p>
</td>
<td style="border:none;padding:0in 0in 0in 0in" width="1">
<p class="MsoNormal"> </p>
</td>
</tr>
<tr height="0">
<td width="325" style="border:none"></td>
<td width="326" style="border:none"></td>
<td width="2" style="border:none"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div></div><div lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_379464175179570735WordSection1"></div>
</div>
_______________________________________________<br>
openssl-project mailing list<br>
<a href="mailto:openssl-project@openssl.org" target="_blank">openssl-project@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-project" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-project</a></blockquote></div></div>