[openssl-dev] [openssl.org #3992] [PATCH] Allow RFC6962 Signed Certificate Timestamps to be disabled

[David Woodhouse]

On Fri, 2015-08-07 at 15:34 +0000, Blumenthal, Uri - 0553 - MITLL via
RT wrote:
> Alas, not right now (and here we're in agreement).
> 
> However I expect the field to evolve with the threats, and the means 
> for using this capability to emerge. 


UEFI is widely mocked for how bloated it is, given that the job of a sane firmware is to boot the operating as quickly as possible and then get the hell out of the way.

You seem to be suggesting that we build in some cryptographic functionality that we admit we have no *idea* how we could sensibly use it, and also build in various extended math library routines that are currently unneeded but would need a whole bunch of pain for different GCC/MSVC/LLVM toolchains and ABIs... just in case we one day work out how we might use it.

> IMHO it would be easier to keep this feature waiting rather than 
> opening a whole new discussion later on. 

If you come up with a use case, it's hardly difficult for you to check
out the open source UEFI implementation from its git tree, build it
*without* OPENSSL_NO_SCT, and implement and test your ideas.

When you submit that, of course there will be a "whole new discussion".
about your design and your implementation. But it's largely distinct
from this one and will need to happen *anyway* even if we disable SCT
in the meantime.

> Plus, by just being there it might "stimulate"‎ people to look for 
> ways to use it.

It'll "stimulate" people, I'm sure. But not in a good way.

-- 
dwmw2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5691 bytes
Desc: not available
URL: <http://mta.openssl.org/pipermail/openssl-dev/attachments/20150810/0d4195c1/attachment.bin>