3 ms·
The requirements for being a public CA are self-regulated by the industry (via a consortium called CABforum including CAs and browser vendors). The requirements
by lvh 9y ago
The requirements for being a public CA are self-regulated by the industry (via a consortium called CABforum including CAs and browser vendors). The requirements are far more stringent than that, but yes, you need an appropriate HSM.
There are some biases that are far more likely in some root CAs because they’re unusually long-lived. For example, I would expect Blum primes to be more prevalent among CAs than a randomly selected leaf certificate. This is because of pre-NFS/QFS folklore that they’re safer. While this is a detectable pattern, it’s not known to produce weaker keys, though it does effectively halve your set of primes.
- jlgaddis 9y ago> The requirements for being a public CA are self-regulated by the industry (via a consortium called CABforum including CAs and browser vendors). The requirements are far more stringent than that, but yes, you need an appropriate HSM. Yeah, and no root CA would ever do anything to violate the BRs, right? /s
- lvh 9y agoIt’s true that BRs exist for a reason (and CAs occasionally fail to follow them), but roots not being on an appropriate HSM would be an extraordinary claim. The failures we’ve seen are not in the same ballpark.