Checks for Mozilla and Microsoft Root program requiremnts

[dougbeattie]

I'm curious if anyone else would like to use these checks and have them cover Mozilla and Microsoft specific root program requirements.

Mozilla: https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
Example: Root certificates in our root program, and any certificate which chains up to them, MUST use only algorithms and key sizes from the following set:

• RSA keys whose modulus size in bits is divisible by 8, and is at least 2048.
• Digest algorithms: SHA-1 (see below), SHA-256, SHA-384, or SHA-512.
• ECDSA keys using one of the following curve-hash pairs:
  • P‐256 with SHA-256
  • P‐384 with SHA-384

Microsoft: https://aka.ms/RootCert
Example: Effective February 1, 2017, all end-entity certificates MUST contain the EKU for the purpose that the CA issued the certificate to the customer, and the end-entity certificate may not use "any EKU."

Do these belong in this zlint, or do they belong in their own standalone set of checks (zlint-mozilla, zlint-ms) so they can be applied by those that want to be compliant with those root programs?

[zakird]

This has come up repeatedly with different folks and we'd be happy to see these lints in ZLint. We'll need to add a slightly more complex interface to check certificates, but that shouldn't be an issue. There's also an open issue for adding checks for CT compliance for Chrome and Apple.

[dougbeattie]

That sounds like a good plan. When do you think you'd have this "more complex" interface designed? Is there anything I can do to start defining some of the checks for this (in the Google doc that is a summary of all checks?) and then perhaps have one of our developers build a few of them?

…

On Wed, Apr 3, 2019 at 10:33 AM Zakir Durumeric ***@***.***> wrote: This has come up repeatedly with different folks and we'd be happy to see these lints in ZLint. We'll need to add a slightly more complex interface to check certificates, but that shouldn't be an issue. There's also an open issue for adding checks for CT compliance for Chrome and Apple. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#277 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMqYexWXx_Zsr3zp3Q_K_quBpN8EB9YAks5vdLucgaJpZM4camMh> .

[dadrian]

This should fit into the current interface for writing lints just fine, unless you actually want to build chains. I'd just start writing some lints and see what happens.

[zakird]

I agree with @dadrian, the interface shouldn't be a big issue right now compared to getting the new lints created. If you can make a list and start to implement them that would be helpful. I'd just make sure that they all have the appropriate Source: and we can use to filter later.

[cpu]

and then perhaps have one of our developers build a few of them?

@dougbeattie Are any of your developers working on this issue?

[dougbeattie]

Yes, we're working on the one at the moment:

• RSA Modulus must be a multiple of 8.

Also, I received this input from Wayne at Mozilla on a couple of others that might be useful:

• P-521 is not permitted
• Intermediates issued after January 1st 2019 must have EKUs
• Backdating of certificates is not permitted. When using zLint as a preissuance checker, it could check that the date of the certificate is not "too far" in the past. I'm not sure this is a good zlint check to add, but it was a comment from Wayne.

I haven't heard from Microsoft.

We might also tackle the first two of those.

[tadukurow]

We're indeed looking into this. Just looking into clarifying some final points, but should have these added fairly quickly after that.

[dougbeattie]

We're having some trouble with defining when a lint should apply.
Zlint automatically determines if something should be CABF compliant or not based on DV/OV/EV and keyusages, but the mozilla policy is for any root in their store, so we can't think of a similar mechanism. Does anyone have some guidance for us on this?

[zakird]

There isn't a beautiful solution to this. I think that the right thing to do here is to create a lint, but set the source to be Mozilla. We can then change the runner to choose which corpus of tests to run.

[cpu]

Closing in favour of #354 - There's been work done in master to split up lints by source and I'd favour seeing smaller issues created off of one larger tracking issue.

Thanks!

[cpu]

I neglected to consider that this issue also requested lints for Microsoft root program reqs. I think it makes sense to consider applying the same process as I've started for #354 for the Microsoft requirements. I don't have the bandwidth to pick that up in addition to managing the Moz. reqs so I'll re-open this issue for now as a marker.

[sleevi]

@cpu I filed #363 for the Microsoft requirements, to at least make it easier for folks to get started.

[cpu]

Thanks @sleevi ! Much appreciated.