<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Peter,<o:p></o:p></p><p class=MsoNormal>In an earlier post you wrote that the number “650+” for separate CAs came from the number of distinct values for the "Organization" field in the DN (out of more than 1500 CA certificates and 1200 DNs). Many of us in the CA industry believe—from a purely objective standpoint—that the threat surface in need of attention is smaller. Is anyone else besides a few of us CAs interested in analyzing this same general area (number of CAs) with different criteria in mind? If the PKI hierarchies involved and physical location of CA keys were considered, then different conclusions could be made. For instance, what would the map look like if the DFN-Verien root were removed? It’s just that the number “650” is now being used regularly in various venues to argue that the problem is that there are too many weak links—but while there may be a statistical correlation (the more cars there are, the more likely you are to get into an accident), the large number alone does not lead directly to the conclusions being made. As someone mentioned to me recently, it’s just a number, but what it connotes might be something more and statistics and visual representations support the case one tries to make. All I am saying is that a number alone only tells us “how many” – it doesn’t tell us anything about “good” or “bad.” In other words, a purely quantitative analysis without corresponding qualitative criteria brings about a different result and leads to a different conclusion than what course of action might be best. Just some thoughts.<o:p></o:p></p><p class=MsoNormal>Ben<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Benjamin T. Wilson, JD CISSP <br>General Counsel and SVP Industry Relations<br>DigiCert, Inc.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="http://www.digicert.com/"><span style='font-size:12.0pt;font-family:"Times New Roman","serif";color:blue;text-decoration:none'><img border=0 width=224 height=58 id="Picture_x0020_1" src="cid:image001.gif@01CCB4D7.529F9460" alt="Visit DigiCert.com"></span></a><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666'>Online: <a href="http://www.digicert.com/" target="_blank"><span style='color:blue'>www.DigiCert.com</span></a><br>Email: <a href="mailto:ben@digicert.com"><span style='color:blue'>ben@digicert.com</span></a><br>Toll Free: <b>1-800-896-7973</b> (US & Canada)<br>Direct: <b>1-801-701-9678</b><br>Fax: <b>1-866-842-0223</b> (Toll Free if calling from the US or Canada) <o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><hr size=1 width="100%" noshade style='color:#007DC0' align=center></div><p class=MsoNormal><span style='font-size:7.0pt;font-family:"Arial","sans-serif";color:#007DC0'>The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. Thank You</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>