Page 1 ·1· · · · · · · · · · ·UNITED STATES DISTRICT COURT

·2· · · · · · · · · · NORTHERN DISTRICT OF CALIFORNIA

·3· · · · · · · · · · · · · ·SAN JOSE DIVISION

·4· · · · · - - - - - - - - - - - - - - - - x

·5· · · · · CHRISTINA GRACE AND KEN POTTER, :

· · · · · · Individually and on Behalf Of

·6· · · · · All Others Similarly Situated, :

·7· · · · · · · · · · Plaintiffs,· · · · · ·: Case No.

·8· · · · · · vs.· · · · · · · · · · · · · ·: 5:17-CV-00551-LHK (NC)

·9· · · · · APPLE INC.,· · · · · · · · · · ·:

10· · · · · · · · · · Defendant.· · · · · · :

11· · · · · - - - - - - - - - - - - - - - - x

12

13· · · · · · · HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

14· · · · · · · · · · ·DEPOSITION OF AVIEL D. RUBIN

15· · · · · · · · · · · · · ·Towson, Maryland

16· · · · · · · · · · ·Wednesday, September 26, 2018

17

18

19

20

21

22

23

24· ·Reported by:

· · ·Misty Klapper, CRR, RMR

25· ·Job No.: 307547

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 1 of 10
Page 102

·1· ·expiration date?

·2· · ·A.· · X.509 certificates do.

·3· · ·Q.· · Do all non-X.509 digital certificates

·4· ·have an expiration date?

·5· · · · · ·MR. NOVIKOV:· Foundation.

·6· · · · · ·THE WITNESS:· I would imagine that

·7· ·there are people that have homegrown digital

·8· ·certificate systems that did not implement

·9· ·things correctly and did not put expiration

10· ·dates on them.· I can't comment about every

11· ·digital certificate in the world.

12· · · · · ·BY MR. McCARTY:

13· · ·Q.· · What is an X.509 digital certificate?

14· · ·A.· · X.509 is a standard put out by a body

15· ·called the ITU, and it is a particular format

16· ·and set of rules for how to express

17· ·certificates and how to use them.

18· · ·Q.· · You said the ITU.· What is the ITU?

19· · ·A.· · It stands for international trade, and

20· ·I'm not sure what the U is.· I don't think it's

21· ·union, but I don't remember what it is.

22· · · · · ·The I -- the IETF also has a lot of

23· ·standards around X.509, including RFCs, which

24· ·are requests for comment, but actually

25· ·represent the standard document.· RFC --

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 2 of 10
Page 104

·1· · · · · ·BY MR. McCARTY:

·2· · ·Q.· · What is the difference between an X.509

·3· ·digital certificate and a digital certificate

·4· ·that is not an X.509 digital certificate?

·5· · ·A.· · Compliance with a standard.

·6· · ·Q.· · If you turn to page 11 --

·7· · ·A.· · I'm there.

·8· · ·Q.· · -- you state that, There are several

·9· ·reasons why X.509 certificates have expiration

10· ·dates, and why they are preferably enforced as

11· ·part of the validation process.

12· · · · · ·Do you see that?

13· · ·A.· · No, I haven't been able to find where

14· ·you are.

15· · ·Q.· · Sorry.

16· · ·A.· · Oh, the top of the page?

17· · ·Q.· · Page 11, yes.

18· · ·A.· · Yeah, okay.

19· · ·Q.· · It is the last sentence of

20· ·paragraph 41.· Would you please read that

21· ·sentence and let me know when you're done?

22· · ·A.· · Yes.

23· · ·Q.· · Why do you say that it is preferable to

24· ·enforce X.509 certificate expiration dates?

25· · ·A.· · Well, the expiration dates are there to

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 3 of 10
Page 105

·1· ·limit the exposure of the keys.· And so it is

·2· ·preferable to check the expiration, and that

·3· ·way you wouldn't be using a key beyond the

·4· ·amount of time that it's supposed to be used.

·5· · ·Q.· · What do you mean when you say the

·6· ·expiration dates of X.509 certificates are

·7· ·there to limit the exposure of the keys?

·8· · ·A.· · Well, when -- in -- in a system, when

·9· ·one entity sends its X.509 certificate, it's

10· ·doing that because it's going to be using the

11· ·private key that corresponds to the public key

12· ·that's in the certificate.

13· · · · · ·The expiration date in the certificate

14· ·is intended for the recipient not to -- not to

15· ·honor the use of the private key beyond a

16· ·certain date.· And the concern is that keys can

17· ·get compromised over time, and so the private

18· ·key -- by having an expiration in the

19· ·certificate of the public key that matches that

20· ·private key means the private key can only be

21· ·used up until a certain time.

22· · ·Q.· · Can -- well, strike that.

23· · · · · ·Can a system use X.509 certificates and

24· ·not enforce the validity periods of those X.509

25· ·certificates?

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 4 of 10
Page 110

·1· ·that.

·2· · · · · ·Is that a reason for why X.509

·3· ·certificates have expiration dates?

·4· · · · · ·MR. NOVIKOV:· Objection to form.

·5· · · · · ·THE WITNESS:· X.509 certificates have

·6· ·expiration dates because of the security

·7· ·implications of not having expiration dates.

·8· ·And the fact that CRLs no longer maintain

·9· ·expired certificates is more of a consequence

10· ·of that than the cause.

11· · · · · ·BY MR. McCARTY:

12· · ·Q.· · Do X.509 certificates have expiration

13· ·dates so that the certificates are replaced?

14· · ·A.· · I -- again, I think I would phrase it

15· ·differently.· I would say that the certificates

16· ·are replaced because they have expiration

17· ·dates.

18· · ·Q.· · Is one of the reasons why certificates

19· ·in X.509 have expiration dates is to encourage

20· ·replacing certificates?

21· · ·A.· · Replacing or revalidating, I would say

22· ·yes.

23· · ·Q.· · And why is it important to replace or

24· ·revalidate digital certificates periodically?

25· · ·A.· · Because the keys are at risk of

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 5 of 10
Page 153

·1· ·are going to expire and you do it every

·2· ·36 months, you could set a particular month.

·3· ·You could say okay, we need to do that every

·4· ·April and every three years or every third

·5· ·April -- or whatever the three years goes by;

·6· ·whereas, if it's 39, then it's always going to

·7· ·shift back three months and it would be harder

·8· ·to keep track of that.

·9· · ·Q.· · Is it important to keep track of the

10· ·expiration dates of digital certificates for

11· ·the purposes of reissuing them?

12· · ·A.· · It is helpful in the administration of

13· ·these things.

14· · ·Q.· · Have you read the CA/Browser Forum

15· ·documents that you cite in the bottom of

16· ·page 18?

17· · ·A.· · I'm sure that I read them at some

18· ·point.

19· · ·Q.· · Why didn't you cite to the CA/Browser

20· ·Forum documents in your original declaration in

21· ·this case?

22· · ·A.· · I don't know.

23· · ·Q.· · Is it because you just learned of the

24· ·CA/Browser Forum after July 3rd?

25· · ·A.· · I don't know if I already had heard of

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 6 of 10
Page 175

·1· · ·Q.· · How can you be sure that companies do

·2· ·check expiration dates of certificates, but be

·3· ·unsure whether companies don't check expiration

·4· ·for some certificates?

·5· · ·A.· · I don't know if it's common for

·6· ·companies to have different policies for

·7· ·different services or if they check for all of

·8· ·them or don't check.· In fact, a lot of the

·9· ·companies that I deal with in my consulting

10· ·business are small and they only have one major

11· ·service, and so I -- you know, they couldn't

12· ·possibly be in a situation where they check for

13· ·some and not for others because they only have

14· ·one.

15· · ·Q.· · Is it generally understood by people in

16· ·your field that when the validity period of a

17· ·certificate expires, any services relying upon

18· ·that certificate or that checks a certificate

19· ·that is issued by that certificate authority

20· ·that expired will fail?

21· · ·A.· · Not at all.· So remember I gave you the

22· ·example of Johns Hopkins.· And, in fact, that's

23· ·the case where they check -- another example

24· ·where they check certificate validity in the

25· ·services that we use.· And two things are going

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 7 of 10
Page 176

·1· ·to happen.· Either the certificates are going

·2· ·to get renewed or they won't, the service will

·3· ·fail and people will complain and then services

·4· ·will be fixed by issuing certificates.

·5· · ·Q.· · So you don't think it's generally

·6· ·understood by people in your field that

·7· ·basically when a certificate expires, anything

·8· ·that relies upon that certificate will cease to

·9· ·work?

10· · ·A.· · I have to add to that if they don't

11· ·renew their certificate.· Many of the services,

12· ·there's the expectation that they will renew

13· ·the certificate and then the service won't

14· ·fail.

15· · ·Q.· · Yeah.· So taking out the qualifier of

16· ·whether or not an IT administrator knows to

17· ·recertify, do you or do you not think it's

18· ·generally understood by people in your field

19· ·that when a certificate expires, any software

20· ·that checks that certificate expiration will

21· ·fail?

22· · ·A.· · Well, you have to also -- I mean,

23· ·you're being very broad here, because there may

24· ·be something that checks the certificate and

25· ·then has some other action besides failing.

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 8 of 10
Page 187

·1· ·certificate was expired and it didn't work,

·2· ·well, then something was done, they issued a

·3· ·new certificate and it worked.

·4· · · · · ·So without any changes to the system or

·5· ·to the certificates, the FaceTime calls were

·6· ·going to start failing then.

·7· · ·Q.· · That's how the system was originally

·8· ·designed?

·9· · · · · ·MR. NOVIKOV:· Objection, form.

10· · · · · ·THE WITNESS:· I -- I wouldn't say it

11· ·was designed with the purpose of the calls

12· ·failing.· I would say that in the initial

13· ·design there was reliance on a PKI that had

14· ·this expiration.

15· · · · · ·And so if Apple didn't do something

16· ·like issuing certificates, then calls would

17· ·fail.· But that's -- that's really standard in

18· ·the industry, because anytime you have

19· ·expirations, the idea is that you want to issue

20· ·new certificates or new keys in order to

21· ·continue using the system.

22· · · · · ·So it's not that uncommon to have

23· ·certificates that expire and then to renew them

24· ·before something goes wrong.

25

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 9 of 10
Page 212

·1· ·your question, so --

·2· · ·Q.· · Isn't the goal of adopting a policy

·3· ·which honors certificate expirations -- isn't

·4· ·the goal of adopting that policy to issue new

·5· ·certificates periodically or frequently?

·6· · ·A.· · I think I understand why I'm having

·7· ·confusion with your question.· The goal is to

·8· ·provide security.· So if you're going to issue

·9· ·certificates that have expirations, your goal

10· ·is security.

11· · · · · ·Now, how do you continue using a system

12· ·that requires you to have a valid certificate?

13· ·Well, one way is to renew the certificates

14· ·before they expire.

15· · ·Q.· · Bleeding over onto page 29, you discuss

16· ·a routine called

17· ·SecPolicyCreateiPhoneDeviceCertificate.

18· · · · · ·Do you see that?

19· · ·A.· · Yes.

20· · ·Q.· · What is

21· ·SecPolicyCreateiPhoneDeviceCertificate?

22· · ·A.· · That is a function that returns a trust

23· ·object for a policy.

24· · ·Q.· · And in paragraph 89 you call it a

25· ·custom policy.· Why is it a custom policy?

GRACE: AVIEL D. RUBIN - HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY

hglitigation.com

YVer1f

Case 5:17-cv-00551-LHK Document 285-28 Filed 10/18/18 Page 10 of 10