<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:123086276;
mso-list-type:hybrid;
mso-list-template-ids:-1082122606 -1232835204 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
color:#1F497D;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:2013487485;
mso-list-type:hybrid;
mso-list-template-ids:445818742 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2
{mso-list-id:2129470907;
mso-list-type:hybrid;
mso-list-template-ids:-228527086 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l2:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Cambria","serif"'>Hi everyone, <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>Ballot 92 addresses the concerns listed below. These issues have been discussed since at least February of 2012 through various email exchanges. Kirk Hall asked for a summary explanation of why we consider these changes necessary. This summary is intended only to explain the purpose of the ballot and is not intended to modify the ballot in any manner. <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-family:"Cambria","serif"'>Section 9.2.1 - Subject Information<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>Section 9.2.1was modified to require subject information in a certificate containing multiple root domain names. DV certs are still permitted if the certificate will contain multiple subdomains off the same root domain. Subject information is also required for certificates that contain a reserved server name or IP address. <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>This change is necessary because, i</span><span style='font-family:"Cambria","serif"'>n certain cases, certificates with multiple domains (SANs) owned by unrelated parties present security problems when no identifying information has been obtained. Take for instance a DV certificate with multiple SANs as follows: <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>OBJECT IDENTIFIER : subjectAltName [2.5.29.17]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'xyx.whoami.com'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'www.microswift.com' <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'xyz'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'students.fullerton.edu'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'www.paypal.local'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : '10.0.0.101'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'shareholder.gecapital.com'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'amazon.ez-seller.com'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'www.google.dom' <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'fasthost.com'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'authentic.bad-girl.com'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>CONTEXT SPECIFIC (2) : 'score.nuthinbut.net'<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>It’s hard to tell who the responsible party is. (By way of analogy, under traditional limited partnership law, there is always at least one General Partner when the rest of the partners are Limited Partners.) <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>So even assuming that we’re sunsetting certificates with private IP addresses or internal server names, there has never been a decision to not make other related improvements to the security of certificates where necessary. Certain information should be prohibited in the CN field and that certificates containing internal server names should have additional restrictions, and possibly full Organizational Vetting (regardless of whether such information is contained in the certificate) for the following reasons: <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>Prior to v1.0 of the baseline requirements, the CN field could contain information other than an FQDN, but allowing a private IP or non-FQDN might result in an incorrect interpretation of the information in this field and create a potential attack. The CN field’s multi-purpose use is one of the reasons the field was deprecated, and the Forum shouldn’t permit uses of this field that resemble an organization name instead of an FQDN.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>A certificate with a non-FQDN or private IP address is essentially non-verified if the certificate lacks organization details. Providing a certificate without verified information might enable an attacker to perform a MITM attack. Conversely, if a verified O field were included, that would provide a way to distinguish between various mail.server certificates held by different organizations. <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>As illustrated above, a certificates containing multiple registered domains must be tied to at least one specified entity. Including multiple unrelated domains in a single certificate just amplifies the potential damage caused by a single mis-issued certificate. Multiple domains are now a central part of virtualization, and certificates with multiple domain names should be additionally protected. Requiring the listing of an organization in certificates with multiple root domains ties the certificate to a verified owner, which is a protection against fraud. Requiring OV (for at least one entity) helps monitor and/or communicate with all of the other entities receiving and using such certificates. A certificate with a lot of high profile domains is worrisome if contextual organizational contact information is missing. When that information is absent, then relying parties are at the mercy of the issuing CA, who may be unwilling to share that contact information because the relying party is not “the customer” in the minds of some CAs. <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-family:"Cambria","serif"'>Section 9.2.2 - Internal Server Name Use<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>Under v1.0, section 9.2.2 of the baseline requirements permitted an internal server name or reserved IP address within the CN field of a certificate. The change prohibits this practice in an attempt to ensure that each certificate is associated with an identifiable entity. A certificate containing only a single internal server name could be used to MITM anyone else with the same single internal server name.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-family:"Cambria","serif"'>Section 9.2.7 – Internationalized Names<o:p></o:p></span></b></p><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>The changes in section 9.2.7 restrict use of mixed characters and certain confusing characters in certificates to prevent confusable domains. Allowing internationalized domain names can lead to the inclusion of visually similar (so-called "confusable") characters in certificates. Restricting this practice will prevent phishing attacks on domains using certificates with characters that may be poorly interpreted by a browser.<o:p></o:p></span></pre><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-family:"Cambria","serif"'>Section 10.3 – Information Requirements<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>This change is to clarify that at least one subjectAltName extension entry is required. CN was deprecated in v1.0. This change furthers the deprecation by shifting domain name entries into the subjectAltName extension.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-family:"Cambria","serif"'>Section 11.1.3 – Wildcard Validation<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'>The current requirements permit an essentially unrestricted use of the wildcard character in a domain name. The argument against unrestricted wildcard characters is set forth in RFC6125:<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>“Wildcard certificates automatically vouch for any and all host names within their domain. This can be convenient for administrators but also poses the risk of vouching for rogue or buggy hosts…<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> o Specifications for existing application technologies are not clear<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> or consistent about the allowable location of the wildcard<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> character, such as whether it can be:<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * only the complete left-most label (e.g., *.example.com)<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * some fragment of the left-most label (e.g., fo*.example.com,<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> f*o.example.com, or *oo.example.com)<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * all or part of a label other than the left-most label (e.g.,<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> www.*.example.com or www.foo*.example.com)<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * all or part of a label that identifies a so-called "public<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> suffix" (e.g., *.co.uk or *.com)<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * included more than once in a given label (e.g.,<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> f*b*r.example.com<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> * included as all or part of more than one label (e.g.,<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'> *.*.example.com)<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>These ambiguities might introduce exploitable differences in identity checking behavior among client implementations and necessitate overly complex and inefficient identity checking algorithms.”<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>By requiring wildcard characters in only the complete left-most label, the forum’s practices will conform to the various RFCs already created and prevent a possible attack.<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><b><span style='font-size:11.0pt;font-family:"Cambria","serif"'>Section 11.1.4 – New gTLD Domains<o:p></o:p></span></b></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>ICANN will begin the process of issuing new generic Top Level Domains (gTLDs) beginning in 2012, therefore certain Certificates for non-public names will need to be revoked on an accelerated schedule. A failure to revoke certificates issued to internal server name containing the new gTLDs will result in collisions throughout the Internet and mis-represent the actual owner of the (now) publicly registered domain. As Brad Hill said “If customers feel there is a property right relative to the name that has been infringed, they need to take that up with ICANN, not the CA. There is a dispute process in place for this kind of issue. CAs issuing publicly trusted certificates with a DNS-ID type have an obligation to conform to the public registration of names, not to second-guess the registries. (as was so often pointed out with regard to my suggestions on IDNA restrictions)”<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>Please, don’t hesitate to ask any additional questions about the ballot or proposed changes. I will respond as soon as I am able.<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'><o:p> </o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>Thanks,<o:p></o:p></span></pre><pre style='page-break-before:always'><span style='font-size:11.0pt;font-family:"Cambria","serif"'>Jeremy<o:p></o:p></span></pre><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p></div></body></html>