<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.Default, li.Default, div.Default
{mso-style-name:Default;
margin:0in;
margin-bottom:.0001pt;
text-autospace:none;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
The Validation Working Group is trying to finish up the Ballot to change BR 3.2.2.4 on domain validation methods. We’ve been at this for over six months, and have previously presented you with the attached draft Ballot dated September 10, 2015. It is ready
to go, except we need to consider the comments of Richard Barnes of Mozilla and Peter Bowen of Amazon (attached, and shown below).<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<i>[As a separate matter, we delayed further work on this Ballot until early November to wait for any IP disclosures requested by the Patent Assessment Group (PAG) committee had been received. We will see what conclusions the PAG has drawn.]<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
It will be useful to receive comments and feedback from the Forum Members on this Thursday’s call. The Validation Working Group (VWG) can then discuss the comments next week, and try to finalize the Ballot.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
I am repeating the comments from both Richard and Peter here, with a little more context. Please be ready to comment on these four matters so we can complete this Ballot.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<u>Any other comments on the draft Ballot</u>?<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><u><span style="color:#002060">Richard Barnes Comments<o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<u><o:p><span style="text-decoration:none"> </span></o:p></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
In September, Richard made the two proposals shown below, and they were discussed in a VWG meeting. I remember there were criticisms of Richard’s proposals – but I don’t remember exactly what they were! (I think the objection to the proposed change in method
6 was allowing any “well-known” path chosen by the CA in addition to the “well-known/validation” directory in the current language – allowing the CA to choose a different past perhaps defeated the purpose of choosing a single path that website owners would
know about.) Richard was going to modify and resubmit his proposals, but he has not done so to date. (<u>Richard</u> – if possible,
<u>please resubmit before Thursday</u>.) Each proposal is keyed to a line or part in the attached pdf matrix of the ballot<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="Default" style="margin-left:.5in"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Proposal 1: In
<u>part L</u> <o:p></o:p></span></b></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">OLD: "by the Applicant requesting and then installing a Test Certificate issued by the CA"
<o:p></o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">NEW: "by the Applicant requesting and then installing a Test Certificate issued by the CA, or installing a Test Certificate containing a Random Value
or Request Token" <o:p></o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">9. Having the Applicant demonstrate control over the FQDN by the Applicant requesting and then installing a Test Certificate issued by the CA on the
FQDN </span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">or installing a Test Certificate containing a Random Value or Request Token</span></u></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">which is accessed and then validated via https by the CA over an Authorized Port.
<o:p></o:p></span></p>
<p class="Default" style="margin-left:1.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">This liberalization would cover the DVSNI proposal being considered in ACME, and seems to offer equivalent protection to the other option. (Either way
the cert contains something specified by the CA.) <o:p></o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Proposal 2: In
<u>part H</u> <o:p></o:p></span></b></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">OLD: "under "/.well-known/validation" directory on an Authorized Domain Name"
<o:p></o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">NEW: "under "/.well-known/validation" directory on an Authorized Domain Name, or any other path under .well-known registered by IANA for this purpose"
<o:p></o:p></span></p>
<p class="Default" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">6. Having the Applicant demonstrate control over the requested FQDN by installing a Random Value (contained in the name of the file, the content of
a file, on a web page in the form of a meta tag, or any other format as determined by the CA) under "/.well-known/validation" directory on an Authorized Domain Name</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">,
</span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">or any other path under .well-known registered by IANA for this purpose</span></u></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">that can be validated over an Authorized Port; or
<o:p></o:p></span></p>
<p class="Default" style="margin-left:1.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
For automated systems like ACME, they're going to want a much more precise definition of the validation process than what's in this document, and they may want to use different .well-known paths to indicate different methods that are all compliant with this
section. Requiring the IANA registration allows these differences to exist, but in a controlled way.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><u><span style="color:#002060">Peter Bowen Comments</span></u></b><span style="color:#002060">
</span>(Peter did not submit specific new language)<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><o:p> </o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b>Proposal 3: In <u>part J</u> <o:p></o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b><o:p> </o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
In Item J, it suggests that the random token is only valid for a FQDN validation. I think DNS validation should be allowed for domain hierarchies in addition to specific FQDNs. A domain registrant should be able to choose to approve all FQDNs under
<a href="http://corp.example.com">corp.example.com</a> by adding a record for <a href="http://corp.example.com">
corp.example.com</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b><o:p> </o:p></b></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">[Current Ballot language]
<o:p></o:p></span></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">7. Having the Applicant demonstrate control over the requested FQDN by the Applicant making a change to information in a DNS record for an Authorization
Domain Name where the change is to insert a Random Value or Request Token; or <o:p>
</o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b><o:p> </o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b><o:p> </o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<b>Proposal 4: In <u>part K</u> <o:p></o:p></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
Conversely, in item K, using Authorization Domain seems inappropriate. Just because I control the IP address of
<a href="http://corp.example.com">corp.example.com</a> doesn't mean I have control
<a href="http://payments.corp.example.com">payments.corp.example.com</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">[Current Ballot language]<o:p></o:p></span></p>
<p class="Default" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">8. Having the Applicant demonstrate control over the requested FQDN by the CA confirming that the Applicant controls an IP address returned from a DNS
lookup for A or AAAA records for the Authorization Domain Name in accordance with section 3.2.2.5; or
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<o:p> </o:p></p>
<p class="MsoNormal">Let’s be ready to discuss on Thursday’s call.<o:p></o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>