<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Richard,<br>
<br>
You provide a helpful overview, and this list was only <br>
intended as a place to start. If there is interest, it should<br>
be moved to an appropriate sub-list/group.<br>
<br>
EVs in their present form are indeed not appropriate.<br>
However, with modifications, the specification could<br>
serve that purpose. The present stir certificate Internet <br>
Draft is in a rather woeful state, and if nothing else, borrowing<br>
entire sections from the EV specification would improve<br>
the draft.<br>
<br>
As you note, the deployment model is controlling. We're<br>
dealing here with the original most regulated domain name<br>
system in telecommunications - the E.164 global numbering<br>
domain hierarchy. How one binds certificates to those domains<br>
worldwide is a major TBD.<br>
<br>
--tony<br>
<br>
<div class="moz-cite-prefix">On 2016-08-28 7:05 PM, Richard Barnes
wrote:<br>
</div>
<blockquote
cite="mid:CAOAcki9Eju3ppSmOeC=E8RjNzPDe06WUAinXSprYhqrfEggg7g@mail.gmail.com"
type="cite">
<div>To Tony's question, "Why not EV?", the answer is simple: EV
doesn't make the attestation that STIR needs. It might be
useful in combination with some other technology, but it is not
a solution itself.<br>
</div>
<div><br>
</div>
Now as to how this relates to CABF, a lot of it depends on the
model in which STIR is deployed. In the "authoritative" model,
where the holders of blocks of TNs are the CAs, there is probably
not a need for anything like the BRs. The RPKI, which follows
this model for IP addresses, has gotten along fine without such
rules. In the "EV" model, where TNs are only authenticated
indirectly, STIR actors can just use normal EV certs.<br>
<br>
<div>The only scenario where I see a need arising for some sort of
CABF work is if we end up in a situation like the web, where
third-party, non-authoritative CAs are attesting to possession
of TNs (as is done with domain names today). If this situation
arises and there is a need for some BR-like rules in this space,
then we will need to address many of the same governance
questions as with code signing, email, etc. -- who are the right
CAs and relying parties to have collaborate on these new rules.
In any case, my personal read of the situation right now is that
this is the least preferred scenario among the various parties
currently involved.<br>
<br>
</div>
</blockquote>
<br>
</body>
</html>