<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Your analysis below is not correct. The “law” in the CA/Browser Forum is what is approved by the members in a Ballot (all of it – in Ballot 190, that includes both Section
1 and Section 2 – both sections have equal validity and applicability because both were adopted by the members at the same time.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">In contrast, the BRs are just a compilation of those portions of prior adopted Ballots that have long-term applicability to members. It’s a mistake to junk up the BRs with
lots of effective dates and transition rule that will expire, and it’s unnecessary. Again, the adopted ballots of the Forum are the “law” – all sections of the ballots equally – and not the BR compilations themselves. I think Google’s Legal Department will
agree. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">See the following concerning codification of US laws:
<a href="https://en.wikipedia.org/wiki/United_States_Statutes_at_Large">https://en.wikipedia.org/wiki/United_States_Statutes_at_Large</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:6.0pt;margin-right:0in;margin-bottom:6.0pt;margin-left:.5in;background:white">
<b><span style="font-size:11.0pt;color:#222222">*** Codification<o:p></o:p></span></b></p>
<p style="mso-margin-top-alt:6.0pt;margin-right:0in;margin-bottom:6.0pt;margin-left:.5in;background:white">
<span style="font-size:11.0pt;color:#222222">Today, large portions of slip laws [for the Forum, our Ballots once they have been approved by the members] denominated as public laws are now drafted as amendments to the<span class="apple-converted-space"> </span></span><span style="font-size:11.0pt">United
States Code [for the Forum, the BRs and EVGL]<span style="color:#222222">. Once enacted into law, an Act will be published in the<span class="apple-converted-space"> </span><i>Statutes at Large</i><span class="apple-converted-space"> [for the Forum, an updated
version of the BRs or EVGL will be published] </span>and will add to, modify, or delete some part of the United States Code [the BRs or EVGL].
<b><u>Provisions of a public law [Ballot] that contains only enacting clauses, effective dates, and similar matters are not generally<span class="apple-converted-space"> </span></u></b></span><b><u>codified</u></b> [i.e., those portions of a Forum Ballot such
as Ballot 190, Section 2, would not be included in the BRs, but would still be valid and controlling].
<span style="color:#222222">***</span></span><span style="font-size:10.5pt;color:#222222"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We could put ballot transition rules in BRs themselves (for Ballot 190, move from Section 2 to Section 1 and make part of BR 3.2.2.4), but I would rather not – then the transition
rules are no longer relevant (because they are time-based and will expire), they have to be pulled out again by a later ballot – not useful. The transition rules will exist in Section 2 of the adopted Ballot 190 itself, and that is sufficient.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Another option is to add transition rules like Ballot 190, Section 2 to the BRs as “Notes” to BR 3.2.2.4 that are not part of BR 3.2.2.4, and that can later be removed by the
BRs compiler without a further ballot once the transition rules are no longer relevant (because all validation data from before the effective date of Ballot 190 will have expired). That’s what some legislatures do, and I wouldn’t object to that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Ryan Sleevi via Public<br>
<b>Sent:</b> Thursday, April 13, 2017 10:02 AM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Cc:</b> Ryan Sleevi <sleevi@google.com><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190: Domain Validation<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Apr 11, 2017 at 4:46 PM, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><u>Ballot Section 2</u></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This provisions of Ballot Section 1 will apply only to the validation of domain names occurring after this Ballot 190’s effective date. Validation of domain names that occurs before
this Ballot’s effective date and the resulting validation data may continue to be used for the periods specified in BR 4.2.1 and EVGL 11.14.3 so long as the validations were conducted in compliance with the BR Section 3.2.2.4 validation methods in effect at
the time of each validation.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As mentioned on today's call, this clause is not compatible with / creates a conflict with the Baseline Requirements.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Section 4.2.1 governs the reuse of previously obtained documents or data, but Section 3.2 explicitly requires that CAs validate and verify every certificate during issuance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The clear intent from Section 2, as worded, is to extend this to allow CAs to not even verify the domains at the time of issuance. While understandable as to the goal, it's highly undesirable.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you want to accomplish this, however, you would need to update Section 4.2.1 to specify how that process works. Otherwise, Section 4.2.1 will govern, and Section 2 of this ballot will have no effect due to its ambiguity and lack of modification
to the document.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I want to echo a strong opposition towards allowing the reuse of data or documents obtained under previous versions of the Baseline Requirements, much as in the discussion of Ballot 194. We are aware of multiple CAs who have relied on insecure
methods here, and the idea that this information would be appropriate to continue issuing certificates for the next three years is an unacceptable security risk. We raised this issue to the Forum nearly three years ago at this point, and continuing for three
more years is not good.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I encourage CAs to thoughtfully examine and articulate why they believe a phase-in is needed, on a per-section basis, so as to help better understand the impact relative to the security risk being introduced, and would encourage the ballot
authors and co-sponsors to update Section 2 to actually update the Baseline Requirements, if that is the goal. <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>