<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Ryan, you kind of skipped over a core rationale for this draft ballot – that it’s somehow too hard to audit DTPs (at least as to their domain validation activities). Why is
it too hard?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Here is what the Purpose section of the ballot says:<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-left:.5in"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Purpose of Ballot:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">At the moment, CAs are permitted to delegate the process of domain and IP address validation.
<b><u>However, permitting such delegations is problematic due to the way audits work - the auditing of such work may or may not be required and, if it is, those audit documents may not make it back to root programs for consideration</u></b>. Although the audit
situation also needs fixing, domain validation is an important enough component of a CA's core competencies that it seems wiser to remove it from the larger problem and forbid its delegation. The purpose of this ballot is to ensure that CAs or their Affiliates
are always the ones performing domain/IP address ownership validation for certificates that CA is responsible for.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Can you and/or Gerv explain why auditing of DTPs can’t be fixed?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Wednesday, April 26, 2017 3:39 PM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Cc:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
<b>Subject:</b> Re: [cabfpub] [EXTERNAL] Forbid DTPs from doing Domain/IP Ownership Validation ballot draft<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Apr 26, 2017 at 6:05 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Gerv, I’m late to the discussion on this. By can you start at the beginning, and explain why you believe DTPs should
not be permitted to perform domain validation under any circumstances?</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I support this approach, and believe domain validation is of critical security relevance that it is vital that the organization whose audits are being provided and examined do this correctly, and that the greatest risk to the ecosystem
has been caused by delegating this authority out.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This is clearly obvious not just in the Symantec case, but in the past decade of issues with RAs (which are what we informally tend to call DTPs).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I’m not speaking from an Entrust use case, but I can imagine there could be cases where the CA has no one on staff
who can read or interpret certain languages and alphabets (Russian Cyrillic, Greek, Arabic, Chinese, Japanese). They want to do a WhoIs lookup, but can’t read or interpret what they see. This could be a perfect situation for using a DTP for domain verification.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Or it would be indicative that using whois information in this manner wouldn't be adequate, and other, more suitable levels of validation can be used.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I appreciate and support the desire to provide a robust, global service. This can be met by hiring employees - and thus bearing the responsibility for their activities - or using automated methods of validation that provide greater assurance
than relying on humans, which, as we know, have human error.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Clearly the work of all DTPs should be audited, and the DTP part of the audit should roll up somehow into the issuing
CA’s audit. I know that can be complex (and under current rules, may be hard for browsers to monitor and feel confident they understand the ENTIRE network of DTPs, etc. used by the CA under each root). But it can be done.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On what basis do you believe that it can be done? From ample discussion and review of the literature, I assert it cannot be done to Google's satisfaction.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I’m not personally familiar with the current complexity of making sure all DTPs are covered by a CA’s audit. But
wouldn’t it make sense to spend time working on the audit completeness problem (which is important in any case) and not forbid use of DTPs for domain verification?</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I appreciate that you're not familiar with the current complexity, and thus may not understand the past year of efforts, even prior to the Symantec incident, to better understand the scope of audits and complexity. I'm sure you're at least
somewhat familiar, due to the discussions by our WebTrust TF members, of the even longer effort by the WebTrust TF.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I hope that the above message suitably demonstrates alternatives to the scenarios that you (although not Entrust, nor so far any other member) are concerned about, but I'm not sure if you appreciate the seriousness or gravity of the concerns
here. While I realize that may sound like "rushing to snap decision", this is actually something that we've been looking at closely for some time - again, even prior to the recent Symantec incident - and certainly, for Google, feel this is the only appropriate
way to reach the level of security.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Given that you're not aware of Entrust being concerned about this, and no other member has spoken up about this concern that you raise, do you feel there are other concerns, perhaps ones that Entrust would have the expertise and knowledge
as to the reasoning and challenges, that might be impacted by this? This would otherwise seem a simple and comprehensive fix for an immediate issue, while still allowing time to continue to determine whether there is a path to DTPs providing the necessary
level of assurance for the many, many concerns about validation. Or it may simply highlight why, if DTPs are necessary to include organizational information, that it might be that including organizational information is not possible with a meaningful, publicly-audited
level of assurance, and thus should not be used by browsers. <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>