<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">A couple of responses.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">1. It appears from various comments over time that your biggest concern about re-use of prior validation data relates to method 3.2.2.4.6 – Agreed
Upon Change to Website. Old method 6 required “</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page
identified by a uniform resource identifier containing the FQDN”</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">New method 6 requires specified content be posted to a
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">"/.well‐known/pki‐validation" directory, which no CA has ever done (because this path is brand new, and created for the updated version of this validation method). So prohibiting reuse
of data collected under old method 6 will necessarily require revalidation of ALL domains ever validated under old method 6. As I indicated on the CABF teleconference yesterday, this will require some CAs (including Entrust) to manually review EVERY domain
validation we have done to determine which used old method 6, versus other approved methods. This would be a massive undertaking, and something CAs won’t want to do unless there is a demonstrated security need.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Can you share with us the facts, data, evidence, etc. that leads you to believe that the domain validations previously done under old method 6 pose a significant security threat
to users? Any statistics to back this up? I’m not challenging you, I’m just asking you for data that supports what you want us to do. We are not aware of any instance where we used old method 6 and later discovered that the domain should not have been authorized
for the customer.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">At one time, I think you expressed concern that old method 6 was being used by customers of the Google cloud to get certs for their assigned FQDN (by making the agreed-upon
change to that assigned FQDN, even though apparently Google had prohibited customers for getting certs for their FQDN in the Google cloud). Originally you called this an example of certificate “mis-issuance,” but later you changed the tag to “unauthorized”,
presumably because the Google subscription agreement prohibits this for its subscribers. Is that the chief basis for your concern about old method 6?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Any hard information you can share (including information about the use cases and numbers of old method 6 certificates that concern you) will help us evaluate the nature of
any security risk that is posed by re-using old method 6 validation data for the period currently permitted by the BRs. If it relates to unauthorized certs issued for space in the Google cloud, an alternative would be to compile a list of all those issues
certificates and ask each issuing CA to revoke – that might be possible under the current BRs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">2. On the idea of marker of some sort in new certs indicating whether or not a newly-issued cert had been validated (or revalidated) in accordance with the methods in Ballot
190 – how do you see users actually using this information? Wouldn’t they have to click 5 or 6 times in the developer’s version of Chrome to see the marker? Do you truly think they will be interested in this discussion? Or would Chrome instead use such
a marker to put up security warnings for any new cert that lacked the marker?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">What would happen if we later make a further change to the validation methods (I think Gerv gave the hypothetical that we might change new method 6 to say subfile instead of
file, etc.). Would all method 6 domains immediately have to be revetted to match the new requirement? Would we have to insert another marker, this time saying “this cert has been validated to the new methods of Ballot 215 instead of re-using prior validation
data”, for example?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Friday, April 28, 2017 6:09 AM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Wayne Thayer <wthayer@godaddy.com><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, Apr 28, 2017 at 1:32 AM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">One other comment. Remember that for the last few months, new Methods 1-4 and 7-10 were actually included
under Method 11 “any other method” after Ballot 181’s effective date, and that situation will continue until the effective date of Ballot 190. Also, the same is true for any validations that followed old Method 7 “any other method” prior to the effective
date of Ballot 169. So be very careful in saying anything in Ballot 190 that would invalidate validations done prior to Ballot 190 under “any other method” so long as they complied with any of Methods 1-10 of the new methods or Methods 1-6 of the old methods.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I would be open to saying that any prior vetting done under old Method 7 or more recent Method 11 “any
other method” must be revalidated upon the effective date of Ballot 190 IF they did not follow EITHER Methods 1-6 (as the existed before Ballot 169) or Methods 1-10 (as put forward in Ballot 169). In other words, the ONLY validations that have to be redone
before the expiration of the re-use period are validations that were done that did not comply with either old Methods 1-6 or new Methods 1-10. That should flush out any unknown and unsecure validations that occurred in the past.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Not quite, because if you recall, Google's interest in reforming these began with the fact that a website demonstration of control was not secure. That is, 3.2.2.4.6 under pre-169 is not acceptable.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kirk, given your support for other forms of indicating that a CA has performed extra diligence, such as the inclusion of OV certificates, would you be supportive in general of a means of expressing, within a certificate, conformance with
the 'new' validation methods, so that subscribers can have assurances of the security? <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>