<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Kirk,</div><div class=""><br class=""></div><div class="">I’m very hesitant to call anything “misissuance” based on the old methods as the CA followed the rules.</div><div class=""><br class=""></div><div class="">I am reasonably sure that the following certificates were issued using either “any other” or an agreed upon change to website method:</div><div class=""><br class=""></div><div class=""><a href="https://crt.sh/?id=106122476" class="">https://crt.sh/?id=106122476</a></div><div class=""><a href="https://crt.sh/?id=18752248" class="">https://crt.sh/?id=18752248</a></div><div class=""><a href="https://crt.sh/?id=128494659" class="">https://crt.sh/?id=128494659</a></div><div class=""><a href="https://crt.sh/?id=91029499" class="">https://crt.sh/?id=91029499</a></div><div class=""><a href="https://crt.sh/?id=17296948" class="">https://crt.sh/?id=17296948</a></div><div class=""><a href="https://crt.sh/?id=81977675" class="">https://crt.sh/?id=81977675</a></div><div class=""><br class=""></div><div class="">I’m not suggesting these are mis-issued, but I have a rather high confidence that they do not represent what I would call “best practices”.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Peter</div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 28, 2017, at 9:37 AM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" class="">Kirk.Hall@entrustdatacard.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Yes, that’s good information on possible exploits - thanks. That’s why we worked so long on improving BR 3.2.2.4 – as you may recall, I was deeply involved in that, and very supportive.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">But I’d really like to know if there is evidence that cert “misissuance” occurred in the past because of these potential vulnerabilities. Do you know if there is any data on that? I think we would need more than one or two anecdotal (and maybe unconfirmable) stories to justify revetting of all outstanding domains by all CAs. The improvements will be implemented over time, on a going-forward basis.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">As Gerv said, there will be significant reluctance to change / improve validation methods in the future if it always requires massive revalidation of all existing domains, without a showing of actual past abuses and related security concerns.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Peter Bowen [<a href="mailto:pzb@amzn.com" style="color: purple; text-decoration: underline;" class="">mailto:pzb@amzn.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Friday, April 28, 2017 9:31 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" style="color: purple; text-decoration: underline;" class="">Kirk.Hall@entrustdatacard.com</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[EXTERNAL]Re: [cabfpub] Ballot 190<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Apr 28, 2017, at 9:06 AM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>> wrote:<o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">1. It appears from various comments over time that your biggest concern about re-use of prior validation data relates to method 3.2.2.4.6 – Agreed Upon Change to Website. Old method 6 required “Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page identified by a uniform resource identifier containing the FQDN”</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">New method 6 requires specified content be posted to a<span class="apple-converted-space"> </span>"/.well‐known/pki‐validation" directory, which no CA has ever done (because this path is brand new, and created for the updated version of this validation method). So prohibiting reuse of data collected under old method 6 will necessarily require revalidation of ALL domains ever validated under old method 6. As I indicated on the CABF teleconference yesterday, this will require some CAs (including Entrust) to manually review EVERY domain validation we have done to determine which used old method 6, versus other approved methods. This would be a massive undertaking, and something CAs won’t want to do unless there is a demonstrated security need.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Can you share with us the facts, data, evidence, etc. that leads you to believe that the domain validations previously done under old method 6 pose a significant security threat to users? Any statistics to back this up? I’m not challenging you, I’m just asking you for data that supports what you want us to do. We are not aware of any instance where we used old method 6 and later discovered that the domain should not have been authorized for the customer.</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Kirk,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I did some research on this back when we were working on ballot 169. See <a href="https://cabforum.org/pipermail/public/2016-April/007504.html" style="color: purple; text-decoration: underline;" class="">https://cabforum.org/pipermail/public/2016-April/007504.html</a> and <a href="https://cabforum.org/pipermail/public/2016-April/007506.html" style="color: purple; text-decoration: underline;" class="">https://cabforum.org/pipermail/public/2016-April/007506.html</a><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We know that all the following were valid under the old method 6:<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">- Allowing the certificate requester to specify the URI. For example, if the certificate wanted<span class="Apple-converted-space"> </span><a href="http://shop.example.com/" style="color: purple; text-decoration: underline;" class="">shop.example.com</a>, the requester could say “check at<span class="Apple-converted-space"> </span><a href="http://shop.example.com/tmp/uploads/foo.txt" style="color: purple; text-decoration: underline;" class="">http://shop.example.com/tmp/uploads/foo.txt</a>” for the agreed upon change<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">- Looking for the change anywhere in the page. The CA would give the requester a token to put on the website and then look for it to appear somewhere on the page. This is a huge problem for sites that have public comments, message boards, or user-editable content. For example, validate “control” of<span class="Apple-converted-space"> </span><a href="http://www.ibm.com/" style="color: purple; text-decoration: underline;" class="">www.ibm.com</a> by posting a message containing the token at <a href="https://www.ibm.com/developerworks/community/forums/html/public" style="color: purple; text-decoration: underline;" class="">https://www.ibm.com/developerworks/community/forums/html/public</a><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">- Simply looking for the existence of a file by name. For example telling the customer to create<a href="http://<fqdn>/adfa24r43aefwaer2442.txt" style="color: purple; text-decoration: underline;" class="">http://<FQDN>/adfa24r43aefwaer2442.txt</a><span class="Apple-converted-space"> </span>and not caring about the content.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">- Looking for a content to be returned from the server that was included in the URL and not checking the HTTP return code.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I would also note that other “old” methods have similar issues. For example, there was no requirement that email validation used a unique token per request. It would have been valid to send an email saying “Does this email work?” to the domain owner and using an out-of-office auto-reply as proof of “communication”, as the requirement was only “Communicating with” the email address.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Does that help explain the concern?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Thanks,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Peter<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> Ryan Sleevi [<a href="mailto:sleevi@google.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mailto:sleevi@google.com</span></a>] </span><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""></o:p></span></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Sent:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Friday, April 28, 2017 6:09 AM<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Kirk.Hall@entrustdatacard.com</span></a>><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">public@cabforum.org</span></a>>; Wayne Thayer <<a href="mailto:wthayer@godaddy.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">wthayer@godaddy.com</span></a>><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>[EXTERNAL]Re: [cabfpub] Ballot 190</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Fri, Apr 28, 2017 at 1:32 AM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Kirk.Hall@entrustdatacard.com</span></a>> wrote:<o:p class=""></o:p></div></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">One other comment. Remember that for the last few months, new Methods 1-4 and 7-10 were actually included under Method 11 “any other method” after Ballot 181’s effective date, and that situation will continue until the effective date of Ballot 190. Also, the same is true for any validations that followed old Method 7 “any other method” prior to the effective date of Ballot 169. So be very careful in saying anything in Ballot 190 that would invalidate validations done prior to Ballot 190 under “any other method” so long as they complied with any of Methods 1-10 of the new methods or Methods 1-6 of the old methods.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I would be open to saying that any prior vetting done under old Method 7 or more recent Method 11 “any other method” must be revalidated upon the effective date of Ballot 190 IF they did not follow EITHER Methods 1-6 (as the existed before Ballot 169) or Methods 1-10 (as put forward in Ballot 169). In other words, the ONLY validations that have to be redone before the expiration of the re-use period are validations that were done that did not comply with either old Methods 1-6 or new Methods 1-10. That should flush out any unknown and unsecure validations that occurred in the past.</span><o:p class=""></o:p></div></div></div></div></blockquote><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Not quite, because if you recall, Google's interest in reforming these began with the fact that a website demonstration of control was not secure. That is, 3.2.2.4.6 under pre-169 is not acceptable.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Kirk, given your support for other forms of indicating that a CA has performed extra diligence, such as the inclusion of OV certificates, would you be supportive in general of a means of expressing, within a certificate, conformance with the 'new' validation methods, so that subscribers can have assurances of the security? <o:p class=""></o:p></div></div></div></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">_______________________________________________<br class="">Public mailing list<br class=""></span><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">Public@cabforum.org</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""></span><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">https://cabforum.org/mailman/listinfo/public</span></a></div></blockquote></div></div></div></blockquote></div><br class=""></body></html>