<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Being overly generic allows methods whose security implications have not been analyzed, and may not be correct. We keep running into cases where validation works by accident, for example by a value being reflected in a 404 error message,
a email scanner following an embedded link, etc.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The trend has been to be more explicit about exactly how validation methods work, for example requiring files to be in a specific location under .well-known, instead of anywhere, and I think this is a good thing.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think it would be better to call out WHOIS and RDAP as acceptable, and even call out one or more fields (for RDAP) which should be used for this purpose.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Public [mailto:public-bounces@cabforum.org] <b>
On Behalf Of </b>Peter Bowen via Public<br>
<b>Sent:</b> Tuesday, October 24, 2017 10:07 PM<br>
<b>To:</b> Geoff Keating <geoffk@apple.com><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Subject:</b> Re: [cabfpub] New validation method<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Oct 24, 2017, at 3:46 PM, Geoff Keating <<a href="mailto:geoffk@apple.com">geoffk@apple.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">On 24 Oct 2017, at 2:58 pm, Peter Bowen via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<br>
<br>
As ballot 190 is complete and fully effective, it seems like a reasonable time to start considering further validation method. Amazon proposes the following new method. As far as I know, this does not overlap with any of the existing methods.<br>
<br>
3.2.2.4.12 Registrar challenge validation<br>
Confirming the Applicant’s control over the request Domain Name by confirming the presence of a Random Value or Request Token in a response from the Domain Name Registrar or Registry received in response to a request containing an Authorization Domain Name.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
I like the concept, but can we be a bit more specific than just ‘in response to a request’? For example, can we say ‘in response to a WHOIS request for the Authorization Domain Name’?<o:p></o:p></p>
</div>
</div>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I was trying to stay fairly generic because some registries, such as Núcleo de Informação e Coordenação do Ponto BR, CZ.NIC, z. s. p. o., and Dirección Nacional del Registro de Dominios de Internet, the registries for .br, .cz, and .ar,
are using RDAP now (see <a href="https://scanmail.trustwave.com/?c=4062&d=hfHv2ejcp8PsaiAk9PrsR3ttPMTnWnAYRNmWlcOp9g&s=5&u=https%3a%2f%2fdata%2eiana%2eorg%2frdap%2fdns%2ejson">https://data.iana.org/rdap/dns.json</a> for the current list). Additionally, as
you may be aware some registries do not have RDAP or Whois servers, so one could imagine that some registries might even be open to implementing an API that could be used for validation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Peter<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>