<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">>Hi Rob!<o:p></o:p></p>
<p class="MsoNormal"><br>
>Welcome to the community, we’re glad to have you!<br>
<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Thank you for the kind words. The level of experience and expertise in this WG is daunting and for the most part I’ll stick to reading along with the odd question here or there.<br>
<br>
Without getting too specific, we’re working through the steps of building several “Trust Services” in a lab environment (Baremetal) that don’t reinvent the wheel, honor and most importantly conform to prior art and best current practices.
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
Obviously, strictly adhering to the CABForum’s Baseline requirements is a critical requirement here.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
The use cases and scenarios we’re looking at aren’t “mainstream”, so may be entirely out of scope for this discussion, but then again maybe not.<o:p></o:p></p>
<p class="MsoNormal"><br>
<br>
>Can you offer more detail on: <br>
>- How specifically will the proposed changes weaken security?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Delivering Objective 1 will mitigate several significant threats to relying parties and it’s clear the consensus is that it should be enacted ASAP.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
<br>
We do have some questions around the wording and the goals of Objective 2<br>
<br>
Some were addressed by prior clarifications, but the wording appears to sunset 3.2.2.4.2 and 3.2.2.4.15 entirely next summer (vs prohibiting the contact information coming from WHOIS at a higher level in the basic requirements as a “Pending Prohibition”).<br>
<br>
If 3.2.2.4.2 and 3.2.2.4.15 are entirely deprecated – Doesn’t that all but eliminate “out of band” verification using data from “Reliable Data Sources” sources via “Reliable Methods of Communication” or even using “DNS SOA” as currently defined in “Domain
Contact”? <br>
<br>
I suspect we’re misreading the requirements, but clarification is very much appreciated if we are.<br>
<br>
<br>
Also, regardless of “WHOIS”, if a registrar doesn’t have, or publish accurate data, or is potentially not permitted to release it to a CA (eg Certain jurisdictions with strong Privacy Regulations or other legal obligations) or for that matter and equally valid
reasons certain domain owners are publicly tight lipped and don’t publish contact information via CAA tags what would be the process?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">This next scenario is almost certainly out of scope, but it’s not unheard of for mid-large publicly listed companies to have poor oversight of shared / “special” mailboxes and mediocre OPSEC.
<br>
<br>
This lends support to deprecating email as a method, if said email was sent via “Trustworthy Email” would that be acceptable?<br>
<br>
EG Email compliant with NIST 800-177 or using something like the EU’s PEC mitigates a substantial amount of risk, or is the risk being mitigated something else?<br>
<br>
It appears that as it stands, prohibiting “email” entirely would prohibit these too without further clarification – an attempt to say they’re not “Email” in the conventional sense appears run afoul of the prohibition in 3.2.2.4.11<br>
<br>
However In cases where there is doubt that a request is made with appropriate authority, using a “well known” fax or postal address (ideally via certified/registered service) feels a viable alternate path to verifying the Applicant’s control is legitimate.
<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
Finally, does the proposed prohibition on using information obtained from HTTPS websites mean the use of ANY site that is accessed via HTTPS or are we again over-reading this?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">>- What precisely is the exception that should be considered?<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Instead of sunsetting 3.2.2.4.2 and 3.2.2.4.15 entirely, which appears to prevent compliance if these methods are used in Sensitive / High Risk Certificate requests we suggest changing the language to recommend
these methods SHOULD NOT be used. <br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">This leaves the door open for compliance using these methods, but responsibility for using them rests with the CA and must be justified.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">>- What are you referring to by the phrase “extended validation?"
<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">See above, that was a poor choice of words on my part. Apologies.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">>- How do the proposed changes impact “extended validation?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><br>
Likewise.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><br>
Many thanks again & kind regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Rob<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>