<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thanks Fotis; we’ll continue this discussion in our scheduled meeting this week.<o:p></o:p></p>
<p class="MsoNormal">Agenda to follow shortly.<o:p></o:p></p>
<p class="MsoNormal">Regards, Stephen<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Fotis Loukos via Smcwg-public<br>
<b>Sent:</b> Sunday, January 30, 2022 6:57 AM<br>
<b>To:</b> SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> [Smcwg-public] Proposed validation reuse periods based on validated entity.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hello everyone,<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
I have just submitted a pull request for some language on the validation reuse period. I would like to provide an analysis and a rationale for the current suggestions.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
First and foremost, I believe that we should make this decision based on the security properties of the entity we are validating. The limit on the validation reuse is a control to mitigate the risk of the Subscriber losing operation/control of the validated
entity, and therefore I believe that the properties of the control should be based on the risk introduced which is related to the security properties of the entity.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Currently, we are using two different principles for validating control of an email address:<br>
* Validating control of the respective mail server, either by validating control of the MX record in 3.2.2.1 or validating control of the server itself in the proposed 3.2.2.3 method; and<br>
* Validating the mailbox in 3.2.2.2.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Since one of the major factors for deciding the validation reuse times is the frequency that these entities change, I believe that a small analysis would be helpful.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
In the first case, we are effectively validating the operation/control of an FQDN or a DNS record. We already have insights on this, and section 4.2.1 of the WebPKI BRs mandates that validations must be obtained no more than 398 days prior to issuing the certificate.
Therefore, I believe that the same should apply to methods 3.2.2.1 and proposed method 3.2.2.3. I believe that this is also aligned with the business practices of many CAs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
In the second case, things are more complicated. I haven't managed to find any exact data, but a research by the DMA shows that in 2015, 3% of the users kept their email address for 0-11 months and 7% for 1-2 years (<a href="https://www.zettasphere.com/how-many-email-addresses-people-typically-use/">https://www.zettasphere.com/how-many-email-addresses-people-typically-use/</a>).
Although these stats may have changed now, I believe that there is a consensus that email addresses change more frequently than SMTP servers, especially with cases such as business emails or emails by ISPs. Therefore, my recommendation is a 30 day validation
reuse period for mailbox validation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
The pull request can be found at <a href="https://github.com/cabforum/smime/pull/35">
https://github.com/cabforum/smime/pull/35</a>. Any comments are highly appreciated.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Fotis<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td nowrap="" style="border:none;border-top:solid #D50F25 1.5pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#555555">Fotis Loukos |<o:p></o:p></span></p>
</td>
<td nowrap="" style="border:none;border-top:solid #3369E8 1.5pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#555555"> Security Engineer |<o:p></o:p></span></p>
</td>
<td nowrap="" style="border:none;border-top:solid #009939 1.5pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#555555"> <a href="mailto:fotisl@google.com" target="_blank">fotisl@google.com</a> |<o:p></o:p></span></p>
</td>
<td nowrap="" style="border:none;border-top:solid #EEB211 1.5pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#555555"> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<div>
<p class="MsoNormal">Brandschenkestrasse 110, 8002 Zurich, Switzerland<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Company Identifikationsnummer: CH-020.4.028.116-1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This email can contain confidential information.If you received this email by mistake,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">do not pass it to third parties and delete all copies and enclosures,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">and let us know that it has been delivered to the wrong address.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>