<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="">
<p style="margin: 0cm 0cm 8pt; line-height: 107%;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0);">I created a version to address the highlighted concerns on the usage of the word
'</span><font color="#000000" face="Calibri, sans-serif"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0);">equivalent'</span></font><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0);"> and
the validation of </span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0);">trademarks and trade/business names.</span></p>
<p class="MsoNormal" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 11pt; margin: 0cm 0cm 8pt; line-height: 107%;">
This version:<br>
</p>
<p class="MsoNormal" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 11pt; margin: 0cm 0cm 8pt; line-height: 107%;">
</p>
<ul>
<li>is using a <u>fixed set</u> of pre/suffix values</li><li>includes a requirement for a <u>certified translation</u> for the equivalent in a language other than English </li><li>requires the CA to check the value in the WIPO Global Brand Database and the local business registry</li></ul>
<p></p>
<p class="MsoNormal" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 11pt; margin: 0cm 0cm 8pt; line-height: 107%;">
Proposed OU validation requirements:</p>
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri, sans-serif">
<span lang="EN-US" style="mso-ansi-language:EN-US"><i>If the Subject Identity Information is to include an organizational unit, then it MUST be preceded or followed by a whitespace and one of the words “unit”, “department”, “division”,
<i style="background-color:rgb(255, 255, 255)">“group”,<span> </span></i>“service", "system", "center", "office", “school”, “faculty”, "administration", "operations” in singular or plural form; or a certified translation of the equivalent in a language other
than English.<o:p> </o:p></i></span></p>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri, sans-serif">
<span lang="EN-US" style="mso-ansi-language:EN-US"><i>The CA MUST verify the existence and affiliation of the organizational unit with the Applicant using an Organizational Chart provided by an authoritative source within the Applicant's organization, such
as the Applicant's main business offices, corporate offices, human resource offices, information technology offices, or other department that the CA deems appropriate.<o:p> </o:p></i></span></p>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri, sans-serif">
<span lang="EN-US" style="mso-ansi-language:EN-US"><i>If a value holds an active registration in the ‘WIPO Global Brand Database’ or a local business register the CA MAY only include these registered values when the CA has verified the right of usage in relation
to the Application in accordance with Section 3.2.<o:p> </o:p></i></span></p>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri, sans-serif">
<span lang="EN-US" style="mso-ansi-language:EN-US"><i>The value SHALL not be abbreviated unless this would exceed the maximum length of the `subject:organizationalUnitName` field, in which case it SHALL only use locally accepted abbreviation.<o:p> </o:p></i></span></p>
</div>
</blockquote>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Please share your thoughts about this version.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Paul</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Ryan Sleevi <sleevi@google.com><br>
<b>Sent:</b> Monday, November 16, 2020 16:23<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Subject:</b> Re: [cabf_validation] [EXTERNAL] Draft Ballot SCXX: Improve OU validation requirements</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, Nov 16, 2020 at 10:12 AM Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I have been thinking about a more simplistic and strict approach that doesn't follow all the current allowed methods listed in section 3.2 of the BR like we have proposed currently. </div>
</div>
</blockquote>
<div><br>
</div>
<div>As with every other proposal Entrust has offered to date, this doesn't actually address the problem inherent to any use of this field, which is that it's unverified, unvetted data, as there is *no* way to validate and vet it.</div>
<div><br>
</div>
<div>The most recent proposal reflects a thoroughly-debunked theater exercise to security, which is to rely on statements like "The user should understand that ...". It attempts to absolve the CA of the responsibility for not placing unverified data in certificates
in the first place, by trying to make it the user's responsibility on distinguishing that data from other fields and making an informed decision. Thankfully, this has been shown to be a theater exercise that harms users, so I feel like it's reasonable to simply
reject it outright.</div>
<div><br>
</div>
<div>If that were not troubling enough, however, I think it also bears mentioning that this approach continues with one which has been firmly discredited, and which we've been actively moving away from in the Forum since the Forum's very creation, which is
the introduction of significant interpretation differences and leeway. "and an equivalent of the word ... " and "in the equivalent of the language" should best be read as "any other method", and much like how "but" serves to negate that which precedes it in
a sentence, the "an equivalent" serves to negate any presumption of any rigor described.</div>
<div><br>
</div>
<div>This isn't progress on any measured dimension of providing rigor or addressing the fundamental issues, and is an attempt to preserve the status quo without actually addressing the issues. I'm glad Entrust is now interested in this space, but this approach
was discussed as far back as London in 2018, during the WG day, and highlights the problematic approach.</div>
<div><br>
</div>
<div>And, in the spirit of completely missing the problem space, it does nothing to address the fact that the following language is, practically speaking, unimplementable: "It SHALL NOT include a name, DBA, tradename, trademark, address, location, or other
text that refers to a specific natural person or Legal Entity unless the CA has verified this information in relation to the Application accordance with Section 3.2."</div>
</div>
</div>
</div>
</body>
</html>