[cabfpub] .onion proposal

Tue Dec 2 00:18:37 UTC 2014

Thanks Ryan for the great feedback.

I can’t believe I forgot to mention that these changes are to the EV Guidelines.  All certs issued to .onion would have to be EV so the language about complying with the other sections of the EV Guidelines was redundant.  I just wanted to emphasize that all EV subject requirements remain as-is. I’ll remove that section in the next draft.  I also sent an email to Mark Nottingham for registration of the well-known.  I’m not sure who should be the change controller for onion.

As for the implications of the 15 month validity period, the result is that the longest an onion certificate is valid for (without revalidation) is 13+15 months, which is shorter than the 13+27 months of current EV certs.  Hopefully this is a short-enough time period that at least mitigate the issues, especially when combined with CT.

Here’s the updated text that I think incorporates all of your suggestions:

Several organizations have expressed a desire for an end-entity SSL certificate valid for their .onion Hidden Service address signed by a Certificate Authority (CA) present in browser trust stores.

Applicants want a CA-signed .onion address for several reasons, including:

-        Powerful web platform features are restricted to secure origins, which are currently not available to onion names (in part, because of the lack of IANA registration).  Permitting EV certs for onion names will help provide a secure origin for the service, moving onion towards use of powerful web platform features.

-        Currently, access to .onion names over https from a standard browser results in the standard existing 'Invalid Certificate' warning.  Training users to click through security warnings lowers the value of these warnings and will cause users to miss important security information.  Removing these warnings for the user, through use of a digital certificate, will help users recognize and avoid real MITM attacks.

-        The public needs attribution of ownership of the .onion address to differentiate onion services, including potential phishing services. Because onion names are not easily recognizable strings, providing the public with additional information about the operator has significant security improvements, especially in regions where use of the incorrect name could have lethal consequences.

This proposal amends the EV Guidelines to provide clear guidelines on how a CA may issue certificates for .onion addresses.

---------------------
Proposal
---------------------

Amend the Guidelines for the Issuance and Management of Extended Validation Certificates v1.5.2 as follows:
Amend Section 9.2.2 and 11.7.1 as follows:

9.2.2. Subject Alternative Name Extension
Certificate field: subjectAltName:dNSName
Required/Optional: Required
Contents: This extension MUST contain one or more host Domain Name(s) owned or controlled by the Subject and to be associated with the Subject’s server. Such server MAY be owned and operated by the Subject or another entity (e.g., a hosting service). Wildcard certificates are not allowed for EV Certificates except as permitted under Appendix F.

11.7 Verification of Applicant’s Domain Name

11.7.1. Verification Requirements

(1) For each Fully-Qualified Domain Name listed in a Certificate other than a Domain Name with .onion in the right-most label of the Domain Name, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or has control over the FQDN using a procedure specified in Section 11.1.1 of the Baseline Requirements, except that a CA MAY NOT verify a domain using the procedure described 11.1.1(7). For a Certificate issued to a Domain Name with .onion in the right-most label of the Domain Name, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant’s control over the .onion Domain Name in accordance with Appendix F.

(2) Mixed Character Set Domain Names: EV Certificates MAY include Domain Names containing mixed character sets only in compliance with the rules set forth by the domain registrar. The CA MUST visually compare any Domain Names with mixed character sets with known high risk domains. If a similarity is found, then the EV Certificate Request MUST be flagged as High Risk. The CA must perform reasonably appropriate additional authentication and verification to be certain beyond reasonable doubt that the Applicant and the target in question are the same organization.

Add a new Appendix F:

Appendix F – Issuance of Certificates for .onion Domain Names
A CA may issue an EV Certificate containing the .onion Domain Name provided that issuance complies with the requirements set forth in this Appendix:
1.      CAB Forum Tor Service Descriptor Hash extension (2.23.140.1.31)
The CAB Forum has created an extension of the TBSCertificate for use in conveying hashes of keys related to .onion addresses.  The Tor Service Descriptor Hash extension has the following format:
cabf-TorServiceDescriptorHash OBJECT IDENTIFIER ::= { 2.23.140.1.31 }
TorServiceDescriptorHash:: = SEQUENCE {
               algorithm               AlgorithmIdentifier
               subjectPublicKeyHash    BIT STRING      }
Where the AlgorithmIdentifier is a hashing algorithm (defined in RFC 6234) performed over the DER-encoding of an ASN.1 SubjectPublicKey of the .onion service and SubjectPublicKeyHash is the hash output.

2.      The CA MUST verify the Applicant’s control over the .onion Domain Name using one of the following:

a.      The CA MAY verify the Applicant’s control over the .onion service by posting a specific value at a well-known URL under RFC5785. [NOTE: This is subject to change depending on whether we can register a well-known URL for onion]

b.      The CA MAY verify the Applicant’s control over the .onion service by signing a Certificate Request using the .onion public key if (i) the signature contains a random value chosen by the CA that prevents a fraudulent applicant from obtaining the signed statement within the signature { 2.23.140.1.41 }  and (ii) the signature contains a random value chosen by the Applicant that prevents the CA from choosing the entire contents of the signed statement { 2.23.140.1.42 }.  Each nonce/counter-nonce MUST have at least 64-bits of entropy and MUST be presented as an OCTET STRING in the appropriate extension (specified above) in the Attributes section of the certificationRequestInfo.

4.      Each Certificate containing a .onion Domain Name MUST conform to the requirements of these Guidelines, including the content requirements in Section 9 and Appendix B of the Baseline Requirements, except that the CA MAY include a wildcard character in the Subject Alternative Name Extension and Subject Common Name Field as the leftmost character in the .onion Domain Name provided inclusion of the wildcard character complies with Section 11.1.3 of the Baseline Requirements.

5.    CAs MUST NOT issue a Certificate containing an .onion Domain Name with a validity period longer than 15 months.

6.    On or before January 15, 2015, each CA MUST revoke all Certificates issued with the Subject Alternative Name extension or Common Name field containing a .onion Domain Name unless the Certificate was issued in compliance with this Appendix F.

-----Original Message-----
From: Gervase Markham [mailto:gerv at mozilla.org<mailto:gerv at mozilla.org>]
Sent: Thursday, November 20, 2014 3:15 AM
To: Brian Smith
Cc: Jeremy Rowley; public at cabforum.org<mailto:public at cabforum.org>
Subject: Re: [cabfpub] .onion proposal
On 19/11/14 20:22, Brian Smith wrote:
> Also, when you say "it should certainly be allowed," do you mean that
> you verified that browsers do the correct thing with respect to SPDY
> and HTTP/2 connection coalescing when a certificate has both an .onion
> and a non-.onion dNSName subjectAltName? I think TorBrowser probably
> does the right thing, but I could see how it could easily go wrong. It
> seems like unnecessary risk.

No, you're right, I haven't checked this.

Gerv
_______________________________________________
Public mailing list
Public at cabforum.org<mailto:Public at cabforum.org>
https://cabforum.org/mailman/listinfo/public

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20141202/f5c26b37/attachment-0003.html>