[cabfpub] For discussion: Restricting the use of file-based demonstrations of control

[Ryan Sleevi]

On Jun 2, 2014 7:15 AM, "Rob Stradling" <rob.stradling at comodo.com> wrote:
>
> On 02/06/14 14:47, Ryan Sleevi wrote:
> <snip>
>
>> In practice, we tend to see filesystem-based verifications result in
>> files being left on the root system, perhaps indefinitely. Additionally,
>> enumerating file names - even without their contents - is also a fairly
>> common attack.
>
>
> Ryan, how about if the authorized CA was permitted to use each CSR hash
value as a demonstration of control a maximum of _once_ ?
>
>
> --
> Rob Stradling
> Senior Research & Development Scientist
> COMODO - Creating Trust Online
>

1) Doesn't solve the CA A / CA B confusion I mentioned
2) Would prohibit issuance of a new cert for the same key, since CSRs don't
contain a nonce, and the request would potentially be identical (thus same
hash value, thus impossible to know if this is an old or new request).

I realize that in the case of "re-issuance", CA A likely has all the
information necessary to issue without a new CSR, I just don't know if that
is actually practiced. It would seem to induce yet another issuance path,
which I understand CAs are not fond of.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20140602/6ddc03aa/attachment-0003.html>