[cabfpub] Ballot 150 - OIDs

Rich Smith richard.smith at comodo.com
Wed Aug 26 06:21:56 MST 2015


Ben,

What about my suggestion:

I propose:

2.23.140

               --> 31 - ServiceDescriptors

                              --> 1 - TORServiceDescriptor



Reasoning being that at the moment the TOR descriptor is the only one, but
that may not always be the case.



You sent an email to a few people off board which included this and seemed
as if you agreed, but you didn't include it in this on board email to
Jeremy.  Oversight or...?



Regards,

Rich



From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On
Behalf Of Jeremy Rowley
Sent: Wednesday, August 26, 2015 1:41 AM
To: Ben Wilson; public at cabforum.org
Subject: Re: [cabfpub] Ballot 150 - OIDs



Sounds good to me



From: Ben Wilson
Sent: Tuesday, August 25, 2015 7:12 PM
To: Jeremy Rowley <jeremy.rowley at digicert.com>; public at cabforum.org
Subject: RE: Ballot 150 - OIDs



Jeremy,



Would it be a problem to add the following to this Ballot 150?



5) Modify the first paragraph of Appendix F of the EV Guidelines by striking
.1 from the TOR Service Descriptor Hash so that the paragraph reads as
follows:

A CA may issue an EV Certificate with .onion in the right-most label of the
Domain Name provided that issuance complies with the requirements set forth
in this Appendix: 1. CAB Forum Tor Service Descriptor Hash extension
(2.23.140.1.31).  The CAB Forum has created an extension of the
TBSCertificate for use in conveying hashes of keys related to .onion
addresses. The Tor Service Descriptor Hash extension has the following
format:

cabf-TorServiceDescriptor OBJECT IDENTIFIER ::= { 2.23.140.1.31 }

The reason for this request is that the .1 OID arc under the CABF’s
assigned entity number (2.23.140) is reserved for policy identifiers and
certificate types.  The OID structure should be:



2.23.140.1 - policies / certificate types …

2.23.140.31 - TorServiceDescriptor

2.23.140.41 - caSigningNonce

2.23.140.42  - applicantSigningNonce



Thanks,



Ben





From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On
Behalf Of Jeremy Rowley
Sent: Thursday, August 20, 2015 9:26 AM
To: public at cabforum.org
Subject: [cabfpub] Ballot 150 - OIDs



Here’s an updated draft of the OID ballot:



Ballot 150-Addition of Optional OID for Individual Validation



 The following motion has been proposed by Dean Coclin of Symantec and
endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend Micro.



-- MOTION BEGINS -



1)      Modify section 1.2 of Baseline Requirements as follows:



1.2 Document Name and Identification

This certificate policy (CP) contains the requirements for the issuance and
management of publicly‐trusted SSL certificates, as adopted by the
CA/Browser Forum.



The following Certificate Policy identifiers are reserved for use by CAs as
an optional means of asserting compliance with this CP (OID arc
2.23.140.1.2) as follows:



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2) domain‐
validated(1)} (2.23.140.1.2.1);



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2)
organization-validated(2)} (2.23.140.1.2.2) and



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2)
individual-validated(3)} (2.23.140.1.2.3).



2)      Modify section 7.1.6.1 of the Baseline Requirements as follows:



7.1.6.1. Reserved Certificate Policy Identifiers



This section describes the content requirements for the Root CA, Subordinate
CA, and Subscriber Certificates, as they relate to the identification of
Certificate Policy.



The following Certificate Policy identifiers are reserved for use by CAs as
an optional means of asserting compliance with these Requirements as
follows:



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2) domain‐
validated(1)} (2.23.140.1.2.1), if the Certificate complies with these
Requirements but lacks Subject Identity Information that is verified in
accordance with either Section 3.2.2.1 or Section 3.2.3.



If the Certificate asserts the policy identifier of 2.23.140.1.2.1, then it
MUST NOT include organizationName, givenName, surname, streetAddress,
localityName, stateOrProvinceName, or postalCode in the Subject field.



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2)
organization-validated(2)} (2.23.140.1.2.2), if the Certificate complies
with these Requirements and includes Subject Identity Information that is
verified in accordance with Section 3.2.2.1.



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2)
individual-validated(3)} (2.23.140.1.2.3), if the Certificate complies with
these Requirements and includes Subject Identity Information that is
verified in accordance with Section 3.2.3.



If the Certificate asserts the policy identifier of 2.23.140.1.2.2, then it
MUST also include organizationName, localityName, stateOrProvinceName (if
applicable), and countryName in the Subject field. If the Certificate
asserts the policy identifier of 2.23.140.1.2.3, then it MUST also include
(i) either organizationName or givenName and surname, (ii) localityName,
(iii) stateOrProvinceName (if applicable), and (iv) countryName in the
Subject field.



3)      Modify the definition of “EV OID” in the EV Guidelines as follows:



EV OID: An identifying number, in the form of an “object identifier,” that
is included in the certificatePolicies field of a certificate that: (i)
indicates which CA policy statement relates to that certificate, and (ii) is
either the CA/Browser Forum EV policy identifier or a  policy identifier
that, by pre-agreement with one or more Application Software Supplier, marks
the certificate as being an EV Certificate.



4)      Modify Section 9.3.2 of the EV Guidelines as follows:

Each EV Certificate issued by the CA to a Subscriber MUST contain a policy
identifier that is either defined by these Guidelines or the CA in the
certificate’s certificatePolicies extension that: (i) indicates which CA
policy statement relates to that Certificate, (ii) asserts the CA’s
adherence to and compliance with these Guidelines, and (iii), is either the
CA/Browser Forum’s EV policy identifier or a policy identifier that, by
pre-agreement with the Application Software Supplier, marks the Certificate
as being an EV Certificate.



The following Certificate Policy identifier is the CA/Browser Forum’s EV
policy identifier:

{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) ev-guidelines (1) } (2.23.140.1.1), if
the Certificate complies with these Guidelines.





If the ballot passes, the custodian of the Forum OIDs will be instructed to
obtain the new OID for IV as indicated above.



-- MOTION ENDS -



The review period for this ballot shall commence at 2200 UTC on Friday,
August 21, 2015, and will close at 2200 UTC on Friday, August 27, 2015.
Unless the motion is withdrawn during the review period, the voting period
will start immediately thereafter and will close at 2200 UTC on Friday,
September 4, 2015. Votes must be cast by posting an on-list reply to this
thread.



A vote in favor of the motion must indicate a clear 'yes' in the response. A
vote against must indicate a clear 'no' in the response. A vote to abstain
must indicate a clear 'abstain' in the response. Unclear responses will not
be counted. The latest vote received from any representative of a voting
member before the close of the voting period will be counted. Voting members
are listed here:  <https://cabforum.org/members/>
https://cabforum.org/members/



In order for the motion to be adopted, two thirds or more of the votes cast
by members in the CA category and greater than 50% of the votes cast by
members in the browser category must be in favor. Quorum is currently nine
(9) members- at least nine members must participate in the ballot, either by
voting in favor, voting against, or abstaining.





-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/public/attachments/20150826/275ff538/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 6378 bytes
Desc: not available
Url : https://cabforum.org/pipermail/public/attachments/20150826/275ff538/attachment-0001.bin 


More information about the Public mailing list