[cabfpub] [EXTERNAL] Forbid DTPs from doing Domain/IP Ownership Validation ballot draft

[Brown, Wendy (10421)]

Ryan –
I wasn’t at the F2F so missed the entire discussion.  But I would also like to understand the rationale for totally banning DTP rather than fixing the audit issue.  If it is difficult to audit the DTP, is it any easier to audit the same functionality when done by  the CA or is it just obtaining the independent audit of the DTP that is problematic?

Also I want to be sure I understand the proposal, are enterprise validators still allowed as long as they are only validating domains subordinate to a domain owned by that enterprise?

Thanks,
   wendy

From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Ryan Sleevi via Public
Sent: Wednesday, April 26, 2017 8:37 PM
To: Kirk Hall <Kirk.Hall at entrustdatacard.com>
Cc: Ryan Sleevi <sleevi at google.com>; CA/Browser Forum Public Discussion List <public at cabforum.org>
Subject: Re: [cabfpub] [EXTERNAL] Forbid DTPs from doing Domain/IP Ownership Validation ballot draft



On Wed, Apr 26, 2017 at 8:12 PM, Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>> wrote:
Ryan, you kind of skipped over a core rationale for this draft ballot – that it’s somehow too hard to audit DTPs (at least as to their domain validation activities).  Why is it too hard?

Here is what the Purpose section of the ballot says:
Purpose of Ballot: At the moment, CAs are permitted to delegate the process of domain and IP address validation. However, permitting such delegations is problematic due to the way audits work - the auditing of such work may or may not be required and, if it is, those audit documents may not make it back to root programs for consideration. Although the audit situation also needs fixing, domain validation is an important enough component of a CA's core competencies that it seems wiser to remove it from the larger problem and forbid its delegation. The purpose of this ballot is to ensure that CAs or their Affiliates are always the ones performing domain/IP address ownership validation for certificates that CA is responsible for.

Can you and/or Gerv explain why auditing of DTPs can’t be fixed?

I'm not sure I understand the purpose of your question, or how that helps us make productive discussion. We actually spent quite a bit of time explaining this at the F2F, but you may have stepped out of the room. I know you were there for part of it, but perhaps there were other things you were focused on.

Let's say that neither Gerv and I are mistating the difficulty - that it is difficult, and that it won't happen in a timely fashion to the security concerns - do you believe this ballot would cause any harm to Entrust's operations that we should be aware of? Do you believe this would present difficulty to adopt?

The answers to those questions help inform and make progress. I can appreciate that you're curious to understand, and while I don't want to discourage that, I must admit I find it somewhat disheartening that you did not participate in the discussions in which this has been explained, or the discussions with our auditor friends on this matter. Recognizing this, it might be useful for a good faith discussion to assume we're telling the truth, and focus on the outcome, rather than the rationale, that way, even if you disagree with the rationale, if the outcome does not negatively affect Entrust's operations, it's a net win. It also reduces the amount of emails for members who have been following and participating in these discussions, understand the concerns, and are rightfully focused on minimizing impact.
NOTICE: Protiviti is a global consulting and internal audit firm composed of experts specializing in risk and advisory services. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services. This electronic mail message is intended exclusively for the individual or entity to which it is addressed. This message, together with any attachment, may contain confidential and privileged information. Any views, opinions or conclusions expressed in this message are those of the individual sender and do not necessarily reflect the views of Protiviti Inc. or its affiliates. Any unauthorized review, use, printing, copying, retention, disclosure or distribution is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email message to the sender and delete all copies of this message. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20170427/08ee9d0d/attachment-0001.html>