[cabfpub] Verification of Domain Contact and Domain Authorization Document

Fri Dec 22 13:09:31 MST 2017

The attack vector is easier than that. 

1.	I use very stringent processes to verify that Google, Inc. is a legit company in Utah.
2.	I verify that Jeremy did indeed incorporate Google, Inc. 
3.	I call Jeremy at the phone listed for Google, Inc., the Utah corporation
4.	The domain information shows Google, Inc. as owning google.com
5.	Certificate issues.

Obviously this would be caught in every CA’s high risk checks, but the point remains valid. Regardless of the expertise and thoroughness of the org check, the specs lack any time between the verified org and the actual domain because orgs are not unique on a global basis.

Jeremy

From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Ryan Sleevi via Public
Sent: Thursday, December 21, 2017 9:58 AM
To: Adriano Santoni <adriano.santoni at staff.aruba.it>; CA/Browser Forum Public Discussion List <public at cabforum.org>
Subject: Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document

Adriano,

Do you have an example of how you believe 3.2.2.4.1 can be used correctly? 

Specifically, it does not describe the process for validating that the Applicant is the Domain Contact with the Registrar - this isn't equivalent to using WHOIS.

Here's just one scenario:

- I ("Ryan Sleevi") apply to Foo CA for example.com <http://example.com> , which is owned by "Andriano Santoni's Lightly Validated Certificates" - you.

- Foo CA decides to employ 3.2.2.4.1, using 3.2.2.4(1)

  - Note, as worded, all of 3.2.2.1 can be read as 'optional' for DV certs, thus automatically met, but lets pretend its OV

  - They verify "Andriano Santoni's Lightly Validated Certificates" is a real company with a real existence using a QGIS. That's all that's needed - there's no binding to the Applicant, just an existence proof of the data.

  - Alternatively, I send a photoshopped letter claiming your company exists, valid under 3.2.2.1(4)

  - Alternatively, the CA declares that "Google Maps" is a Reliable Data Source (it isn't, but again, underspecified), and verifies that there's an entry under 3.2.2.1(2) - despite the fact I just added the entry

- They then need to verify whether or not I'm authorized to speak for your company.

  - The information used in 3.2.2.1 doesn't have to be used ("the CA MAY use ..."), but remember, I may have made it up under 3.2.2.1

  - The CA can directly call me, Ryan Sleevi, asking if I'm authorized ("the CA MAY establish the authenticity of the certificate request directly with the Applicant Representative")

  - The requirement to use an RMOC simply means that Foo CA could decide to call up Jeremy, since Jeremy knows me, and say "Hey, does Ryan work for Adriano Santoni" - that's all that's required.

- Finally, the CA contacts the registrar, and says "Hey, does Adriano Santoni's Lightly Validated Certificates own example.com <http://example.com> " - and the registrar says sure

  - Note: There's no consensus whether we're talking about the same organization - perhaps I created a version incorporated in the US, but you're incorporated in Italy

These are just a few of the legal-but-bad things you can do. I'm sure we'll see the normal rush from some CAs saying "Yes, but we'd never do that" - while ignoring the fact that some could, as it's valid under the language, and we consistently see "That which is valid (or subject to misinterpretation) is possible to use"

Could you provide an example of how you believe 3.2.2.4.1 "should" work and offer the same level of assurance as the other methods, without normatively prescribing the data sources used? From conversations with both current and past employees of CAs, I am adamantly convinced that there is not a consistent standard of reliableness being applies. Google Maps being used as a Reliable Data Source is not a hypothetical, despite it allowing community edits.

On Thu, Dec 21, 2017 at 4:00 AM, Adriano Santoni via Public <public at cabforum.org <mailto:public at cabforum.org> > wrote:

Jeremy, I am not sure I fully understand the problems you describe. 

Would it be possible for you to provide some concrete example related to method #1, with some details, without of course mentioning specific certificates and/or organizations?

Il 19/12/2017 22:30, Jeremy Rowley via Public ha scritto:

Hi all, 

When reviewing the Symantec validation methods and the customers using each method, I found an alarming number of customers verified under 3.2.2.4.1 (Verification of a Domain Contact) or 3.2.2.4.5 (Domain Authorization Document) where the domain is not technically associated with the entity. These two methods need improvement or removal as the way they are currently lacks sufficient controls to associate the domain verification with the actual certificate approver. I’ve had too many calls with customers explaining re-verification where the domain holder didn’t understand that a cert issued for the domain. Although the organization verification was successfully complete, the only tie between the domain and organization is a call to the organization that happened within the last years to approve the account for issuance. I wanted to bring it up here because I’ve always thought these methods were less desirable than others. I think other large CAs use this method quite a bit so I’m hoping to get clarity on why these methods are permitted when the domain verification seems more “hand-wavy” than other methods. 

Method 3.2.2.4.1 permits a CA to issue a certificate if the certificate is an EV or OV cert. With EV certificates, there is a call to a verified telephone number that confirms the requester’s affiliation with the organization. I can see this method working for EV.  For OV certificates, there is a reliable method of communication that confirms the account holder as affiliated with the organization.  Unlike EV, for OV certs there is no tie between the requester and their authority to request a certificate. Once the organization is verified, the BRs permit auto-issuance for any domain that reflects an affiliation with the verified entity for up to 825 days. There’s no notice to the domain contact that the certificate was requested or approved.  Perhaps this is sufficient as the account has been affiliated with the organization through the reliable method of communication and because CT will soon become mandatory. 

Method 3.2.2.4.5 permits a CA to issue a certificate using a legal opinion letter for the domain. Unfortunately the BRs lack clear requirements about how the legal opinion letter is verified. If I want a cert for Google.com and the CA is following the bare minimum, all I need to do is copy their letterhead and sign the document. Magically, a certificate can issue.  This method lacks a lot of controls of method 1 because there is no requirement around verification of the company. I can list as many domains in the letter as I’d like provided the entity listed in the corresponding WHOIS’s letterhead is used.

I’m looking to remove/fix both of these methods as both these methods lack the necessary controls to ensure that the verification ties to the domain holder. These methods probably should have been removed back when we passed 169/182. Would anyone being willing to endorse a ballot killing these or making some necessary improvements?  

Jeremy

_______________________________________________
Public mailing list
Public at cabforum.org <mailto:Public at cabforum.org> 
https://cabforum.org/mailman/listinfo/public

_______________________________________________
Public mailing list
Public at cabforum.org <mailto:Public at cabforum.org> 
https://cabforum.org/mailman/listinfo/public

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20171222/836e5759/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4984 bytes
Desc: not available
URL: <http://cabforum.org/pipermail/public/attachments/20171222/836e5759/attachment-0001.p7s>