[cabfpub] Notice of Review Period - Ballot 197

Wed May 3 22:03:09 UTC 2017

NOTICE OF REVIEW PERIOD – BALLOT 197

This Review Notice is sent pursuant to Section 4.1 of the CA/Browser Forum’s Intellectual Property Rights Policy (v1.2).  This Review Period is for Final Maintenance Guidelines (30 day Review Period).  A complete draft of the Draft Guideline that is the subject of this Review Notice is attached.

Date Review Notice Sent:        May 3, 2017

Ballot for Review:                    Ballot 197 - Effective Date of Ballot 193 Provisions

Start of Review Period:           May 3, 2017 at 23:00 UTC

End of Review Period:             June 2, 2017 at 23:00 UTC

Please forward any Exclusion Notice relating to Essential Claims to the Chair by email to kirk.hall at entrustdatacard.com<mailto:kirk.hall at entrustdatacard.com> before the end of the Review Period.  See current version of CA/Browser Forum Intellectual Property Rights Policy for details.

(Optional form of Exclusion Notice is attached)

Ballot 197 – Effective Date of Ballot 193 Provisions (amended April 26)

Recent Ballot 193 reduced the maximum period for certificates and for reuse of vetting data for DV and OV certificates from 39 months to 825 days.  The effective date for reducing the maximum validity period of certificates was specified as March 1, 2018, but no effective date was specified for when the reduction of the maximum period for reuse of vetting data becomes effective.

It was the intention of the authors of Ballot 193 that the effective date for reducing the maximum period for reuse of vetting data under BR 4.2.1 would also be March 1, 2018.  This ballot is intended to clarify that intention.  The ballot also makes these changes retroactive to the effective date of Ballot 193 so there is no gap period.

Ballot 193 is in the Review Period (which will end on April 22, 2017), and has not yet taken effect.  Bylaw 2.3 states that Ballots should include a “redline or comparison showing the set of changes from the Final Guideline section(s) intended to become a Final Maintenance Guideline” and that “[s]uch redline or comparison shall be made against the Final Guideline section(s) as they exist at the time a ballot is proposed”.

To avoid confusion, this Ballot will show the proposed changes to BR 4.2.1 will be presented two ways: (1) a comparison of the changes to BR 4.2.1 as it existed before Ballot 193 (which is as BR 4.2.1 exists at this time this ballot is proposed), and also (2) a comparison of the changes to BR 4.2.1 as it will exist after the Review Period for Ballot 193 is completed (assuming no Exclusion Notices are filed).

The following motion has been proposed by Chris Bailey of Entrust Datacard and endorsed by Ben Wilson of DigiCert, and Wayne Thayer of GoDaddy to introduce new Final Maintenance Guidelines for the "Baseline Requirements Certificate Policy for the Issuance and Management of Publicly-Trusted Certificates" (Baseline Requirements) and the "Guidelines for the Issuance and Management of Extended Validation Certificates" (EV Guidelines).

-- MOTION BEGINS --

Ballot Section 1

BR 4.2.1 is amended to read as follows:

[Ballot amendments shown against BR 4.2.1 as it currently exists without the changes adopted in Ballot 193]

BR 4.2.1. Performing Identification and Authentication Functions

The certificate request MAY include all factual information about the Applicant to be included in the Certificate, and such additional information as is necessary for the CA to obtain from the Applicant in order to comply with these Requirements and the CA’s Certificate Policy and/or Certification Practice Statement. In cases where the certificate request does not contain all the necessary information about the Applicant, the CA SHALL obtain the remaining information from the Applicant or, having obtained it from a reliable, independent, third‐party data source, confirm it with the Applicant. The CA SHALL establish and follow a documented procedure for verifying all data requested for inclusion in the Certificate by the Applicant.

Applicant information MUST include, but not be limited to, at least one Fully‐Qualified Domain Name or IP address to be included in the Certificate’s SubjectAltName extension.

Section 6.3.2 limits the validity period of Subscriber Certificates. The CA MAY use the documents and data provided in Section 3.2 to verify certificate information, provided that: the CA obtained the data or document from a source specified under Section 3.2 no more than thirty‐nine (39) months prior to issuing the Certificate.

(1) Prior to March 1, 2018, the CA obtained the data or document from a source specified under Section 3.2 no more than 39 months prior to issuing the Certificate; and

(2) On or after March 1, 2018, the CA obtained the data or document from a source specified under Section 3.2 no more than 825 days prior to issuing the Certificate.

The CA SHALL develop, maintain, and implement documented procedures that identify and require additional verification activity for High Risk Certificate Requests prior to the Certificate’s approval, as reasonably necessary to ensure that such requests are properly verified under these Requirements.

If a Delegated Third Party fulfills any of the CA’s obligations under this section, the CA SHALL verify that the process used by the Delegated Third Party to identify and further verify High Risk Certificate Requests provides at least the same level of assurance as the CA’s own processes.

[Ballot amendments shown against BR 4.2.1 as it existed after Ballot 193 was approved]

BR 4.2.1. Performing Identification and Authentication Functions

The certificate request MAY include all factual information about the Applicant to be included in the Certificate, and such additional information as is necessary for the CA to obtain from the Applicant in order to comply with these Requirements and the CA’s Certificate Policy and/or Certification Practice Statement. In cases where the certificate request does not contain all the necessary information about the Applicant, the CA SHALL obtain the remaining information from the Applicant or, having obtained it from a reliable, independent, third‐party data source, confirm it with the Applicant. The CA SHALL establish and follow a documented procedure for verifying all data requested for inclusion in the Certificate by the Applicant.

Applicant information MUST include, but not be limited to, at least one Fully‐Qualified Domain Name or IP address to be included in the Certificate’s SubjectAltName extension.

Section 6.3.2 limits the validity period of Subscriber Certificates. The CA MAY use the documents and data provided in Section 3.2 to verify certificate information, provided that: the CA obtained the data or document from a source specified under Section 3.2 no more than 825 days prior to issuing the Certificate.

(1) Prior to March 1, 2018, the CA obtained the data or document from a source specified under Section 3.2 no more than 39 months prior to issuing the Certificate; and

(2) On or after March 1, 2018, the CA obtained the data or document from a source specified under Section 3.2 no more than 825 days prior to issuing the Certificate.

The CA SHALL develop, maintain, and implement documented procedures that identify and require additional verification activity for High Risk Certificate Requests prior to the Certificate’s approval, as reasonably necessary to ensure that such requests are properly verified under these Requirements.

If a Delegated Third Party fulfills any of the CA’s obligations under this section, the CA SHALL verify that the process used by the Delegated Third Party to identify and further verify High Risk Certificate Requests provides at least the same level of assurance as the CA’s own processes.

Ballot Section 2

The provisions of Ballot Section 1 will be effective retroactive to the effective date of Ballot 193.

Ballot Section 3

The vote on Ballot 194 and the Review Period notice issued for Ballot 194 are hereby declared null and void and of no effect, and are rescinded.

--Motion Ends--

The procedure for approval of this Final Maintenance Guideline ballot is as follows (exact start and end times may be adjusted to comply with applicable Bylaws and IPR Agreement):

BALLOT 197

Status: Final Maintenance Guideline

Start time (22:00 UTC)

End time (22:00 UTC)

Discussion (7 to 14 days)

April 19, 2017

April 26, 2017

Vote for approval (7 days)

April 26, 2017

May 3, 2017

If vote approves ballot: Review Period (Chair to send Review Notice) (30 days).

If Exclusion Notice(s) filed, ballot approval is rescinded and PAG to be created.

If no Exclusion Notices filed, ballot becomes effective at end of Review Period.

May 3, 2017 at 23:00 UTC

June 2, 2017 at 23:00 UTC

From Bylaw 2.3: If the Draft Guideline Ballot is proposing a Final Maintenance Guideline, such ballot will include a redline or comparison showing the set of changes from the Final Guideline section(s) intended to become a Final Maintenance Guideline, and need not include a copy of the full set of guidelines.  Such redline or comparison shall be made against the Final Guideline section(s) as they exist at the time a ballot is proposed, and need not take into consideration other ballots that may be proposed subsequently, except as provided in Bylaw Section 2.3(j).

Votes must be cast by posting an on-list reply to this thread on the Public list.  A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here: https://cabforum.org/members/

In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor.  Quorum is shown on CA/Browser Forum wiki.  Under Bylaw 2.2(g), at least the required quorum number must participate in the ballot for the ballot to be valid, either by voting in favor, voting against, or abstaining.

EXCLUSION NOTICE – BALLOT

I hereby provide this Exclusion Notice for the Essential Claim(s) listed below:

Ballot Covered by This Exclusion Notice:      Ballot:

CABF Member Name:                                                      (Organization)

Date Exclusion Notice Sent:

Exclusion Notice provided by:                                            (Name)

Provide Exclusion Notice to current CA/Browser Forum Chair: Kirk Hall, kirk.hall at entrustdatacard.com<mailto:kirk.hall at entrustdatacard.com>   Exclusion Notices must be provided by deadline stated in related Review Notice.

(For each Essential Claim covered by this Exclusion Notice, please list “numbered section of the Final Guideline or Final Maintenance Guideline whose implementation makes the excluded claim an Essential Claim for each of the issued patent(s) or pending patent application(s) that a Participant reasonably believes at the time may contain Essential Claims the Participant wishes to exclude from the CAB Forum RF License” and also “make an election, (i) not to grant a license or (ii) to provide a license with all of the requirements of Section 5.1 with the exception of subsection 5.1 f.”  See IPR Policy Sections 4.2 and 4.3.)

Essential Claim No.

Numbered section(s) of Guideline related to Essential Claim  [Sec. 4.3]

Patent number for issued patent, title and application number for pending patent, or copy of patent application unpublished patent applications [Sec. 4.3]

License Grant Election Made  [Sec. 4.2]

1.

£ (i) no license granted
£ (ii) license granted per Sec. 5.1 except Sec. 5.1.f

2.

£ (i) no license granted
£ (ii) license granted per Sec. 5.1 except Sec. 5.1.f

3.

£ (i) no license granted
£ (ii) license granted per Sec. 5.1 except Sec. 5.1.f

4.

£ (i) no license granted
£ (ii) license granted per Sec. 5.1 except Sec. 5.1.f

(Continue on second page if necessary)

Relevant IPR Policy Excerpts

4.2 Excluding Patents and/or Patent Applications from Royalty Free Licensing Obligations during Review Period.

Except for Essential Claims encompassed by a Participant’s Contributions that are actually incorporated into a Final Guideline or Final Maintenance Guideline approved in accordance with the CAB Forum Guideline approval process, Participants may within the Review Period exclude Essential Claims from the CAB Forum RF License. In such case, Participant shall be permitted to either make an election, (i) not to grant a license or (ii) to provide a license with all of the requirements of Section 5.1 with the exception of subsection 5.1 f.

4.3 Conditions and Procedure for Excluding Patents and/or Patent Applications from CAB Forum RF License.

A Participant seeking to exclude Essential Claims from the CAB Forum RF License in accordance with Section 4.2 must provide written notice of such intent to the CAB Forum Chair (“Exclusion Notice”) within the Review Period, and the Exclusion Notice shall be effective upon its receipt by the CAB Forum Chair. The Exclusion Notice shall include identification of the numbered section of the Final Guideline or Final Maintenance Guideline whose implementation makes the excluded claim an Essential Claim for each of the issued patent(s) or pending patent application(s) that a Participant reasonably believes at the time may contain Essential Claims the Participant wishes to exclude from the CAB Forum RF License. For issued patents, the Exclusion Notice shall also include the patent number(s). For pending patent applications, the Exclusion Notice shall also include the title and application number(s). If an issued patent or pending patent application that may contain Essential Claims is not set forth in the Exclusion Notice, such Essential Claims shall continue to be subject to the CAB Forum RF License. For unpublished patent applications, the Exclusion Notice shall also include a copy of the patent application. Exclusion Notices shall be published at https://cabforum.org/ipr-exclusion-notices/. ***

8.1. Essential Claims

“Essential Claims” shall mean all claims in any patent or patent application in any jurisdiction in the world that would necessarily be infringed by implementation of any Normative Requirement in a Final Guideline or Final Maintenance Guideline. A claim is necessarily infringed hereunder only when it is not possible to avoid infringing it because there is no non-infringing alternative for implementing a Normative Requirement of a Final Guideline or Final Maintenance Guideline. Existence of a non-infringing alternative shall be judged based on the state of the art at the time the guideline is adopted as a Final Guideline or Final Maintenance Guideline. If a Normative Requirement in a Final Guideline or Final Maintenance Guideline may be fulfilled by any of a list of specified alternatives, then for determination of whether a claim is an Essential Claim, each of the specified alternatives should be considered independently as if it were the only method for fulfilling that requirement. ***

8.3. Other Key Definitions ***

c. “Contribution” means material, including Draft Guidelines, Draft Guideline text, and modifications to other Contributions, made verbally or in a tangible form of expression (including in electronic media) which is provided by a Participant in the process of developing a Draft Guideline for the purpose of incorporating such material into a Draft Guideline or a Final Guideline or Final Maintenance Guideline. For a verbal contribution to be deemed a Contribution hereunder it must be memorialized within approved meeting minutes of the CAB Forum. ***

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20170503/e11b62c2/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Ballot 197 Review Notice and Exclusion Notice Template.pdf
Type: application/pdf
Size: 623143 bytes
Desc: Ballot 197 Review Notice and Exclusion Notice Template.pdf
URL: <http://cabforum.org/pipermail/public/attachments/20170503/e11b62c2/attachment-0001.pdf>