[cabfpub] LEI information in web certificates

[Tim Hollebeek]

I’m not sure us standardizing using someone else’s OID arc instead of ours has a lot of added value, but it could be done.  I doubt they really care.  I certainly don’t.

 

Google is certainly free to not consume the information if they do not feel it is valuable to them.  To be clear, the link would be between a validated identity and the associated LEI (we continue to see lots of value in asserted and validated identities whether it be a VAT id or any other identifier with well-defined validation rules).  You can put LEIs into DV certificates, but I’m not sure I see the point.

 

Relying parties are free to make use of validated information found in certificates in any way they find useful.  We’re generally not in the business of telling people how to use the information we validate, which is one of the things that distinguishes us from some other CAs.

 

-Tim

 

From: Ryan Sleevi [mailto:sleevi at google.com] 
Sent: Friday, July 6, 2018 5:37 PM
To: Tim Hollebeek <tim.hollebeek at digicert.com>; CABFPub <public at cabforum.org>
Subject: Re: [cabfpub] LEI information in web certificates

 

 

On Fri, Jul 6, 2018 at 4:29 PM Tim Hollebeek via Public <public at cabforum.org <mailto:public at cabforum.org> > wrote:

 

As many of you are aware, the GLEIF foundation recently invited CA/Browser Forum members to its identity management workshop.  Some people have contacted us about the possibility of putting LEI identifiers into web certificates.  This is in some ways similar to the recent proposal from ETSI to put additional identity information into certificates, though it has the advantage that we are free to determine ourselves how best to encode it.

 

CAs are already allowed to include this information in certificates, assuming it has been appropriately validated.  There is a Global Legal Entity Identifier Index that is authoritative for LEIs.  However it would be valuable if there were a standardized CABF OID and extension so that every CA that chooses to include this information includes it in an interoperable way.  This also allocates the OID in a namespace we control, allowing us to state in the BRs the purpose and semantics of the extension, and require that it only be used for authentic and validated LEIs.

 

It seems to me that it would be worthwhile to standardize this, instead of every CA coming up with their own way of doing it.  What do other people think?

 

Could you explain how this information would be used by Relying Parties?

 

The GLEIF model effectively relies on third-party RAs, with all of the attendant issues, and without a clear framework for addressing many of the issues that has been held in the CA ecosystem. I'm not sure the value proposition here, or that the information is something RPs should necessarily use. As to whether or not it's appropriate, I think that's going to be very much contingent upon what the intended semantics being introduced are - that is, what relationship, if any, is being expressed between the LEI ID and the domain - and that opens a host of complexity that could easily detract from the far more pressing and meaningful work on improving the domain and information validation.

 

I'm not sure why a CABF OID would be more useful than a GLEIF OID (which seems far more appropriate), and with a defined syntax relevant for GLEIF. I can think of no good reason to use the CABF arc, so I'm hoping you could explain more that thinking.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20180706/38874748/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4940 bytes
Desc: not available
URL: <http://cabforum.org/pipermail/public/attachments/20180706/38874748/attachment-0001.p7s>