[Servercert-wg] Discussion Period Begins - Ballot SC-067 V3: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"

Wed May 22 07:01:45 UTC 2024

Marco, this ballot is under discussion period not voting period. You don´t
have to vote but discuss if needed

De: Servercert-wg <servercert-wg-bounces at cabforum.org> En nombre de Marco
Schambach via Servercert-wg
Enviado el: martes, 21 de mayo de 2024 23:13
Para: CA/B Forum Server Certificate WG Public Discussion List
<servercert-wg at cabforum.org>
Asunto: [Servercert-wg] Discussion Period Begins - Ballot SC-067 V3:
"Require domain validation and CAA checks to be performed from multiple
Network Perspectives"

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.

IdenTrust votes “Yes” on ballot SC-067 V3

Marco S.

TrustID Program Manager 

From: Servercert-wg <servercert-wg-bounces at cabforum.org
<mailto:servercert-wg-bounces at cabforum.org> > On Behalf Of Chris Clements
via Servercert-wg
Sent: Monday, May 20, 2024 10:30 AM
To: CA/B Forum Server Certificate WG Public Discussion List
<servercert-wg at cabforum.org <mailto:servercert-wg at cabforum.org> >
Subject: [External][Servercert-wg] Discussion Period Begins - Ballot SC-067
V3: "Require domain validation and CAA checks to be performed from multiple
Network Perspectives"

Purpose of Ballot SC-067 V3:

This Ballot proposes updates to the Baseline Requirements for the Issuance
and Management of Publicly-Trusted TLS Server Certificates (i.e., TLS BRs)
related to “Multi-Perspective Issuance Corroboration” (“MPIC”).

Background:

- MPIC refers to performing domain validation and CAA checks from multiple
Network Perspectives before certificate issuance, as described within the
Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and
3.2.2.5.

- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will
require using MPIC.

- This work was most recently motivated by research presented at
Face-to-Face 58 [1] by Princeton University, but has been discussed for
years prior as well.

- The goal of this proposal is to make it more difficult for adversaries to
successfully launch equally-specific prefix attacks against the domain
validation processes described in the TLS BRs.

- Additional background information can be found in an update shared at
Face-to-Face 60 [2].

Benefits of Adoption:

- Recent publicly-documented attacks have used BGP hijacks to fool domain
control validation and obtain malicious certificates, which led to the
impersonation of HTTPS websites [3][4].

- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP
attacks, but localized, equally-specific BGP attacks still pose a
significant threat to the Web PKI [5][6].

- Corroborating domain control validation checks from multiple network
perspectives (i.e., MPIC) spread across the Internet substantially reduces
the threat posed by equally-specific BGP attacks, ensuring the integrity of
domain validation and issuance decisions [5][7][8].

- Existing deployments of MPIC at the scale of millions of certificates a
day demonstrate the feasibility of this technique at Internet scale [7][9].

Intellectual Property (IP) Disclosure:

- While not a Server Certificate Working Group Member, researchers from
Princeton University presented at Face-to-Face 58, provided academic
expertise, and highlighted publicly-available peer-reviewed research to
support Members in drafting this ballot.

- The Princeton University researchers indicate that they have not filed for
any patents relating to their MPIC work and do not plan to do so in the
future.

- Princeton University has indicated that it is unable to agree to the
CA/Browser Forum IPR agreement because it could encumber inventions invented
by researchers not involved in the development of MPIC or with the CA/B
Forum.

- Princeton University has instead provided the attached IPR statement.
Pursuant to the IPR statement, Princeton University has granted a worldwide
royalty free license to the intellectual property in MPIC developed by the
researchers and has made representations regarding its lack of knowledge of
any other Princeton intellectual property needed to implement MPIC.

- The attached IPR statement has not changed since disclosed in Discussion
Round 1.

- For clarity, Princeton University’s IPR statement is NOT intended to
replace the Forum’s IPR agreement or allow Princeton to participate in the
Forum in any capacity.

- Members seeking legal advice regarding this ballot should consult their
own counsel.

Proposal Revision History:

- Pre-Ballot Release #1 (work team artifacts and broader Validation
Subcommittee collaboration) [10]

- Pre-Ballot Release #2 [11]

Previous versions of this Ballot:

- Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some
of the changes represented in the comparison are updates made by other
ballots that have since passed (e.g., SC-069).

- Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some
of the changes represented in the comparison are updates made by other
ballots that have since passed (e.g., SC-072).

References:

[1]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcabforum.
org%2Fwp-content%2Fuploads%2F13-CAB-Forum-face-to-face-multiple-vantage-poin
ts.pdf&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308d
c79dad719%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620199606%7C
Unknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLC
JXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=A4uivnpVwNcQSyfQ%2B6VOYRMzOmVXmlsdfjz6Vzt2oK
I%3D&reserved=0>
https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-v
antage-points.pdf

[2]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdrive.goo
gle.com%2Ffile%2Fd%2F1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL%2Fview%3Fusp%3Ddrive_
link&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308dc7
9dad719%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620211596%7CUn
known%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJX
VCI6Mn0%3D%7C0%7C%7C%7C&sdata=R2zaukCllcQPzr6H%2BZSCvqFb6uZwbekAjdfOdhaiTMk%
3D&reserved=0>
https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=d
rive_link 

[3]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmedium.co
m%2Fs2wblog%2Fpost-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7
e33de600&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f30
8dc79dad719%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620220376%
7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwi
LCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=XVBy6Gf%2FtjUK0XmKnR5hIDbDs2BnGNtRXj5zEpXS
Jtc%3D&reserved=0>
https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hija
cking-en-3ed7e33de600 

[4]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.coinb
ase.com%2Fblog%2Fceler-bridge-incident-analysis&data=05%7C02%7Cinigo.barreir
a%40sectigo.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6
968b49fb7%7C0%7C0%7C638519228620227298%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wL
jAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ec3
3eLm6Ym0D0BdrAcQchSTX1qVIWPETTmj9mORlsyk%3D&reserved=0>
https://www.coinbase.com/blog/celer-bridge-incident-analysis 

[5]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni
x.org%2Fconference%2Fusenixsecurity23%2Fpresentation%2Fcimaszewski&data=05%7
C02%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c
48946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620233632%7CUnknown%7CTWFpbG
Zsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0
%7C%7C%7C&sdata=py4%2FDjcc8lnn0wH5CxgTc6CasCTckqmbl%2BRCS%2FS3Zek%3D&reserve
d=0>
https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski

[6]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.black
hat.com%2Fdocs%2Fus-15%2Fmaterials%2Fus-15-Gavrichenkov-Breaking-HTTPS-With-
BGP-Hijacking-wp.pdf&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C367e8265f
0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C6385192
28620240129%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJB
TiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ziAWyclf%2Fb2xv5axQFbVKlbR236Q
Bmvi0rBk7fXkBVk%3D&reserved=0>
https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HT
TPS-With-BGP-Hijacking-wp.pdf 

[7]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni
x.org%2Fconference%2Fusenixsecurity21%2Fpresentation%2Fbirge-lee&data=05%7C0
2%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48
946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620246523%7CUnknown%7CTWFpbGZs
b3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7
C%7C%7C&sdata=2k84jjkwrjnN9oLoqySChq%2FhXA8h2RCyHBms87MOGs8%3D&reserved=0>
https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee 

[8]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni
x.org%2Fconference%2Fusenixsecurity18%2Fpresentation%2Fbirge-lee&data=05%7C0
2%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48
946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620252380%7CUnknown%7CTWFpbGZs
b3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7
C%7C%7C&sdata=vwM85EwMslTSEz00%2B3o424y%2Fb1fnvG3M6jOtdrGPKUg%3D&reserved=0>
https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee 

[9]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.
googleblog.com%2F2023%2F05%2Fgoogle-trust-services-acme-api_0503894189.html&
data=05%7C02%7Cinigo.barreira%40sectigo.com%7C367e8265f0254c8401f308dc79dad7
19%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638519228620258187%7CUnknown
%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6M
n0%3D%7C0%7C%7C%7C&sdata=hz%2B3jnzb1BeGjysGBOQo4%2Bj%2BvsefR04z6FnDB0gfEKs%3
D&reserved=0>
https://security.googleblog.com/2023/05/google-trust-services-acme-api_05038
94189.html 

[10]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fryancdickson%2Fstaging%2Fpull%2F6&data=05%7C02%7Cinigo.barreira%40sectig
o.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968b49fb7%
7C0%7C0%7C638519228620264065%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJ
QIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ZmpG7K2eQUXXL
tiChgpF0yqAogwqdSJ6fsLcV%2Fhjrys%3D&reserved=0>
https://github.com/ryancdickson/staging/pull/6 

[11]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fryancdickson%2Fstaging%2Fpull%2F8&data=05%7C02%7Cinigo.barreira%40sectig
o.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968b49fb7%
7C0%7C0%7C638519228620270858%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJ
QIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=vTnHZ%2BnZ73E
Sw7mZZTEZt36LhnEkcL5heeZFInLR0zk%3D&reserved=0>
https://github.com/ryancdickson/staging/pull/8 

[12]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fcabforum%2Fservercert%2Fpull%2F487&data=05%7C02%7Cinigo.barreira%40secti
go.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968b49fb7
%7C0%7C0%7C638519228620276648%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLC
JQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=%2FPSDP8Nn2l
MmFWqoZUjKeD1AsKhWRQU0KW0UorlwoVQ%3D&reserved=0>
https://github.com/cabforum/servercert/pull/487 

[13]
https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e
753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5

[14]
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fcabforum%2Fservercert%2Fpull%2F507&data=05%7C02%7Cinigo.barreira%40secti
go.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968b49fb7
%7C0%7C0%7C638519228620288032%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLC
JQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=2RUGT8GOVv1f
%2BYlrT3WGmT7SG05rjRfRjk8J2cd%2BERI%3D&reserved=0>
https://github.com/cabforum/servercert/pull/507 

[15]
https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7
a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 

The following motion has been proposed by Chris Clements and Ryan Dickson of
Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s
Encrypt) and Wayne Thayer (Fastly). 

— Motion Begins —

This ballot modifies the “Baseline Requirements for the Issuance and
Management of Publicly-Trusted TLS Server Certificates” (“Baseline
Requirements”), based on Version 2.0.4.

MODIFY the Baseline Requirements as specified in the following Redline:

<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fcabforum%2Fservercert%2Fcompare%2Fc4a34fe2292022e0a04ba66b5a85df75907ac2
a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463&data=05%7C02%7Cinigo.barreira%4
0sectigo.com%7C367e8265f0254c8401f308dc79dad719%7C0e9c48946caa465d96604b6968
b49fb7%7C0%7C0%7C638519228620313030%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw
MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=1WerOy
EKicN10ROMFGw2f0S6QQ8y42RAbs8eQh66Qow%3D&reserved=0>
https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85d
f75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 

— Motion Ends —

This ballot proposes a Final Maintenance Guideline. The procedure for
approval of this ballot is as follows:

Discussion (at least 11 days)

- Start: 2024-05-20 14:30:00 UTC

- End no earlier than: 2024-05-31 14:30:00 UTC

Vote for approval (7 days)

- Start: TBD

- End: TBD

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20240522/e9b8a19f/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6630 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20240522/e9b8a19f/attachment-0001.p7s>