[cabf_validation] Multi-Perspective Issuance Corroboration Updates

[Ryan Dickson]

Hi Adriano,

Thank you for your review of the latest
<https://github.com/ryancdickson/staging/pull/8> proposal to incorporate
"Multi-Perspective Issuance Corroboration" ("MPIC") requirements into the
TLS Baseline Requirements.

Responses to your comments are inline below.

1) I cannot seem to find an explicit requirement that a CA uses at least
> two (2) Remote Network Perspectives. That can be inferred from the Quorum
> Requirements table in 3.2.2.9, sure, but it would probably be better (IMO)
> if it was explicit.


The "Quorum Requirements" table describes the maximum number of allowed
"non-corroborations" given the number of distinct remote network
perspectives used for an MPIC attempt. The end of 3.2.2.9 presents the
"Phased Implementation Timeline," which describes implementation milestones
that strengthen over time. Over the proposed implementation timeline,
quorum requirements increase from undefined (during the period where CAs
SHOULD be implementing MPIC but are not otherwise required) to 5+
(beginning in December 2026).

I've noticed some of my formatted emails aren't preserved well on the Mail
archive (example
<https://archive.cabforum.org/pipermail/servercert-wg/2023-July/003825.html>),
so I've also described this implementation in a GitHub comment
<https://github.com/ryancdickson/staging/pull/8/files#r1368708684>. I also
made some edits
<https://github.com/ryancdickson/staging/commit/d40f1614978f74fd84a198175640bd2f4008106b>
to the proposed language in hopes of making this more clear.



Does this address your concern? If not, suggested edits directly on GitHub
are welcome.


2) The current proposed language has it that Remote Network Perspectives
> must be "distinct from the Primary Network Perspective" (meaning they must
> be at least 500km away from it), but it doesn't say that they must also be
> "distinct" from each other! Although this is intuitable, IMO it would be
> better to clarify.


Added in this update
<https://github.com/ryancdickson/staging/commit/fa0bb58b405a3745874e757f072789f369087c60>
. Does this address your concern? If not, suggested edits directly on
GitHub are welcome.



If I can make anything more clear, please let me know.

Thanks again for your review and comments,

Ryan


On Mon, Oct 23, 2023 at 4:58 AM Adriano Santoni via Validation <
validation at cabforum.org> wrote:

> All,
>
> I have a couple doubts after reading [1]:
>
> 1) I cannot seem to find an explicit requirement that a CA uses at least
> two (2) Remote Network Perspectives. That can be inferred from the Quorum
> Requirements table in 3.2.2.9, sure, but it would probably be better (IMO)
> if it was explicit.
>
> 2) The current proposed language has it that Remote Network Perspectives
> must be "distinct from the Primary Network Perspective" (meaning they must
> be at least 500km away from it), but it doesn't say that they must also be
> "distinct" from each other! Although this is intuitable, IMO it would be
> better to clarify.
>
> [1]
> https://github.com/ryancdickson/staging/blob/require-mpdv-v2/docs/BR.md#3229-multi-perspective-issuance-corroboration
>
> Adriano
>
> _______________________________________________
> Validation mailing list
> Validation at cabforum.org
> https://lists.cabforum.org/mailman/listinfo/validation
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20231023/f5b27ee3/attachment.html>