[cabfpub] Random value reuse

Peter Bowen pzb at amzn.com
Tue Jul 25 22:33:37 MST 2017


This is an interesting question and I the answer is you cannot share a value across all five of the methods you list.

Methods 2 and 4 involve sending the value privately to contacts related to the domain (either from registration data or role mailboxes). The certificate applicant does not know the random value unless they are a contact or the contact gives them the random value.  The CA doesn’t care how it gets the value back for these methods.

On the other hand, 6, 7, and 10 involve giving the applicant the random value and then the CA verifying the applicant could cause it to appear on something related to the domain.  The CA then looks for it at the right point.

If you use the same value for 2/4 and 6/7/10, then the workflow could look like:
- Certificate request
- You generate the random value and give it to the applicant (intending to be used for 6/7/10)
- Applicant turns around and submits it back to you (as if they had gotten it from a domain contact as per 2/4)
Result: No confirmation the applicant is authorized (BAD)

Alternatively, you could:
- Get certificate request
- Send random value to one or more addressed allowed by 2/4
- Then look for the value in a location allowed by 6/7/10
Result: double confirmation (good, but beyond the minimal requirement)

Maybe we should clarify this somehow in


> On Jul 25, 2017, at 9:20 PM, Jeremy Rowley via Public <public at cabforum.org> wrote:
> An interesting question came up today in connection with random values used for validation.  Methods 2, 4, 6, 7, and 10 permit use of a random values. Methods 2 and 4, require a unique random value per email. Methods 6, 7, and 10 do not require unique random values per request for the random value. 
> Some customers would like to use the same random value across multiple methods (method 2, 6, and 7), having us look for the first instance of the random value, or across multiple domains. Method 6 and 7 require a unique random value per certificate request, not per domain. This means, that the same Random Value can appear in multiple DNS records at once to confirm control. 
> The questions raised by this are:
> Should the random value be unique per verified domain name instead of per certificate request? With email methods, use of a single email to verify multiple domain names with the same email address makes sense. I’m not sure this makes as much sense for DNS records.  
> Can multiple methods use the same random value? Can you request a random value and then the CA just scour the permitted locations to find it? This seems okay to me as nothing requires the CA to specify the method of validation associated with the Random Value, but thought I’d get other opinions.
> Jeremy
> _______________________________________________
> Public mailing list
> Public at cabforum.org <mailto:Public at cabforum.org>
> https://cabforum.org/mailman/listinfo/public <https://cabforum.org/mailman/listinfo/public>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20170725/4fce635d/attachment-0001.html>

More information about the Public mailing list