[cabf_validation] Onion Proposal

Dimitris Zacharopoulos (HARICA) dzacharo at harica.gr
Fri Jan 24 05:44:24 MST 2020


On 16/1/2020 11:07 μ.μ., Roland Shoemaker via Validation wrote:
> Let's Encrypt will endorse this ballot.
>
> Thanks,
> Roland
>
> On Thu, Jan 16, 2020 at 9:32 AM Wayne Thayer via Validation 
> <validation at cabforum.org <mailto:validation at cabforum.org>> wrote:
>
>     The only feedback I've received is to update the redline to be
>     immutable by referencing commits [1].
>
>     Please let me know if you are willing to endorse this ballot. Once
>     I have two endorsers, I'll begin the discussion period.
>

HARICA will also endorse this ballot.

Dimitris.

>
>     Thanks,
>
>     Wayne
>
>     [1]
>     https://github.com/cabforum/documents/compare/16a5a9bb78a193266f8d1465de1ee5a1acf5d184..fded04ad7f0390931d38af225bea46a4742fb631
>
>     On Thu, Jan 2, 2020 at 11:03 AM Wayne Thayer <wthayer at mozilla.com
>     <mailto:wthayer at mozilla.com>> wrote:
>
>         Here is a draft ballot for review. I'm still looking for
>         feedback on the proposal and two members to endorse.
>
>         ==========================
>         Ballot SCXX: Version 3 Onion Certificates
>
>         Purpose of Ballot:
>
>         This ballot will permit CAs to issue DV and OV certificates
>         containing Tor onion addresses using the newer version 3
>         naming format.
>
>         In ballot 144, later clarified by ballots 198/201, the Forum
>         created rules for issuing EV certificates containing onion
>         addresses. A primary reason for requiring EV level validation
>         was that onion addresses were cryptographically weak, relying
>         on RSA-1024 and SHA-1. More recently a newer "version 3"
>         addressing scheme has removed these weaknesses. For much the
>         same reason that EV certificates are not always a viable
>         option for website operators (e.g. sites operated by
>         individuals), many onion sites would benefit from the
>         availability of DV and OV certificates for version 3 onion
>         addresses.
>
>         The Tor Service Descriptor Hash extension required in the EV
>         Guidelines to contain the full hash of the keys related to the
>         .onion address is no longer needed as this hash is part of the
>         version 3 address.
>
>         Older version 2 onion addresses are still in use, so this
>         ballot does not remove the existing EV Guidelines requirements
>         for onion names.
>
>         Reference to discussion of EV onion certificates:
>         https://cabforum.org/pipermail/public/2014-November/004569.html
>
>         Reference to reasons we required EV in the past:
>         https://cabforum.org/pipermail/public/2015-November/006213.html
>
>         Reference to prior discussion of this topic:
>         https://cabforum.org/pipermail/public/2017-November/012451.html
>
>
>         The following motion has been proposed by Wayne Thayer of
>         Mozilla and endorsed by XXX of YYY and XXX of YYY.
>
>
>         -- MOTION BEGINS --
>
>         This ballot modifies the “Baseline Requirements for the
>         Issuance and Management of Publicly-Trusted Certificates” as
>         follows, based on Version 1.6.7, or based on Version 1.6.7 as
>         modified by ballot SC25:
>
>         ADD a paragraph to section 3.2.2.4 of the Baseline
>         Requirements as defined in the following redline:
>         https://github.com/cabforum/documents/compare/master...wthayer:br-onion
>
>         ADD Appendix C to the Baseline Requirements as defined in the
>         following redline:
>         https://github.com/cabforum/documents/compare/master...wthayer:br-onion
>
>
>         This ballot modifies the "Guidelines for the Issuance and
>         Management of Extended Validation Certificates" as follows
>         based on version 1.7.1:
>
>         MODIFY Appendix F as defined in the following redline:
>         https://github.com/cabforum/documents/compare/master...wthayer:br-onion
>
>
>         -- MOTION ENDS --
>
>
>         This ballot proposes two Final Maintenance Guidelines.
>
>         The procedure for approval of this ballot is as follows:
>
>         Discussion (7+ days)
>
>         Start Time: TBD UTC
>
>         End Time: No earlier than TBD UTC
>
>         Vote for approval (7 days)
>
>         Start Time: TBD
>
>         End Time: TBD
>
>         On Mon, Dec 23, 2019 at 3:37 PM Wayne Thayer
>         <wthayer at mozilla.com <mailto:wthayer at mozilla.com>> wrote:
>
>             Thanks Jacob and Roland. I've attempted to address your
>             comments:
>             https://github.com/wthayer/documents/commit/6e590309cca47737454790f452369769bf7281eb
>
>             As I believe you are suggesting, I removed the requirement
>             defining how to communicate the nonce only to the Applicant.
>
>             I also made a few other changes to the draft:
>             * Add random value expiration:
>             https://github.com/cabforum/documents/commit/14235f2e21df5cc75fbd151f91cba277af2df762
>             * Anticipate changes to domain validation method #6:
>             https://github.com/cabforum/documents/commit/4945ebd94fe70e3762600f39746e30d266d15aaf
>
>             Thanks,
>
>             Wayne
>
>             On Thu, Dec 19, 2019 at 2:18 PM Jacob Hoffman-Andrews
>             <jsha at letsencrypt.org <mailto:jsha at letsencrypt.org>> wrote:
>
>                 Thanks for moving this forward.
>
>                 My colleague Roland Shoemaker pointed out that this
>                 proposal introduces the term "Verified Method of
>                 Communication," which is only defined in the EVGLs,
>                 not the BRs. There's a similar definition in the BRs:
>
>                 Reliable Method of Communication: A method of
>                 communication, such as a postal/courier delivery
>                 address, telephone number, or email address, that was
>                 verified using a source other than the Applicant
>                 Representative.
>
>                 However, this is only used in the context of
>                 establishing Subject Identity Information to be
>                 included in the certificate. For certificates without
>                 Subject Identity Information, this is probably not
>                 necessary; that is, proof of control of the private
>                 key corresponding to the Onion address is sufficient
>                 on its own, so communication could be established,
>                 e.g. through an API account created by the Applicant
>                 Representative.
>
>     _______________________________________________
>     Validation mailing list
>     Validation at cabforum.org <mailto:Validation at cabforum.org>
>     https://cabforum.org/mailman/listinfo/validation
>
>
> _______________________________________________
> Validation mailing list
> Validation at cabforum.org
> https://cabforum.org/mailman/listinfo/validation

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/validation/attachments/20200124/4921d877/attachment.html>


More information about the Validation mailing list