Ben Bucksch wrote:
Actually, not even that is necessary. Classes each have their own root cert, so we can simply match root certs to level in our software, using a list that is just as hardcoded as our root certs, and matches the assigned levels.
That assumes CAs only issue one type of cert from a particular root. Sadly, I believe this is not universally true.
Right. As you said yourself, Gerv, CAs are audited based on their public (and closed) policies. If VeriSign publically states that they'll verify the street address via this-and-that means for Class 3, and they have a WebTrust audit, then you can consider street address verification being audited for Class 3. This is true already, today. All that Eddy's proposal changes, really, is to make these policies machine-readable.
I didn't see anything in Eddy's proposal which required CAs to make their policies machine-readable. What did I miss?
Or do you mean that we have to check the policy documents for every offering manually, and classify it, and _then_ it becomes machine-readable? :-)
Gerv _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security
