Sectigo votes yes
De: Servercert-wg <[email protected]> En nombre de Chris Clements via Servercert-wg Enviado el: lunes, 15 de julio de 2024 17:30 Para: CA/B Forum Server Certificate WG Public Discussion List <[email protected]> Asunto: [Servercert-wg] Voting Period Begins - Ballot SC-067 V3: "Require domain validation and CAA checks to be performed from multiple Network Perspectives" CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Purpose of Ballot SC-067 V3: This Ballot proposes updates to the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (i.e., TLS BRs) related to "Multi-Perspective Issuance Corroboration" ("MPIC"). Background: - MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5. - Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC. - This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well. - The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes described in the TLS BRs. - Additional background information can be found in an update shared at Face-to-Face 60 [2]. Benefits of Adoption: - Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS websites [3][4]. - Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to the Web PKI [5][6]. - Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8]. - Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9]. Intellectual Property (IP) Disclosure: - While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted publicly-available peer-reviewed research to support Members in drafting this ballot. - The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future. - Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers not involved in the development of MPIC or with the CA/B Forum. - Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC. - The attached IPR statement has not changed since disclosed in Discussion Round 1. - For clarity, Princeton University's IPR statement is NOT intended to replace the Forum's IPR agreement or allow Princeton to participate in the Forum in any capacity. - Members seeking legal advice regarding this ballot should consult their own counsel. Proposal Revision History: - Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10] - Pre-Ballot Release #2 [11] Previous versions of this Ballot: - Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069). - Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-072). References: [1] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcabforum. org%2Fwp-content%2Fuploads%2F13-CAB-Forum-face-to-face-multiple-vantage-poin ts.pdf&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208d ca4e2f059%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314105860%7C Unknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLC JXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=aypL3ktEOqfVcVSHi8wHYRtaXa0sm2SKPFVr0RbM2Kc% 3D&reserved=0> https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-v antage-points.pdf [2] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdrive.goo gle.com%2Ffile%2Fd%2F1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL%2Fview%3Fusp%3Ddrive_ link&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208dca 4e2f059%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314124716%7CUn known%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJX VCI6Mn0%3D%7C0%7C%7C%7C&sdata=N%2F7aVS7BZ7N%2FFCXD3eDBHq6ocvxgfeJd4HR6G4qtmO g%3D&reserved=0> https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=d rive_link [3] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmedium.co m%2Fs2wblog%2Fpost-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7 e33de600&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d098920 8dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314139421% 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwi LCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=%2FalM5qd78WJvpHz3iM8dJu8mpB%2FDNkhK%2B%2F fcp9r9BX0%3D&reserved=0> https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hija cking-en-3ed7e33de600 [4] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.coinb ase.com%2Fblog%2Fceler-bridge-incident-analysis&data=05%7C02%7Cinigo.barreir a%40sectigo.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6 968b49fb7%7C0%7C0%7C638566542314151823%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wL jAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=fXs AuVm6qYvnyHEfeAapnRhbUsnt%2B1FqS3JaF3bpSBk%3D&reserved=0> https://www.coinbase.com/blog/celer-bridge-incident-analysis [5] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni x.org%2Fconference%2Fusenixsecurity23%2Fpresentation%2Fcimaszewski&data=05%7 C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c 48946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314163043%7CUnknown%7CTWFpbG Zsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0 %7C%7C%7C&sdata=%2FNoF%2BR9IPc3NpwoiQ5XQvFrn3wdSe2nJImsPmisIWWQ%3D&reserved= 0> https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski [6] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.black hat.com%2Fdocs%2Fus-15%2Fmaterials%2Fus-15-Gavrichenkov-Breaking-HTTPS-With- BGP-Hijacking-wp.pdf&data=05%7C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40 c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C6385665 42314172184%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJB TiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wf8TGo9bUO2yuT1SWwYzcRiltuDcCo yzFcz2ZpaKzVE%3D&reserved=0> https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HT TPS-With-BGP-Hijacking-wp.pdf [7] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni x.org%2Fconference%2Fusenixsecurity21%2Fpresentation%2Fbirge-lee&data=05%7C0 2%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48 946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314180135%7CUnknown%7CTWFpbGZs b3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7 C%7C%7C&sdata=tILZ2zr7h3aGN7heuWVfEOhP%2ByD9Cw4fRmIkzTnW1vg%3D&reserved=0> https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee [8] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.useni x.org%2Fconference%2Fusenixsecurity18%2Fpresentation%2Fbirge-lee&data=05%7C0 2%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48 946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314187761%7CUnknown%7CTWFpbGZs b3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7 C%7C%7C&sdata=4RfCBCi%2FhTMrwCenqEWZoN%2Bw0AeGUVWIEnL7AkLHl5M%3D&reserved=0> https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee [9] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity. googleblog.com%2F2023%2F05%2Fgoogle-trust-services-acme-api_0503894189.html& data=05%7C02%7Cinigo.barreira%40sectigo.com%7C0cd254e40c0342d0989208dca4e2f0 59%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638566542314194700%7CUnknown %7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6M n0%3D%7C0%7C%7C%7C&sdata=KXpS0RSkogQZKGEy3ZetM8Skoh5A4V3BuBNtPHDciBk%3D&rese rved=0> https://security.googleblog.com/2023/05/google-trust-services-acme-api_05038 94189.html [10] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co m%2Fryancdickson%2Fstaging%2Fpull%2F6&data=05%7C02%7Cinigo.barreira%40sectig o.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7% 7C0%7C0%7C638566542314201332%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJ QIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=7e7kV8tqOVq4j Pv7Bru2BiNzUPskBLJlFZ42ix%2FTO8g%3D&reserved=0> https://github.com/ryancdickson/staging/pull/6 [11] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co m%2Fryancdickson%2Fstaging%2Fpull%2F8&data=05%7C02%7Cinigo.barreira%40sectig o.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7% 7C0%7C0%7C638566542314207500%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJ QIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=toM4Xmghs8YuE F3BAfUCxM0RrZmzQBPMnGOL1uhXsUg%3D&reserved=0> https://github.com/ryancdickson/staging/pull/8 [12] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co m%2Fcabforum%2Fservercert%2Fpull%2F487&data=05%7C02%7Cinigo.barreira%40secti go.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7 %7C0%7C0%7C638566542314213615%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLC JQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=mgMUMHSAyby% 2FpiLuPpkqPJ6tfgIRChQ3K5iS%2BDjvDhg%3D&reserved=0> https://github.com/cabforum/servercert/pull/487 [13] https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e 753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5 [14] <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co m%2Fcabforum%2Fservercert%2Fpull%2F507&data=05%7C02%7Cinigo.barreira%40secti go.com%7C0cd254e40c0342d0989208dca4e2f059%7C0e9c48946caa465d96604b6968b49fb7 %7C0%7C0%7C638566542314226217%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLC JQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=%2BM0rsxiT3L OtlINTK98IxBSBFRVQxezZaKQYku21H34%3D&reserved=0> https://github.com/cabforum/servercert/pull/507 [15] https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7 a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let's Encrypt) and Wayne Thayer (Fastly). - Motion Begins - This ballot modifies the "Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates" ("Baseline Requirements"), based on Version 2.0.4. MODIFY the Baseline Requirements as specified in the following Redline: https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85d f75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 - Motion Ends - This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows: Discussion (57 days) - Start: 2024-05-20 14:30:00 UTC - End: 2024-07-15 15:29:59 UTC Vote for approval (7 days) - Start: 2024-07-15 15:30:00 UTC - End: 2024-07-22 15:30:00 UTC
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Servercert-wg mailing list [email protected] https://lists.cabforum.org/mailman/listinfo/servercert-wg
