OISTE Votes Yes to SC-067 V3 > On 15 Jul 2024, at 17:29, Chris Clements via Servercert-wg > <[email protected]> wrote: > > Purpose of Ballot SC-067 V3: > > This Ballot proposes updates to the Baseline Requirements for the Issuance > and Management of Publicly-Trusted TLS Server Certificates (i.e., TLS BRs) > related to “Multi-Perspective Issuance Corroboration” (“MPIC”). > > Background: > > - MPIC refers to performing domain validation and CAA checks from multiple > Network Perspectives before certificate issuance, as described within the > Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and > 3.2.2.5. > - Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will > require using MPIC. > - This work was most recently motivated by research presented at Face-to-Face > 58 [1] by Princeton University, but has been discussed for years prior as > well. > - The goal of this proposal is to make it more difficult for adversaries to > successfully launch equally-specific prefix attacks against the domain > validation processes described in the TLS BRs. > - Additional background information can be found in an update shared at > Face-to-Face 60 [2]. > > Benefits of Adoption: > > - Recent publicly-documented attacks have used BGP hijacks to fool domain > control validation and obtain malicious certificates, which led to the > impersonation of HTTPS websites [3][4]. > - Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP > attacks, but localized, equally-specific BGP attacks still pose a significant > threat to the Web PKI [5][6]. > - Corroborating domain control validation checks from multiple network > perspectives (i.e., MPIC) spread across the Internet substantially reduces > the threat posed by equally-specific BGP attacks, ensuring the integrity of > domain validation and issuance decisions [5][7][8]. > - Existing deployments of MPIC at the scale of millions of certificates a day > demonstrate the feasibility of this technique at Internet scale [7][9]. > > Intellectual Property (IP) Disclosure: > > - While not a Server Certificate Working Group Member, researchers from > Princeton University presented at Face-to-Face 58, provided academic > expertise, and highlighted publicly-available peer-reviewed research to > support Members in drafting this ballot. > - The Princeton University researchers indicate that they have not filed for > any patents relating to their MPIC work and do not plan to do so in the > future. > - Princeton University has indicated that it is unable to agree to the > CA/Browser Forum IPR agreement because it could encumber inventions invented > by researchers not involved in the development of MPIC or with the CA/B Forum. > - Princeton University has instead provided the attached IPR statement. > Pursuant to the IPR statement, Princeton University has granted a worldwide > royalty free license to the intellectual property in MPIC developed by the > researchers and has made representations regarding its lack of knowledge of > any other Princeton intellectual property needed to implement MPIC. > - The attached IPR statement has not changed since disclosed in Discussion > Round 1. > - For clarity, Princeton University’s IPR statement is NOT intended to > replace the Forum’s IPR agreement or allow Princeton to participate in the > Forum in any capacity. > - Members seeking legal advice regarding this ballot should consult their own > counsel. > > Proposal Revision History: > > - Pre-Ballot Release #1 (work team artifacts and broader Validation > Subcommittee collaboration) [10] > - Pre-Ballot Release #2 [11] > > Previous versions of this Ballot: > > - Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some > of the changes represented in the comparison are updates made by other > ballots that have since passed (e.g., SC-069). > - Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some > of the changes represented in the comparison are updates made by other > ballots that have since passed (e.g., SC-072). > > References: > [1] > https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__cabforum.org_wp-2Dcontent_uploads_13-2DCAB-2DForum-2Dface-2Dto-2Dface-2Dmultiple-2Dvantage-2Dpoints.pdf&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=hk27XHbgi9xSgS0B5OMnS78CUAi0AIdFascXdgEVCMQ&e=> > [2] > https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_file_d_1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL_view-3Fusp-3Ddrive-5Flink&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=RpCzNbmHqe_WTOV90wcp62pPIoDb7vKY4dydBw2ZNMg&e=> > > [3] > https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600 > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__medium.com_s2wblog_post-2Dmortem-2Dof-2Dklayswap-2Dincident-2Dthrough-2Dbgp-2Dhijacking-2Den-2D3ed7e33de600&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=u1M6FW9BBSQssvDgVKzkJtW3A5V9EOYipbFKg8l4ACk&e=> > > [4] https://www.coinbase.com/blog/celer-bridge-incident-analysis > <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.coinbase.com_blog_celer-2Dbridge-2Dincident-2Danalysis&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=DFWyyxayVtzj_7UydWz5iBg_0S2f9OxFElmUfocuH8c&e=> > > [5] > https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski > <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.usenix.org_conference_usenixsecurity23_presentation_cimaszewski&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=36dgskzWXqOZGN3lHidq6KEj7ApK2O6-LW1Ek9Ban3k&e=> > > [6] > https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.blackhat.com_docs_us-2D15_materials_us-2D15-2DGavrichenkov-2DBreaking-2DHTTPS-2DWith-2DBGP-2DHijacking-2Dwp.pdf&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=jqT4hDPDmdDiJgJha6rFLpT2IySSe56_6ZcSDvUT3W4&e=> > > [7] https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee > <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.usenix.org_conference_usenixsecurity21_presentation_birge-2Dlee&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=rUmPLedRyyHhXaZiDyvKqbEsBWBFud9KdXiebT7AQdg&e=> > > [8] https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee > <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.usenix.org_conference_usenixsecurity18_presentation_birge-2Dlee&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=gaqOGRnWuYGfzTgLwg1iMmEat25WRgiUHP1zqn4-XV0&e=> > > [9] > https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__security.googleblog.com_2023_05_google-2Dtrust-2Dservices-2Dacme-2Dapi-5F0503894189.html&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=YdbAwURPU0-QW7V7eOZzEDPoqouJCroJfDQpMbNGp-A&e=> > > [10] https://github.com/ryancdickson/staging/pull/6 > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ryancdickson_staging_pull_6&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=57yl1IynGbhAyG8rW2W-RYWgaCk6URk0epWUhIYiIwY&e=> > > [11] https://github.com/ryancdickson/staging/pull/8 > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ryancdickson_staging_pull_8&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=t_RK2hLdcCzcMujwUXZtbMvE0D0FJIPwGHHUymGfqQA&e=> > > [12] https://github.com/cabforum/servercert/pull/487 > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_cabforum_servercert_pull_487&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=PojcD01SGxsYx1JoR-DH2BXj-vAHchMaFJ68D2uFo34&e=> > > [13] > https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5 > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_cabforum_servercert_compare_6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=3uyWhI3p9mBSU7bZi15zj7lRH0Oix2M5ryLfaPv-WKQ&e=> > [14] https://github.com/cabforum/servercert/pull/507 > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_cabforum_servercert_pull_507&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=52kLXXu4gRYzu803N5wWtH8lLdroh7OrNG3F-CTFNBw&e=> > > [15] > https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_cabforum_servercert_compare_5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=HNLJ48jeFQjYUa7jPt_3w0XHKnt6mFmFO8HzOBAyfLU&e=> > > The following motion has been proposed by Chris Clements and Ryan Dickson of > Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s > Encrypt) and Wayne Thayer (Fastly). > > — Motion Begins — > > This ballot modifies the “Baseline Requirements for the Issuance and > Management of Publicly-Trusted TLS Server Certificates” (“Baseline > Requirements”), based on Version 2.0.4. > > MODIFY the Baseline Requirements as specified in the following Redline: > https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463 > > <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_cabforum_servercert_compare_c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=F2K6BqmctpcB-XQFWX3-yy5Lrc5Htx0kpNjgJas0i6E&e=> > > > > — Motion Ends — > > This ballot proposes a Final Maintenance Guideline. The procedure for > approval of this ballot is as follows: > > Discussion (57 days) > - Start: 2024-05-20 14:30:00 UTC > - End: 2024-07-15 15:29:59 UTC > > Vote for approval (7 days) > - Start: 2024-07-15 15:30:00 UTC > - End: 2024-07-22 15:30:00 UTC > > <Princeton MPIC Commitment - final draft 2024.01.11 > (003).pdf>_______________________________________________ > Servercert-wg mailing list > [email protected] > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_servercert-2Dwg&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=f1KWC1EW3Za0wc_7fQ8pPPvnRwfPY_-0BalhHoVxoEAazgc-MMFG1ZflOMlLCrAI&s=0LmmXd63RzZCMsWAE9mvmCCjMkF6V5vKxq8VgjGbIyQ&e=
WISeKey SA Pedro Fuentes CSO - Trust Services Manager Office: + 41 (0) 22 594 30 00 Mobile: + 41 (0) 791 274 790 Address: Avenue Louis-Casaï 58 | 1216 Cointrin | Switzerland Stay connected with WISeKey <http://www.wisekey.com/> THIS IS A TRUSTED MAIL: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey please check the signature to avoid security risks CONFIDENTIALITY: This email and any files transmitted with it can be confidential and it’s intended solely for the use of the individual or entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender DISCLAIMER: WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability for any errors or omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail are checked for viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Servercert-wg mailing list [email protected] https://lists.cabforum.org/mailman/listinfo/servercert-wg
