October 2017 - Gnso-rds-pdp-3

Any changes?
by David Cake Nov. 1, 2017

Nov. 1, 2017

Our report seemed relatively well received on Saturday, I think people appreciated that we had looked at the issues in detail. Based on feedback and questions from those in the room, do you think there are any changes we should make before the meeting on Wednesday? David

3 2

Revised document
by David Cake Oct. 28, 2017

Oct. 28, 2017

I revised the document significantly from Alex’s version, but the majority of the changes are simply to remove operational and template material (such as descriptions of timelines, etc.) I have made some changes to the group conclusions in the document, but I hope that I have not included anything not specifically on the call. Please let me know if you think any changes need to be made very quickly - other wise this draft will be sent to the working group in a few hours, David

4 3

Presenting in Abu Dhabi
by David Cake Oct. 26, 2017

Oct. 26, 2017

I will not be in Abu Dhabi. Would one you volunteer to present this groups work to the face to face meeting in Abu Dhabi? Alex, you would be best placed, but if you can’t we will need somebody. Regards David

3 3

Discussion from first meeting
by David Cake Oct. 23, 2017

Oct. 23, 2017

Thank you to those that managed to make it to our Adobe Connect meeting today, We used the document Alex supplied as our initial basis for discussions. We also looked at the CAB Forum Guidelines For The Issuance And Management Of Extended Validation Certificates https://cabforum.org/wp-content/uploads/EV-V1_6_5.pdf <https://cabforum.org/wp-content/uploads/EV-V1_6_5.pdf> We discussed the different methods of validation, etc. Some methods of certificate validation focus only on demonstrating that the certificate applicant is in control of the domain, this includes the ACME protocol used by Lets Encrypt!, and these methods use the DNS directly, but do not use the RDS at all. We agreed that we did not feel that discussing the value of various forms of validation was largely outside of our scope, and had limited value. Validation that does not require access of personally identifying information exists, but by its nature does not act as a purpose for accessing the RDS. We chose to focus on the Extended Validation certificate case. The case of Extended Validation extends beyond the DNS and is designed to identify certificate ownership by a particular legal identity, so has a clear case to access identifying data. We discussed the Guidelines in detail, and noted that it was not an absolute necessity to use information from the RDS to validate identity for an EV - while an EV required validation of domain ownership, this could be performed solely via the DNS if necessary, and while an EV required validation of identify, this did not necessarily require use of identifying information from the RDS to perform. However, identifying information in the RDS could improve the practicality and quality of validation, and was used practically by many CAs in their normal course of business and was very practical for many reasons. We discussed that consent to accessing identifying information was implicit in requesting an EV certificate. We generally did not feel that DNS Certification was a necessary purpose for collection of personally identifying data. Regular use of a domain name is possible without certification, or limited certification is possible without RDS data. But the EV Certificate case was a notable purpose for access of existing personally identifying data. Any comments, corrections, additions, or follow up? David

3 5

UPDATED AC Recording, AC Chat & Attendance from Next-Gen RDS drafting team 2- Domain Name Certification call on Thursday, 19 October 2017 23:00 UTC
by Michelle DeSmyter Oct. 20, 2017

Oct. 20, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team 2 - Domain Name Certification call held on Thursday, 19 October 2017 at 23:00 UTC. Adobe Connect recording: https://participate.icann.org/p8b68sem06w/ Apologies: Arsène Tungali Attendance: Alex Deacon, David Cake, Kal Feher Staff: Michelle DeSmyter AC Chat: Michelle DeSmyter:Welcome to the GNSO Next-Gen RDS Drafting team #3: Domain Name Certification call on Thursday, 19 October 2017 at 23:00 UTC for 60 minutes. Michelle DeSmyter:Drafting teams and mailing list archives wiki page: https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_… Kal Feher:no audio possible? Kal Feher:nvm. it appeared the second time I tried Kal Feher:better! Michelle DeSmyter:I uploaded the document Alex sent out and unsynced it, so you can scroll through if you would like. Kal Feher:EV requirements: https://urldefense.proofpoint.com/v2/url?u=https-3A__cabforum.org_wp-2Dcont… Kal Feher:FYI the two letsencrypt validation methods are 3.2.2.4.6 and 3.2.2.4.7 Thank you. Kind regards, Michelle DeSmyter SOAC Support GNSO/GDD Internet Corporation for Assigned Names and Numbers (ICANN) Email: michelle.desmyter(a)icann.org<mailto:michelle.desmyter@icann.org>

1 0

UPDATED AC Recording, AC Chat & Attendance from Next-Gen RDS drafting team 2 - Domain Name Certification call on Thursday, 19 October 2017 at 23:00 UTC
by Michelle DeSmyter Oct. 20, 2017

Oct. 20, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team 2 - Domain Name Certification call held on Thursday, 19 October 2017 at 23:00 UTC. Adobe Connect recording: https://participate.icann.org/p8b68sem06w/ Apologies: None Attendance: Alex Deacon, David Cake, Kal Feher Staff: Michelle DeSmyter AC Chat: Michelle DeSmyter:Welcome to the GNSO Next-Gen RDS Drafting team #3: Domain Name Certification call on Thursday, 19 October 2017 at 23:00 UTC for 60 minutes. Michelle DeSmyter:Drafting teams and mailing list archives wiki page: https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_… Kal Feher:no audio possible? Kal Feher:nvm. it appeared the second time I tried Kal Feher:better! Michelle DeSmyter:I uploaded the document Alex sent out and unsynced it, so you can scroll through if you would like. Kal Feher:EV requirements: https://urldefense.proofpoint.com/v2/url?u=https-3A__cabforum.org_wp-2Dcont… Kal Feher:FYI the two letsencrypt validation methods are 3.2.2.4.6 and 3.2.2.4.7 Thank you. Kind regards, Michelle DeSmyter SOAC Support GNSO/GDD Internet Corporation for Assigned Names and Numbers (ICANN) Email: michelle.desmyter(a)icann.org<mailto:michelle.desmyter@icann.org>

2 2

AC Recording, AC Chat and attendance from Next-Gen RDS Drafting Team 3 - Domain Name Certification
by Michelle DeSmyter Oct. 20, 2017

Oct. 20, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team 2 - Domain Name Certification call held on Thursday, 19 October 2017 at 23:00 UTC. Adobe Connect recording: https://participate.icann.org/p8b68sem06w/ Apologies: None Attendance: Alex Deacon, David Cake, Kal Feher Staff: Michelle DeSmyter Thank you. Kind regards, Michelle DeSmyter SOAC Support GNSO/GDD Internet Corporation for Assigned Names and Numbers (ICANN) Email: michelle.desmyter(a)icann.org

1 0

The poll
by Arsène Tungali Oct. 19, 2017

Oct. 19, 2017

Hi all, The poll does not include a lot of options to allow better choice. All the available options does not work for me, i cannot make it. Hope this can be resolved, having more options to accomodate multiple time zones. Regards, Arsene ----------------- Arsène Tungali, about.me/ArseneTungali +243 993810967 GPG: 523644A0 Goma, Democratic Republic of Congo Sent from my iPhone (excuse typos)

3 2

lets get started
by David Cake Oct. 17, 2017

Oct. 17, 2017

The first meeting, unfortunately, only two of us attended, so we cancelled it. We will try for another meeting later in the week, but we can’t wait until then to get started, as our ‘m hoping to kick off discussion with this email. Our goal is to produce, over the next week and a bit, roughly two pages or so of definition of DNS Certification as a purpose for RDS data and access. We might want to start by expanding the definition very carefully, specifying the who and why at every stage. We might want to expand the use cases in detail, for example looking at the different types of DNS certification, and which data is necessary for each, and being specific about the data required. We might want to look at alternatives to accessing RDS data. I don’t think we have anyone on this call who works for a CA. The closest we probably have is some people from EFF (Jeremy’s employer) are involved in the Lets Encrypt project, and might be able to help us with some technical questions. I know some of the technical issues related to Certification a bit, but only some. We should expect that some of our work may change in detailed discussion with a CA technical expert, but that is no reason not to get started. The EWG report includes this definition, which we might want to consider as a bare minimum starting point > Tasks within the scope of this purpose include a Certification Authority (CA) issuing an X.509 certificate to a subject identified by a domain name. To accomplish this task, the user needs to confirm that the DN is registered to the certificate subject; doing so requires access to all public and gated data about the Registrant. > Which parts of that do we agree with, which deserve further consideration? David

4 3

Drafting Team #3 – Domain Name Certification
by David Cake Oct. 16, 2017

Oct. 16, 2017

Welcome. You have been selected by the RDS leadership team to serve on a drafting team to define the RDS purpose named in the subject line above. Thank you very much for volunteering to participate in this effort. Here is the list of the team members: Coordinated by: David Cake Members: Kal Feher, Alex Deacon, Carlton Samuels, Jeremy Malcolm, Arsen Tungali As you can see, this message is being sent via a dedicated mailing list that has been set up to facilitate email communications over the next two to two and half weeks. Please use the list for all of our electronic team communications. Note that this list is publicly archived. Here are the list details. Mailing list address: gnso-rds-pdp-3(a)icann.org Mailing list archive: http://mm.icann.org/pipermail/gnso-rds-pdp-3/ Attached you will find a template that outlines our tasks and provides a timeline. Please review it right away so that we can start discussions as soon as possible. We plan to have at least two teleconference calls over the next two weeks, but additional ones may be scheduled as needed. At the same time, mailing list discussion is encouraged. The first call will be scheduled on Tuesday or Wednesday, October 17 or 18. Please complete the Doodle poll linked below not later than end of day on Sunday, October 15 so that a time can be identified that best meets team member availability. https://icannorg.doodle.com/poll/pdvu9kgtksumeefk Teams were formed using results from this week’s poll which can be found on the WG wiki. Every team includes: · At least one person from each of the perspectives named in the poll wherever possible, but without assigning members to more than one team. · A mix of members who have direct experience regarding the proposed purpose and those who have little or no experience about the proposed purpose. Remember that the purpose of this work is not to make decisions but rather to facilitate communication and understanding. The team is expected to deliver a one to two-page document to the full WG that will be used in our face to face meeting on Saturday, October 28 to help all WG members understand the applicable purpose. If you have any questions, please feel free to ask them on this list. Thanks in advance for completing the Doodle Poll promptly and for participating in our discussions starting today and in the days ahead. David Cake Drafting Team Coordinator

2 1