First, apologies for not responding to messages earlier – last week was the CA/Browser Forum meeting and too much travel.
Responses inline.
From: David Cake [mailto:dave@davecake.net]
Sent: Monday, March 5, 2018 8:35 PM
To: Kirk Hall <Kirk.Hall@entrustdatacard.com>
Cc: gnso-rds-pdp-3@icann.org
Subject: [EXTERNAL]Re: [Gnso-rds-pdp-3] added Kirk Hall/ RDS drafting team 3 / Reconvening Domain Name Certification team
Welcome Kirk to the drafting team, and the working group. Your expertise is very welcome.
On 6 Mar 2018, at 8:52 am, Kirk Hall <Kirk.Hall@entrustdatacard.com> wrote:
Hi, drafting team – I’m Kirk Hall, and I work on policy and compliance issues with Certification Authority Entrust Datacard (plus I’m a recovering lawyer). Before that I was with the CA GeoTrust (acquired by Symantec) and later started the CA AffirmTrust (acquired by Entrust Datacard). I’m currently serving as Chair of the CA/Browser Forum.
Marika Konings shared the drafting team memo “Domain Name Certification,” and it’s very good. I would just point out the WhoIs data is widely used by CAs for three different methods of domain confirmation – BR 3.2.2.4.1, .2, and .3 – and CAs and their website owner customers very much want the WhoIs information to continue to be available, as these three methods can be among the “easiest” for website owners, particularly enterprise owners with hundreds of domains.
That is close to our understanding, that WHOIS data is one of the methods used to demonstrate domain control.
Disputes in the working group have centered around issues of data exactly what constitutes legitimate data collection, and its implications. I think there is general agreement
that if the data is collected for some purpose (and while it is possible that some changes may take place, it seems likely that data of at least rough equivalence will be collected), it should be possible for it to be voluntarily used for Domain Certification
by those that wish it. Quite how we express that in terms of policy that appropriately translates to the GDPR etc is something we do not quite understand.
It sounds as if you agree with the drafting teams point that data for other certification purposes, eg EV certificates, needs to be sourced outside the RDS/ WHOIS system
in any case, and so is largely not relevant to working group discussion?
[KH] Complicated issue. First, use of WhoIs Registrant information (Method 1) for domain validation was eliminated in a recent ballot because some thought the method was not secure enough (we disagreed). But there
is discussion about bringing it back in a modified form.
Second, Method 1 was used for both OV and EV certs. It presents a great advantage for enterprises with hundreds of domains – if they are properly registered to the organization in WhoIs, and the CA has done the
identity and contact steps for the organization under BR 3.2.1 and 3.2.5, then the CA can issue (OV, EV, and even DV) certs for the customer simply by checking the Registrant in the WhoIs record. The domain owner is not required to do a “practical control”
test for the domain (pasting a Random Value received from the CA on a specified web page for the domain or in the DNS record, etc.), which many enterprises with servers around the world can find hard to do.
So in short, the WhoIs Registrant information was very useful to domain owners and CAs for all types of certs.
If these methods become unavailable because WhoIs-type data becomes unavailable, it will be much harder for many website owners to confirm their domains and obtain certificates to encrypt their websites – the other domain confirmation methods require active demonstrations of control of the domain like posting a unique Random Value supplied by the CA at a specific place on each of their websites, or in each of their DNS records for each domain. This will not be popular!
The various methods involving web or dns entries are notable in that they provide an alternative, but I think there is a general understanding that many people will prefer
to use the BR 3.2.2.4.x methods, and this should remain possible for those that wish it. Quite what that means at each stage of the policy process is not always clear.
[KH] WhoIs Registrant data is very useful for Methods 1 and 5 of BR 3.2.2.4.x, but as noted above have been (temporarily?) removed by a ballot of the Forum while modifications are being considered. We do need WhoIs
data for other methods that involve emailing the contact email addresses or using the telephone number of the Registrant in the WhoIs record for a domain.
I understand there are policy and legal reasons why Registrars/Registries may not want to display WhoIs data to the public – but would it be possible for each Registrar/Registry to “whitelist” all the commercial CAs so that they may have access to the data?
Some system should be possible, but the general question of how we validate/ certify access has not been addressed, and we don’t plan to get into that for a while. Hopefully
some fruitful discussions will take place at the face to face meeting - will you be there, Kirk?
I personally think the CAs getting the information will be a relatively easy case - clearly the applicants have assented, the list of authorized CAs should be fairly uncontroversial,
and if it is only the information required above that is needed, then it is a well defined list. This is much less controversial than some other data access issues we will need to address. But as I said, we aren’t quite at that point yet.
[KH] This was not discussed at the F2F meeting of the Forum last week, but I think all CAs are hoping/assuming they will have continued access to the data in some way in the future. I think there’s a general feeling
of, “Well, what is the data for if not to allow third parties a method for figuring out who owns the domain and how to contact them?” I think also that CAs generally feel that the current system, which allows a domain owner to opt out of public registration
and use private registration, is sufficient to deal with privacy concerns.
Let me know if you have any questions which commercial CAs can answer. I will be leading a face-to-face meeting of the CA/Browser Forum this Wednesday-Thursday in Washington, so it would be a good time to pull in the CAs and browsers on these issues.
Great. I think our main question at this point is essentially if any uses of WHOIS data outside the voluntary use of data for establishing domain control is needed.
[KH] I think you have captured the main issues, but CAs would prefer not to add an extra step of requiring customers to specifically open or authorize viewing of WhoIs data on a domain-by-domain basis to allow the
CA to validate the domains – in many cases, tens or hundreds of domains come up for re-validation at the same time, and it seems that extra steps to open the WhoIs data each time might be more than the CA and domain owner can do. That would likely push them
to some of the other methods that don’t use WhoIs data, but some of these methods have their own problems and/or vulnerabilities. (Methods 9 and 10 are limited in their permitted use right now because of security issues.)
Also, there is one implementation of Method 1 that was preserved by the Forum – where the CA is both the customer’s Registrar/Registry and also its CA. The CA can just look at its own registrar records to confirm
the customer owns the domain, then issue the certificate. I’m wondering if this implementation is consistent with the idea that all registrar/registry WhoIs data should be private?
David
Best regards.
Kirk Hall
Entrust Datacard
Chair, CA/Browser Forum
From: Gnso-rds-pdp-3 [mailto:gnso-rds-pdp-3-bounces@icann.org] On Behalf Of Terri Agnew
Sent: Monday, March 5, 2018 3:34 PM
To: gnso-rds-pdp-3@icann.org
Cc: gnso-secs@icann.org
Subject: [EXTERNAL][Gnso-rds-pdp-3] added Kirk Hall/ RDS drafting team 3 / Reconvening Domain Name Certification team
Hello RDS Drafting Team 3,
This is to inform you Kirk Hall has been added to the drafting team.
Welcome Kirk.
Thank you.
With kind regards,
Terri
---
Terri Agnew
Operations Support - GNSO Lead Administrator
Internet Corporation for Assigned Names and Numbers (ICANN)
Email: terri.agnew@icann.org
Skype ID: terri.agnew.icann
Find out more about the GNSO by taking our interactive courses and visiting the GNSO Newcomer pages
Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO
Follow the GNSO on Facebook: https://www.facebook.com/icanngnso/
_______________________________________________
Gnso-rds-pdp-3 mailing list
Gnso-rds-pdp-3@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-3