Subject: Re: The new High Assurance SSL Certificates

From: "Aisenberg, Michael" <[email-masked]>
Date: Mon, 16 Jan 2006 11:01:43 -0500

Joel
Thanks for pointing out that this discussion is around Organizational certs, obtained from C/As by entities seeking to do business over the Net with consumers. Mediated by the browsers, these engagements are the ones where the consumers' understanding of the assurances being made (by the organization itelf,  by the  C/A, and (transitively ?) by the browser-chrome) are what is "at issue".  Under discussion in the C/A community is the ? of the means to best express a strong (more paper world-like) level of CA dilligence regarding the  identity attributes of the organizational subjects of these SSL certificates.  This is a process ...really, 2 processes. 1) attribute vetting by the CAs and 2) attribute display ("communication") in the browser, discernable and understandable to the consumer/user.  Another "process" ("labour") is the intra industry saga of reaching consensus on How and Where to do this (standards body, industry assn.) and then doing it...Promptly.

Michael

 -----Original Message-----
From: 	Joel S. Kazin [mailto:[email-masked]]
Sent:	Mon Jan 16 10:49:09 2006
To:	Jeffrey I. Schiller; Anders Rundgren
Cc:	[email-masked]
Subject:	Re: The new High Assurance SSL Certificates

As discussed at the October 2005 ABA ISC meeting, a HCA does not address 
the handling of a consumer's personal information.

----System Information
Platform: Windows 2000
Machine Type: Intel
System Version: 5.00.2195
Processor: Pentium II or III Model 8, Stepping 6
Physical RAM Installed: 261532 Kb
Eudora: Version 5.1
Mode: Sponsored Mode
Registration #:
MSHTML Version: 6.00
WININET Version: 6.00

At 04:37 PM 1/14/2006 -0500, Jeffrey I. Schiller wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>I apologize, as I am joining this thread a little late.... and I haven't
>had time to read every single message.
>
>That said, I believe the issue of a High Assurance CA (HCA) isn't
>ensuring that private keys are properly protected (not that it isn't
>important), but ensuring that when consumers go to a site signed by a
>High Assurance CA, that they know they can trust it to properly handle
>their personal information. This is a much broader problem.
>
>To me this means that when AOL.COM goes to a HCA to obtain a certificate
>they get it. But when AO1.COM attempts to apply for one they are denied.
>
>The trick is how do you do this. If I start a company named ?AO1
>Vacuums? and have the legal right to use ?AO1? in my name, how can
>another company (or oligarchy) deny me the right to have my customers
>trust my website? Perhaps what is needed is legal language that let's
>AO1.COM obtain a certificate provided they agree to not intentionally
>attempt to confuse people into believing that they are AOL.COM. I'll
>leave it to the lawyers to figure out the language that accomplishes
>this goal.
>
>So now the real problem is revocation. If AO1.COM obtains a HCA
>certificate and turns out to be a bad actor, there needs to be an
>effective way of revoking their certificate. We don't have a deployed
>mechanism today. Perhaps this is what we need from a technical perspective.
>
>                         -Jeff
>
>- --
>=============================================================================
>Jeffrey I. Schiller
>MIT Network Manager
>Information Services and Technology
>Massachusetts Institute of Technology
>77 Massachusetts Avenue  Room W92-190
>Cambridge, MA 02139-4307
>617.253.0161 - Voice
>[email-masked]
>============================================================================
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.1 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
>iD8DBQFDyW7+8CBzV/QUlSsRAkqYAKDWtkD0OQ6UDGCKGUz3buS6z2OdfgCg5W0H
>Dhey/w4/bCR1dvDqjduKpzo=
>=mED5
>-----END PGP SIGNATURE-----

Joel S. Kazin CPA, CISA, CISSP, CISM
Senior Consultant
Atos Origin
40 Old Sleepy Hollow Road
Pleasantville, New York 10570-3802
USA
Phone  +1 914-769-8780
Mobile  +1 914-564-1484
email    [email-masked]
www.atosorigin.com

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 16 Jan 2006 11:57:42 -0800

At 11:01 AM -0500 1/16/06, Aisenberg, Michael wrote:
>Another "process" ("labour") is the intra industry saga of reaching 
>consensus on How and Where to do this (standards body, industry 
>assn.) and then doing it...Promptly.

I will repeat my earlier question, maybe a bit more pointed at the 
VeriSign folks on the list:

What is the difference between VeriSign high assurance and VeriSign 
low assurance certificates? If a developer can't answer the question, 
then the app doesn't need to differentiate.

That is, if the developer cannot describe to the user what the 
difference between two types of certificates is, the application 
should not differentiate them to the user. Making one "green" and one 
"not green" is a particularly bad method without an explanation.

--Paul Hoffman, Director
--VPN Consortium

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 18 Jan 2006 22:23:08 +1300

Paul Hoffman <[email-masked]> writes:

>What is the difference between VeriSign high assurance and VeriSign low
>assurance certificates? If a developer can't answer the question, then the
>app doesn't need to differentiate.

With the HA certs you have a high level of assurance that the cert owner paid
more for them, thus indicating that they were more serious about obtaining a
cert than a LA cert owner.

Peter.