digitalist posted:

So I'm reading through the Globaltrust Certification Policy and, from what I understand it's just suppose to state "what" they do, and the Certification Policy Statement is where they demonstrate how they accomplish the what. I guess it makes it pretty dry reading, is there a matrix somewhere I could compare or check boxes to make sure they're at least covering the necessary bases?

Fascinating read. Curious to actually get into the meat of the matter, so off I went to find the GLOBALTRUST Certificate Security Policy, shouldn't this be called the Certification Policy Statement? Anyway, then I stumbled on this, which is actually on the first page or so of the Certification Policy document,

So, no information on what they're actually doing to ensure BR are being met is actually available to the public? Do I need to request it? Is that normal?

This all seems, bad.

quote:

Abstract
This document presents a framework to assist the writers of
certificate policies or certification practice statements for
participants within public key infrastructures, such as certification
authorities, policy authorities, and communities of interest that
wish to rely on certificates. In particular, the framework provides
a comprehensive list of topics that potentially (at the writer's
discretion) need to be covered in a certificate policy or a
certification practice statement. This document supersedes RFC 2527.

quote:

* The responsibility of a PKI participant to publish information
regarding its practices, certificates, and the current status of
such certificates, which may include the responsibilities of
making the CP or CPS publicly available using various mechanisms
and of identifying components, subcomponents, and elements of such
documents that exist but are not made publicly available, for
instance, security controls, clearance procedures, or trade secret
information due to their sensitivity;

quote:

Audits through external assessors are conducted on principle once a year
or as frequently as legally provided for or as provided for on the basis of
the documents named in  8. COMPLIANCE AUDIT AND OTHER
ASSESSMENTS / Prüfung der Konformität und andere Beurteilungen with
which this GLOBALTRUST Certificate Policy conforms.

Salt Fish posted:

I always had some sense that PKI depending on trusted root CAs was ripe for Bad Things to happen but I didn't expect multiple CAs to have worse security than my grandma's wordpress.

digitalist posted:

So I'm reading through the Globaltrust Certification Policy and, from what I understand it's just suppose to state "what" they do, and the Certification Policy Statement is where they demonstrate how they accomplish the what. I guess it makes it pretty dry reading, is there a matrix somewhere I could compare or check boxes to make sure they're at least covering the necessary bases?

digitalist posted:

Fascinating read. Curious to actually get into the meat of the matter, so off I went to find the GLOBALTRUST Certificate Security Policy, shouldn't this be called the Certification Policy Statement? Anyway, then I stumbled on this, which is actually on the first page or so of the Certification Policy document,

So, no information on what they're actually doing to ensure BR are being met is actually available to the public? Do I need to request it? Is that normal?

This all seems, bad.

digitalist posted:

Got a lot to learn about this,

CPS is actually Certification Practice Statement.

RFC 3647 is the document I was looking for,

https://datatracker.ietf.org/doc/html/rfc3647#section-4.2

I guess it makes some sense some of those technical controls might not be available, it could be exploited. But it does feel like there's a massive gulf between "we make sure our stuff won't be damaged by water" and information that would enable exploitation. I suppose this is something an audit would look at? It would be nice if they said somewhere under what conditions it would be made available, even if it's only to professional auditing firms.

Frequency of audits seems to be specified within the CPS, in globaltrust's case,

There were three audits conducted in 2023,


https://service.globaltrust.eu/static/conformity-assessment-2023.pdf


https://service.globaltrust.eu/static/conformity-assessment-seal-2023.pdf


https://www.a-sit.at/wp-content/uploads/2023/05/VIG-23-044_audit-attestation_globaltrust-etsi-2023_final_signed.pdf

So from my tiny research session, despite their CPS giving off first year university student writing an essay effort vibes, you could argue it's compliant. Except for the above, almost. By this time last year they had two audits completed, and in a month they will be past the one year mark from their most recent audit. But, the CPS says "annual" and I guess they could get away with an audit conducted in December of 2024, technically it would be annual.

Interesting start, will keep poking around but enough for this evening.

Wiggly Wayne DDS posted:

Chrome Root Program Policy: https://g.co/chrome/root-policy
- oh Chrome does say "an authoritative English language version"...

MononcQc posted:

Human health and safety are sometimes the responsibility of government agencies though.

Subjunctive posted:

the idea of safety-critical stuff depending on WebPKI is itself pretty worrying, speaking as someone who has had to consider “societal effects” when making decisions about how it is administered. I sort of feel that WebPKI should be declared explicitly as not being suitable for safety-critical applications, since it can’t feasibly provide the levels of reliability and availability that would be (IMO; never audited for it) appropriate for such uses

Subjunctive posted:

another option is to work with multiple CAs, ideally for certs with out-of-phase lifetimes, so that if something fucks up with one CA you’re ready to go on your “hot spare”. you can also run replacement drills between the cert sets at low risk because if you miss one it’s still got something valid while you clean up

that’s how all the tech majors run, because FB’s web certs getting blown away literally stops the business (as has happened a couple of times for short time periods)

Subjunctive posted:

another option is to work with multiple CAs, ideally for certs with out-of-phase lifetimes, so that if something fucks up with one CA you’re ready to go on your “hot spare”. you can also run replacement drills between the cert sets at low risk because if you miss one it’s still got something valid while you clean up

that’s how all the tech majors run, because FB’s web certs getting blown away literally stops the business (as has happened a couple of times for short time periods)

digitalist posted:

Yeah this is a good point, sadly I'm not sure our government has this contingency accounted for, but what do I know. I did some googling last night on governments and whether or not they ran their own CAs which would seem logical, whatever cost of operating one could be offset by not paying someone else to do it and it could offer more agility/independence or something along those lines. I saw a few countries do, Italy, Netherlands, Estonia, USA (as mentioned).

edit: Estonia also issued every citizen a certificate for its interactions with the government which seemed interesting, I don't really know much more than that about it but yeah, seems natural if digitizing? Digitalisierung of governments is a goal

quote:

A CP is represented in a certificate by a unique number called an "Object Identifier" (OID). That OID, or at least an "arc", can be registered. An "arc" is the beginning of the numerical sequence of an OID and is assigned to a particular organization. The registration process follows the procedures specified in ISO/IEC and ITU standards. The party that registers the OID or arc also can publish the text of the CP, for examination by relying parties. Any one certificate will typically declare a single CP or, possibly, be issued consistent with a small number of different policies. Such declaration appears in the Certificate Policies extension of a X.509 Version 3 certificate. When a CA places multiple CPs within a certificate's Certificate Policies extension, the CA is asserting that the certificate is appropriate for use in accordance with any of the listed CPs.

quote:

The CP and CPS address the same set of topics that are of interest to the relying party in terms of the degree to and purpose for which a public key certificate should be trusted. Their primary difference is in the focus of their provisions. A CP sets forth the requirements and standards imposed by the PKI with respect to the various topics. In other words, the purpose of the CP is to establish what participants must do. A CPS, by contrast, states how a CA and other participants in a given domain implement procedures and controls to meet the requirements stated in the CP. In other words, the purpose of the CPS is to disclose how the participants perform their functions and implement controls.

...

The main differences between CPs and CPSs can therefore be summarized as follows:

(a) A PKI uses a CP to establish requirements that state what participants within it must do. A single CA or organization can use a CPS to disclose how it meets the requirements of a CP or how it implements its practices and controls.

(b) A CP facilitates interoperation through cross-certification, unilateral certification, or other means. Therefore, it is intended to cover multiple CAs. By contrast, a CPS is a statement of a single CA or organization. Its purpose is not to facilitate interoperation (since doing so is the function of a CP).

(c) A CPS is generally more detailed than a CP and specifies how the CA meets the requirements specified in the one or more CPs under which it issues certificates.

Subjunctive posted:

no, I think there are different ways that a CA might implement the necessary controls, which are generally specified as policy and not mechanism of enforcement

similarly to PCI or SOC2 in that sense

digitalist posted:

An enforced CP/CPS structure seems self evident, there's nothing unique about the technical or physical controls necessary for a PKI to do its job adequately, having each come up with on their own and define it in a CP seems like inviting trouble. Have a list of pre defined certification policy elements with matching OIDs and then maybe you can just do away with "unique" CPs entirely in a sense, just have one master CP administered by the root CAs and CPS can refer just refer to specific CP OIDs and how they manage them.

I just got here so I'm probably stating things that are plainly obvious and are already in motion if a more regulated CP/CPS is being tabled but it's hard to ignore how disorganized the current structure is.

quote:

Effective 2024-09-15, the Certificate Policy and/or Certification Practice Statement MUST be structured in accordance with section 6 of RFC 3647 and MUST:
* include at least every section and subsection defined in section 6 of RFC 3647;
* only use the words "No Stipulation" to mean that the particular document imposes no requirements related to that section; and
* contain no sections that are blank and have no subsections.

quote:

16 Note: Although RFC 5280 specifies the upper bound as 32,768 characters, this was a transcription error from X.520 (08/2005). The effective (interoperable) upper bound is 64 characters

Wiggly Wayne DDS posted:

i'm still amused at them tying themselves down to specification x.520 and not clarifying which version when that body could update the document tomorrow and make every CA non-compliant. they've built a house of cards relying on superseding authorities they have no control over

Wiggly Wayne DDS posted:

e: i mean hell this is still in br 2.0.3:

digitalist posted:

Wiggly Wayne DDS posted:

i really feel that no one involved in the cabforum has done any regulatory work at all and they're just trying to poorly emulate how they think it all works in other fields.

digitalist posted:

Wayne, how do you keep your notes organized?

Wiggly Wayne DDS posted:

otherwise, i have a memory

Wiggly Wayne DDS posted:

otherwise, i have a memory