Policy-Discussion

["Greg Stark" <gstark AT electrorent.com>]

Where does the vote stand?

 

From: cacert-policy-bounces AT lists.cacert.org [mailto:cacert-policy-bounces AT lists.cacert.org] On Behalf Of Peter Williams
Sent: Tuesday, October 21, 2008 8:53 AM
To: Policy-Discussion
Subject: Re: [CAcert-Policy] CPS bugs. Vote please. Colosing date of votes21 October 12pm UTC

 

By the way, the verb confirmed is used as a subprocedure of validation:  checking the subscriber’s claim of a name, and the right to use said , is ”confirmation”

 

 

From what I recall, this had a basis in legal “acknowledgement” protocols. Acknowledgements are specific types of statements on which one may rely, with specifically limited legal semantics well suited to that “pre-acceptance” phase of the certification process.

 

 

From: Peter Williams [mailto:home_pw AT msn.com]
Sent: Monday, October 20, 2008 8:20 PM
To: 'Policy-Discussion'
Subject: RE: [CAcert-Policy] CPS bugs. Vote please. Colosing date of votes21 October 12pm UTC

 

 

The Mozilla CA Certificate Policy uses wording like 'We consider verification of certificate signing requests to be acceptable if it'
 

 

 

This is acceptable (if you are still ‘with’ the legal formalisms). A CSR is (self)signed. (a) you are thus properly ”verifying”, since it’s a signature. Second, in a semantic leap based on policy, a CSR is technically a prototype cert (in a non X.509 format) in some CPSs. Thus, “sponsored”  by an LRA (assurer in  CACert), and “subscribed to” by the user, it gets “validated” by a/the relying party known as a CA. During this act, there are validation procedures – such as EV. As a final step the IA component of a CA registers the cert, turning it from prototype/temp to accepted cert, at which point obligations  are passed to all types of relying party other than the CA and subscriber.

Ahem.

Yes, its legal bullshit. But, writing it is highly paid… and its author (not me) made over $50M. So…

 

Remember, if like VeriSign , you are going to warrant now over 25 billion dollars, you need a  strong basis to convince the “insurers”. Since one cannot issue US-style junk bonds to cover this kind of non-investment warranty, you have to go to pure risk markets, like Lloyds.