Re: [Bimi] Where do the signed certificates come from?

Here are a few more tidbits on Verified Mark Certificates and their relationship to BIMI.  Some on the list will not have been close to their development over the last year.  

Highlights: 

* Verified Mark Certificates are designed to be compatible with BIMI's publishing and discovery mechanisms and anticipated uses with email, OATH, and social media.  However, VM Certs are not tied to BIMI in any way, nor does BIMI itself require domain registrants to obtain them 

* issued VM Certs must be published in well-known Certificate Transparency (CT) logs in order to be considered valid.  The CT entry must include all material contents of the cert, allowing review.  

* VM Certs are issued by intermediates which are dedicated to the issuance of VM Certs, and distinct from TLS intermediates.  

* we anticipate that some 'Consuming Entities' (parties offering services which partially or heavily rely upon VM Certificates) will operate their own VM Certificate "root programs".  These are analogous to TLS "root programs"

* VM Certs require f2f verification, subject to a sunset provision 

* While a VM Cert can contain a signed public key of the certificate Applicant, the certificate is not for server identification as with EV, and has a different EKU.  The important components of the cert are instead a list of FQDNs, the legal entity identifying information, the embedded logo, and the trademark registration and jurisdiction information which substantiate the Applicant's rights rights to the logo 

* the initial draft defined a set of acceptable vetting methods.  We would like over time to define other acceptable vetting methods suitable for situations beyond the one where the Applicant holds the registration of the mark directly 

* latest draft for reference (as Seth referenced previously) is here: https://docs.google.com/document/d/10IzxkdrveDazBAvTvOUa9uCIDBwMkdmluwHEcbja42w

Thede

--
Thede Loder
Managing Director, Skye Logicworks LLC
E: thede@skyelogicworks.com
M: 415-420-8615

> On Feb 11, 2019, at 01:19, Wei Chuang <weihaw=40google.com@dmarc.ietf.org> wrote:
> 
> 
> 
> On Sun, Feb 10, 2019 at 8:39 PM John R Levine <johnl@taugh.com <mailto:johnl@taugh.com>> wrote:
> BIMI appears to assume that senders will have TLS certificates
> 
> BIMI (sometimes documented as Verified Mark) certificates should be considered a different PKI than TLS certificates.  The certificates have a distinguishing Extended Key Usage for this.
>  
> that include 
> RFC6170 certificate images, signed by a CA that attests that the image is a 
> logo that belongs to the same entity as the domain name in the certificate.
> 
> Is this supposed to be a DV, EV, or some other kind of certificate?
> 
> The proposed validation as documented in the guidelines (see Seth Blank's Feb 6th post) builds upon web EV but of course includes a logo (and optionally name) validation that goes beyond what is done for web EV.
>  
>   Are there 
> any CAs that will do the logo attestation?
> 
> We (Authindicators WG) have been working with Entrust-Datacard on the Guidelines, and they are willing to do this logo attestation.  We also are talking with other CAs, and believe that at least one other is willing.  
>  
> Logos, like all trademarks, have geographic scope, and it's not rare for a 
> trademark and logo to belong to one company in, say, the US and a different one 
> in Europe.  How will that work?
> 
> There is a trademark registration country/region level jurisdiction field.  Currently the guideline specification only allows for a single jurisdiction..  One open question is whether to specify multiple jurisdiction in a single cert and another is how to do this.  (There are some compounding issues in this space that make this potentially challenging)  That's something I hope the IETF can help with.
> 
> -Wei
>  
>   I don't think there's any way for a cert to 
> say it's only valid in some countries.
> 
> Regards,
> John Levine, johnl@iecc..com <mailto:johnl@iecc.com>, Primary Perpetrator of "The Internet for Dummies",
> Please consider the environment before reading this e-mail. https://jl.ly <https://jl.ly/>
> 
> -- 
> bimi mailing list
> bimi@ietf.org <mailto:bimi@ietf.org>
> https://www.ietf.org/mailman/listinfo/bimi <https://www.ietf.org/mailman/listinfo/bimi>
> -- 
> bimi mailing list
> bimi@ietf.org
> https://www.ietf.org/mailman/listinfo/bimi