|
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
|
|
|
|
<html><head>
|
|
|
|
|
<meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8"><title>Assurance Policy</title>
|
|
|
|
|
|
|
|
|
|
<meta name="CREATED" content="20080530;0">
|
|
|
|
|
<meta name="CHANGEDBY" content="Teus Hagen">
|
|
|
|
|
<meta name="CHANGED" content="20080709;12381800">
|
|
|
|
|
<meta name="CREATEDBY" content="Ian Grigg">
|
|
|
|
|
<meta name="CHANGEDBY" content="Teus Hagen">
|
|
|
|
|
<meta name="CHANGEDBY" content="Robert Cruikshank">
|
|
|
|
|
<meta name="CHANGEDBY" content="Teus Hagen">
|
|
|
|
|
<style type="text/css">
|
|
|
|
|
<!--
|
|
|
|
|
P { color: #000000 }
|
|
|
|
|
TD P { color: #000000 }
|
|
|
|
|
H1 { color: #000000 }
|
|
|
|
|
H2 { color: #000000 }
|
|
|
|
|
DT { color: #000000 }
|
|
|
|
|
DD { color: #000000 }
|
|
|
|
|
H3 { color: #000000 }
|
|
|
|
|
TH P { color: #000000 }
|
|
|
|
|
-->
|
|
|
|
|
</style></head>
|
|
|
|
|
<body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB">
|
|
|
|
|
<h1>Assurance Policy for CAcert Community Members</h1>
|
|
|
|
|
<p><a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" name="graphics1" alt="CAcert Policy Status" align="bottom" border="0" height="33" width="90"></a>
|
|
|
|
|
<br>
|
|
|
|
|
Author: Ian Grigg<br>
|
|
|
|
|
Creation date: 2008-05-30<br>
|
|
|
|
|
Last change by: Teus Hagen<br>
|
|
|
|
|
Last change date: 2008-07-07 15:03 MET<br>
|
|
|
|
|
Status: WIP 2008-05-30<br>
|
|
|
|
|
Next status: DRAFT June 2008 </p>
|
|
|
|
|
<h2>0. Preamble</h2>
|
|
|
|
|
<p>Definitions of terms: </p>
|
|
|
|
|
<dl>
|
|
|
|
|
<dt><i>Member</i> </dt>
|
|
|
|
|
<dd> A Member is an individual who has agreed to the CAcert
|
|
|
|
|
Community Agreement (<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php" target="_blank">CCA</a>) and has created successfully
|
|
|
|
|
a CAcert login account on the CAcert web site. </dd>
|
|
|
|
|
<dt> <i>Assurance</i> </dt>
|
|
|
|
|
<dd> Assurance is the process by which a Member of CAcert
|
|
|
|
|
Community (Assurer) identifies an individual (<span lang="en-US">Assuree</span>).
|
|
|
|
|
</dd>
|
|
|
|
|
<dt> <i>Prospective Member</i> </dt>
|
|
|
|
|
<dd> An individual who has been assured in an Assurance
|
|
|
|
|
process, but has not yet created successfully a CAcert login account. </dd>
|
|
|
|
|
<dt> <i>Name</i> </dt>
|
|
|
|
|
<dd> A Name is the full name of an individual, with all
|
|
|
|
|
components of that name.</dd>
|
|
|
|
|
<dd> (Title(s), first name(s), family name(s), name extensions,
|
|
|
|
|
abbreviation of name(s), etc. <br>
|
|
|
|
|
The Name is technically spoken a string exactly taken e.g. from a
|
|
|
|
|
governmental issued photo ID.) </dd>
|
|
|
|
|
<dt> <i>Secondary Distinguishing Feature</i>
|
|
|
|
|
(DoB) </dt>
|
|
|
|
|
<dd> A Name for an individual is discriminated from similar
|
|
|
|
|
full names by a secondary distinguished feature, as recorded on the
|
|
|
|
|
on-line CAcert (web) account. <br>
|
|
|
|
|
(Currently this is the date of birth (DoB) of the individual. )</dd>
|
|
|
|
|
</dl>
|
|
|
|
|
<h3>
|
|
|
|
|
The CAcert Web of Trust</h3>
|
|
|
|
|
<p>At each Assurance one allocates a number of Assurance Points,
|
|
|
|
|
applied to the assured Member. By combining the Assurances, and the
|
|
|
|
|
Assurance Points, CAcert constructs a global <i>Web-of-Trust</i>
|
|
|
|
|
or
|
|
|
|
|
"WoT". </p>
|
|
|
|
|
<p>CAcert explicitly chooses to meet its various goals by
|
|
|
|
|
construction of a Web-of-Trust of all Members. This is done by
|
|
|
|
|
face-to-face meetings, identifying and sharing claims in a network.
|
|
|
|
|
Maintaining a sufficient strength for the Web-of-Trust is a
|
|
|
|
|
high-level objective of the Assurance process. </p>
|
|
|
|
|
<h3>Related Documentation</h3>
|
|
|
|
|
<p>Documentation on Assurance is split between this Assurance
|
|
|
|
|
Policy
|
|
|
|
|
(AP) and the <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance
|
|
|
|
|
Handbook</a>. The policy is controlled by Configuration Control
|
|
|
|
|
Specification (<a href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification" target="_blank">CCS</a>)
|
|
|
|
|
under Policy on Policy (<a href="http://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>)
|
|
|
|
|
policy document regime.<br>
|
|
|
|
|
Because Assurance is an active area, much
|
|
|
|
|
of the practice is handed over to the Assurance Handbook, which is
|
|
|
|
|
not a controlled policy document, and can more easily respond to
|
|
|
|
|
experience and circumstances. It is also more readable. </p>
|
|
|
|
|
<p>See also Organisation Assurance Policy (<a href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php" target="_blank">OAP</a>)
|
|
|
|
|
and CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>).
|
|
|
|
|
</p>
|
|
|
|
|
<h2>1. Assurance Purpose</h2>
|
|
|
|
|
<p>The purpose of Assurance is to add confidence
|
|
|
|
|
in the Assurance Statement made by the CAcert Community of a Member. </p>
|
|
|
|
|
<p>With sufficient assurances, a Member may: (a) issue
|
|
|
|
|
certificates
|
|
|
|
|
with their assured Name included, (b) participate in assuring others,
|
|
|
|
|
and (c) other related activities. The strength of these activities is
|
|
|
|
|
based on the strength of the assurance. </p>
|
|
|
|
|
<h3>The Assurance Statement</h3>
|
|
|
|
|
<p>The following claims can be made about a person who is
|
|
|
|
|
assured: </p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The person is a bona fide Member. In other words, the
|
|
|
|
|
person is a member of the CAcert Community as defined by the CAcert
|
|
|
|
|
Community Agreement (<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php" target="_blank">CCA</a>); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The Member has a (login) account with CAcert's on-line
|
|
|
|
|
registration and service system; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The Member can be determined from any CAcert certificate
|
|
|
|
|
issued by the Account; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The Member is bound into CAcert's Arbitration as defined
|
|
|
|
|
by the Community Agreement; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Some personal details of the Member are known to CAcert:
|
|
|
|
|
the individual Name(s), primary and other listed individual email
|
|
|
|
|
address(es), secondary distinguished feature (e.g. DoB). </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p>The confidence level of the Assurance Statement is expressed
|
|
|
|
|
by
|
|
|
|
|
the Assurance Points. </p>
|
|
|
|
|
<h3>Relying Party Statement</h3>
|
|
|
|
|
<p>The primary goal of the Assurance Statement is for the express
|
|
|
|
|
purpose of certificates to meet the needs of the <i>Relying
|
|
|
|
|
Party
|
|
|
|
|
Statement</i>, which latter is found in the Certification
|
|
|
|
|
Practice
|
|
|
|
|
Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>).
|
|
|
|
|
</p>
|
|
|
|
|
<p>When a certificate is issued, some of the Assurance Statement
|
|
|
|
|
may
|
|
|
|
|
be incorporated, e.g. Name. Other parts may be implied, e.g.
|
|
|
|
|
Membership, exact account and status. They all are part of the
|
|
|
|
|
<i>Relying Party Statement</i>. In short, this means that
|
|
|
|
|
other
|
|
|
|
|
Members of the Community may rely on the information verified by
|
|
|
|
|
Assurance and found in the certificate. </p>
|
|
|
|
|
<p>In particular, certificates are sometimes considered to
|
|
|
|
|
provide
|
|
|
|
|
reliable indications of e.g. the Member's Name and email address. The
|
|
|
|
|
nature of Assurance, the number of Assurance Points, and other
|
|
|
|
|
policies and processes should be understood as limitations on any
|
|
|
|
|
reliance. </p>
|
|
|
|
|
<h2>2. The Member</h2>
|
|
|
|
|
<h3>2.1 The Name in the CAcert login account</h3>
|
|
|
|
|
<p lang="en-AU">At least one individual Name is recorded
|
|
|
|
|
in the
|
|
|
|
|
CAcert login account. The Name is recorded as a string of characters,
|
|
|
|
|
encoded in <span lang="en-US">unicode</span>
|
|
|
|
|
transformation format.</p>
|
|
|
|
|
<p lang="en-AU">A Name should be as fully written in a
|
|
|
|
|
government-issued identity document (ID). A Name should be as
|
|
|
|
|
complete as possible, that is not abbreviated, no transliteration of
|
|
|
|
|
characters in the Name.</p>
|
|
|
|
|
<p lang="en-AU">A Name in the CAcert login account, which
|
|
|
|
|
has reached
|
|
|
|
|
the applicable level of 50 Assurance Point is defined as an Assured
|
|
|
|
|
Name. An Assured Name can be used in a certificate issued by CAcert.
|
|
|
|
|
A Member with at least one Assured Name has reached the Assured
|
|
|
|
|
Member status.</p>
|
|
|
|
|
<h3>2.2. Multiple Names and variations</h3>
|
|
|
|
|
<p>A Member may have multiple Names or multiple variations of a
|
|
|
|
|
Name.
|
|
|
|
|
For example, married name, variations of initials of first or middle
|
|
|
|
|
names, abbreviation of a first name, different language or country
|
|
|
|
|
variations and transliterations of characters in a name.</p>
|
|
|
|
|
<p>The login account may record multiple Names. Each of the
|
|
|
|
|
Assured
|
|
|
|
|
Names can be selected to be used in a certificate issued by CAcert.</p>
|
|
|
|
|
<!--
|
|
|
|
|
FOLLOWING GOES TO ASSURER HANDBOOK
|
|
|
|
|
<h3>Comparison of names</h3>
|
|
|
|
|
<p><a href="http://en.wikipedia.org/wiki/Transliteration" target="_blank">Transliteration</a>
|
|
|
|
|
of characters as defined in the transliteration character table (<a href="http://svn.cacert.org/CAcert/Policies/transtab.utf" target="_blank">UTF
|
|
|
|
|
Transtab</a>) for names is permitted, but the result must be
|
|
|
|
|
7-bit
|
|
|
|
|
ASCII for the full name. Transliteration is one way and is towards
|
|
|
|
|
7-bit ASCII. Transliteration is a way to compare two names. However
|
|
|
|
|
transliteration of a Name makes the Name less discriminative.</p>
|
|
|
|
|
<p>In general names are handled case insensitively.</p>
|
|
|
|
|
<p>Abbreviation of second given name(s), middle name(s),
|
|
|
|
|
titles and name extensions in the name of an individual to one
|
|
|
|
|
character and the dot indicating the abbreviation, is permitted. If
|
|
|
|
|
the first given name in the ID document is abbreviated, the first
|
|
|
|
|
given name in the web account Name may be abbreviated. Abbreviation
|
|
|
|
|
of a name makes the name less discriminative.</p>
|
|
|
|
|
<p>A Name on an ID which has initials (abbreviations) for
|
|
|
|
|
titles, name extensions and given names, and/or transliterations as
|
|
|
|
|
defined in the transliteration table can be taken into account for
|
|
|
|
|
assurance for a Name in the account which is not abbreviated or
|
|
|
|
|
transliterated.</p>
|
|
|
|
|
<p>Titles and name extensions in the name of an individual
|
|
|
|
|
may be omitted.</p>
|
|
|
|
|
<p>The assurance ambition is to pursue
|
|
|
|
|
a highly discriminative assured Name in the account. The ambition is
|
|
|
|
|
to have only a Name in the account which has no abbreviation(s), no
|
|
|
|
|
transliteration and is case sensitive.</p>
|
|
|
|
|
|
|
|
|
|
FOLLOWING GOES TO Certficate Implementation Policy
|
|
|
|
|
<h3>Names on the certificate issued by CAcert</h3>
|
|
|
|
|
<p>The Certificate Implementation Policy (<a href="http://svn.cacert.org/CAcert/Policies/CertificateImplementationPolicy.html" target="_blank">CIP</a>)
|
|
|
|
|
will define the fields added by CAcert on the issued certificate on
|
|
|
|
|
request of the Member.</p>
|
|
|
|
|
<p>The Common Name and related certificate fields in the
|
|
|
|
|
issued certificate is dependent on the assurance of the Name in the
|
|
|
|
|
web account. Abbreviation and transliteration handling in the CN is
|
|
|
|
|
defined in the Certificate Implementation Policy and is similar to
|
|
|
|
|
the name comparison as defined in this policy. However the Common
|
|
|
|
|
Name may become less discriminative as than
|
|
|
|
|
the assured Name as the unique certificate serial number will lead to
|
|
|
|
|
the account of the individual in a unique way, and in this way to the
|
|
|
|
|
Name and email address of the individual or organisation. The first
|
|
|
|
|
given name in the Common Name may be abbreviated on request.</p>
|
|
|
|
|
<p>The certificate issued by CAcert can have on request of
|
|
|
|
|
the Member the SubjAltName field. The name as defined by the Member
|
|
|
|
|
is not checked by CAcert.</p>
|
|
|
|
|
<table border="1" cellpadding="2" cellspacing="0">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<th width="25%">
|
|
|
|
|
<p><i>name on the ID</i></p>
|
|
|
|
|
</th>
|
|
|
|
|
<th width="25%">
|
|
|
|
|
<p><i>assured Name in the account</i></p>
|
|
|
|
|
</th>
|
|
|
|
|
<th width="25%">
|
|
|
|
|
<p><i>name in the certificate request</i></p>
|
|
|
|
|
</th>
|
|
|
|
|
<th width="25%">
|
|
|
|
|
<p><i>name on the issued certificate</i></p>
|
|
|
|
|
</th>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Maria Kate Märvel-Java </p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Maria K. Maervel-Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>M. K. Märvel-Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Maria K. Maervel-Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p>prof. dr. John K. Marvel</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>John K. Marvel</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>John K. Marvel</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>John K. Marvel</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Moeria Koete v. Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Möria Kœté von Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Möria K. v. Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Möria K. v. Java</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Jamé de Häring sr</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Jame de Haering</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>J. d. Häring</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>J. d. Haering</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p>Jame d. Haering sr</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>dr Jamé de Häring</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>John de Haering</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p>dr Jamé de Häring</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
|
|
|
|
</table>
|
|
|
|
|
<p align="center"><font size="2">table
|
|
|
|
|
Examples of names in
|
|
|
|
|
different contexts</font></p>
|
|
|
|
|
-->
|
|
|
|
|
<h3>2.3. Status and Capabilities</h3>
|
|
|
|
|
<p>A Member has the following capabilities derived from
|
|
|
|
|
Assurance: </p>
|
|
|
|
|
<table border="1" cellpadding="5" cellspacing="0">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="10%">
|
|
|
|
|
<p align="left"><i>Minimum Assurance Points</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
<td width="15%">
|
|
|
|
|
<p align="left"><i>Capability</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
<td width="15%">
|
|
|
|
|
<p align="left"><i>Status</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
<td width="60%">
|
|
|
|
|
<p align="left"><i>Comment</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr valign="top">
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">0</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Request Assurance</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Prospective Member</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Individual taking part of an
|
|
|
|
|
Assurance, who does not have created a CAcert login account (yet). The
|
|
|
|
|
allocation of Assurance Points is awaiting login account creation.</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr valign="top">
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">0</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">request unnamed certificates</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Member</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Although the Member's details are
|
|
|
|
|
recorded in the account, they are not highly assured.</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr valign="top">
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">50</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">request named certificates</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Assured Member</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Statements of Assurance: the Name is
|
|
|
|
|
assured to 50 Assurance Points or more</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr valign="top">
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">100</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">become an Assurer</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Prospective Assurer</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="left">Assured to 100 Assurance Points (or
|
|
|
|
|
more) on at least one Name, and passing the Assurer Challenge.</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
|
|
|
|
</table>
|
|
|
|
|
<p align="center"><font size="2"><i>table
|
|
|
|
|
Assurance Capability</i></font></p>
|
|
|
|
|
<p>A Member may check the status of another Member, especially
|
|
|
|
|
for an
|
|
|
|
|
assurance process.</p>
|
|
|
|
|
<p>The CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>)
|
|
|
|
|
and other policies may list other capabilities that rely on Assurance
|
|
|
|
|
Points. </p>
|
|
|
|
|
<h2>3. The Assurer</h2>
|
|
|
|
|
<p>An Assurer is a Member with the following: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Is assured to a minimum of 100 Assurance Points; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Has passed the CAcert Assurer Challenge. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>The Assurer Challenge is administered by the Education Team on
|
|
|
|
|
behalf of the Assurance Officer. </p>
|
|
|
|
|
<h3>The Obligations of the Assurer</h3>
|
|
|
|
|
<p>The Assurer is obliged to: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Follow this Assurance Policy; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Follow any additional rules of detail laid out by the
|
|
|
|
|
CAcert Assurance Officer; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Be guided by the CAcert <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance Handbook</a> in their
|
|
|
|
|
judgement; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Make a good faith effort at identifying and verifying
|
|
|
|
|
Members; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Maintain the documentation on each Assurance; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Deliver documentation to Arbitration, or as otherwise
|
|
|
|
|
directed by the Arbitrator; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Keep up-to-date with developments within the CAcert
|
|
|
|
|
Community. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<h2>4. The Assurance</h2>
|
|
|
|
|
<h3>4.1. The Assurance Process</h3>
|
|
|
|
|
<p>The Assurer conducts the process of Assurance with each
|
|
|
|
|
Member. </p>
|
|
|
|
|
<p>The process consists of: </p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Voluntary agreement by both Assurer and Member or
|
|
|
|
|
Prospective Member to conduct the Assurance; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Personal meeting of Assurer and Member or Prospective
|
|
|
|
|
Member; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Recording of essential details on CAcert Assurance
|
|
|
|
|
Programme form; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Examination of Identity documents by Assurer and
|
|
|
|
|
verification of recorded details (the Name(s) and Secondary
|
|
|
|
|
Distinguishing Feature, e.g., DoB); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Allocation of Assurance Points by Assurer; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Optional: supervision of reciprocal Assurance made by
|
|
|
|
|
Assuree (Mutual Assurance); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Safe keeping of the CAcert Assurance Programme (<a href="http://www.cacert.org/cap.php" target="_blank">CAP</a>)
|
|
|
|
|
forms by Assurer. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<h3>4.2. Mutual Assurance</h3>
|
|
|
|
|
<p>Mutual Assurance follows the principle of reciprocity. This
|
|
|
|
|
means
|
|
|
|
|
that the Assurance may be two-way, and that each member participating
|
|
|
|
|
in the Assurance procedure should be able to show evidence of their
|
|
|
|
|
identity to the other. </p>
|
|
|
|
|
<p>In the event that an Assurer is assured by a Member who is not
|
|
|
|
|
certified as an Assurer, the Assurer supervises the Assurance
|
|
|
|
|
procedure and process, and is responsible for the results. </p>
|
|
|
|
|
<p>Reciprocity maintains a balance between the (new) member and
|
|
|
|
|
the
|
|
|
|
|
Assurer, and reduces any sense of power. It is also an important aid
|
|
|
|
|
to the assurance training for future Assurers. </p>
|
|
|
|
|
<h3>4.3. Evidence of Assurer status</h3>
|
|
|
|
|
<p>On the question of providing evidence that one is an Assurer,
|
|
|
|
|
CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm#p3.2" target="_blank">CPS</a>)
|
|
|
|
|
says:<i> "The level at which each Member is Assured is public
|
|
|
|
|
data. The number of Assurance Points for each Member is not
|
|
|
|
|
published.</i>.".</p>
|
|
|
|
|
<h3>4.4. Assurance Points</h3>
|
|
|
|
|
<p>The Assurance applies Assurance Points to each Member which
|
|
|
|
|
measure the increase of confidence in the Statement (above).
|
|
|
|
|
Assurance Points should not be interpreted for any other purpose.
|
|
|
|
|
Note that, even though they are sometimes referred to as <i>Web-of-Trust</i>
|
|
|
|
|
(Assurance) Points, or <i>Trust</i> Points, the meaning
|
|
|
|
|
of the word
|
|
|
|
|
'Trust' is not well defined. </p>
|
|
|
|
|
<p><i>Assurance Points Allocation</i><br>
|
|
|
|
|
An Assurer can allocate a
|
|
|
|
|
number of Assurance Points to the Member according to the Assurer's
|
|
|
|
|
experience (Experience Point system, see below). The allocation of
|
|
|
|
|
the maximum means that the Assurer is 100% confident in the
|
|
|
|
|
information presented: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Detail on form, system, documents, person in accordance; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Sufficient quality identity documents have been checked; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Assurer's familiarity with identity documents; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The Assurance Statement is confirmed. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>Any lesser confidence should result in less Assurance Points
|
|
|
|
|
for a
|
|
|
|
|
Name. If the Assurer has no confidence in the information presented,
|
|
|
|
|
then <i>zero </i>Assurance Points may be allocated by
|
|
|
|
|
the Assurer.
|
|
|
|
|
For example, this may happen if the identity documents are totally
|
|
|
|
|
unfamiliar to the Assurer. The number of Assurance Points from <i>zero</i>
|
|
|
|
|
to <i>maximum </i>is guided by the Assurance Handbook
|
|
|
|
|
and the
|
|
|
|
|
judgement of the Assurer. </p>
|
|
|
|
|
<p>Multiple Names should be allocated separately in a single
|
|
|
|
|
Assurance. </p>
|
|
|
|
|
<p>A (new) Member who is not an Assurer may award an Assurer in a
|
|
|
|
|
reciprocal process a maximum of 2 Assurance Points, according to his
|
|
|
|
|
judgement. The Assurer should strive to have the Member allocate
|
|
|
|
|
according to the Member's judgement, and stay on the cautious side a
|
|
|
|
|
maximum of Assurance Points per Name; a (new) Member new to the
|
|
|
|
|
assurance process should allocate <i>zero</i> Assurance
|
|
|
|
|
Points
|
|
|
|
|
until they get some confidence in what is happening.</p>
|
|
|
|
|
<p>To reach 50 Assurance Points for a Name the Member must
|
|
|
|
|
have had at least two assurances on that Name: the Assured Member has
|
|
|
|
|
at least one Name assured, the Assured Name.</p>
|
|
|
|
|
<p>To reach 100 Assurance
|
|
|
|
|
Points, at least one Name of the Assured Member must have been
|
|
|
|
|
assured at least three times.</p>
|
|
|
|
|
<p>The maximum number of
|
|
|
|
|
Assurance
|
|
|
|
|
Points, which can be allocated for a Name assurance under this policy
|
|
|
|
|
and subsidiary policies is 50 Assurance Points.</p>
|
|
|
|
|
<p>If there is negative confidence the Assurer should consider
|
|
|
|
|
filing
|
|
|
|
|
a dispute.</p>
|
|
|
|
|
<h3>4.5. Experience Points</h3>
|
|
|
|
|
<p>The maximum number of Assurance Points that may be awarded by
|
|
|
|
|
an
|
|
|
|
|
Assurer is determined by the Experience Points of the Assurer. </p>
|
|
|
|
|
<dl>
|
|
|
|
|
<dd>
|
|
|
|
|
<table border="1" cellpadding="2" cellspacing="0" width="15%">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p><i>Assurer's Experience Points</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p><i>Allocatable Assurance Points</i></p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">0</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">10</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">10</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">15</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">20</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">20</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">30</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">25</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">40</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">30</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">>=50</p>
|
|
|
|
|
</td>
|
|
|
|
|
<td>
|
|
|
|
|
<p align="center">35</p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
|
|
|
|
</table>
|
|
|
|
|
</dd>
|
|
|
|
|
</dl>
|
|
|
|
|
<p align="left"><font size="2"><i>table
|
|
|
|
|
Maximum of Assurance Points </i></font>
|
|
|
|
|
</p>
|
|
|
|
|
<p>An Assurer is given a maximum of 2 Experience Points for every
|
|
|
|
|
completed Assurance. On reaching Assurer status, the Experience
|
|
|
|
|
Points start at 0 (zero). </p>
|
|
|
|
|
<p>Less Experience Points (1) may be given for mass Assurance
|
|
|
|
|
events,
|
|
|
|
|
where each Assurance is quicker. </p>
|
|
|
|
|
<p>Additional Experience Points may be granted temporarily or
|
|
|
|
|
permanently to an Assurer by CAcert Inc.'s Committee (board), on
|
|
|
|
|
recommendation from the Assurance Officer. </p>
|
|
|
|
|
<p>Experience Points are not to be confused with Assurance
|
|
|
|
|
Points. </p>
|
|
|
|
|
<h3>4.6. CAcert Assurance Programme (CAP) form</h3>
|
|
|
|
|
<p>The CAcert Assurance Programme (<a href="http://www.cacert.org/cap.php" target="_blank">CAP</a>)
|
|
|
|
|
form requests the following details of each Member or Prospective
|
|
|
|
|
Member: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Name(s), as recorded in the on-line account; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Primary email address, as recorded in the on-line account;
|
|
|
|
|
</p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Secondary Distinguishing Feature, as recorded in the
|
|
|
|
|
on-line account (normally, date of birth); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Statement of agreement with the CAcert Community
|
|
|
|
|
Agreement; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Permission to the Assurer to conduct the Assurance
|
|
|
|
|
(required for privacy reasons); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Date and signature of the Assuree. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>The CAP form requests the following details of the Assurer: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>At least one Name as recorded in the on-line account of
|
|
|
|
|
the Assurer; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Assurance Points for each Name in the identity
|
|
|
|
|
document(s); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Statement of Assurance; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Optional: If the Assurance is reciprocal, then the
|
|
|
|
|
Assurer's email address and Secondary Distinguishing Feature are
|
|
|
|
|
required as well; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Date, location of Assurance and signature of Assurer. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>The CAP forms are to be kept at least for 7 years by the
|
|
|
|
|
Assurer. </p>
|
|
|
|
|
<h2>5. The Assurance Officer</h2>
|
|
|
|
|
<p>The Committee (board) of CAcert Inc. appoints an Assurance
|
|
|
|
|
Officer
|
|
|
|
|
with the following responsibilities: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Reporting to the Committee and advising on all matters to
|
|
|
|
|
do with Assurance; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Training and testing of Assurers, in association with the
|
|
|
|
|
Education Team; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Updating this Assurance Policy, under the process
|
|
|
|
|
established by Policy on Policy (<a href="https://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Management of all Subsidiary Policies (see below) for
|
|
|
|
|
Assurances, under Policy on Policy; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Managing and creating rules of detail or procedure where
|
|
|
|
|
inappropriate for policies; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Incorporating rulings from Arbitration into policies,
|
|
|
|
|
procedures or guidelines; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Assisting the Arbitrator in any requests; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Managing the Assurer Handbook; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Maintaining a sufficient strength in the Assurance process
|
|
|
|
|
(web-of-trust) to meet the agreed needs of the Community. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<h2>6. Subsidiary Policies</h2>
|
|
|
|
|
<p>The Assurance Officer manages various exceptions and
|
|
|
|
|
additional
|
|
|
|
|
processes. Each must be covered by an approved Subsidiary Policy
|
|
|
|
|
(refer to Policy on Policy => CAcert Official Document COD1).
|
|
|
|
|
Subsidiary Policies specify any additional tests of knowledge
|
|
|
|
|
required and variations to process and documentation, within the
|
|
|
|
|
general standard stated here. </p>
|
|
|
|
|
<h3>6.1. Standard</h3>
|
|
|
|
|
<p>Each Subsidiary Policy must augment and improve the general
|
|
|
|
|
standards in this Assurance Policy. It is the responsibility of each
|
|
|
|
|
Subsidiary Policy to describe how it maintains and improves the
|
|
|
|
|
specific and overall goals. It must describe exceptions and potential
|
|
|
|
|
areas of risk. </p>
|
|
|
|
|
<h3>6.2. High Risk Applications</h3>
|
|
|
|
|
<p>In addition to the Assurance or Experience Points ratings set
|
|
|
|
|
here
|
|
|
|
|
in and in other policies, Assurance Officer or policies can
|
|
|
|
|
designate certain applications as high risk. If so, additional
|
|
|
|
|
measures may be added to the Assurance process that specifically
|
|
|
|
|
address the risks.</p>
|
|
|
|
|
<p>Additional measures may include additional information.
|
|
|
|
|
Additional
|
|
|
|
|
information can be required in process of assurance: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><dd>unique numbers of identity documents; </dd>
|
|
|
|
|
</li>
|
|
|
|
|
<li><dd> photocopy of identity documents; </dd>
|
|
|
|
|
</li>
|
|
|
|
|
<li><dd> photo of User; </dd>
|
|
|
|
|
</li>
|
|
|
|
|
<li><dd> address of User. </dd>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>Additional Information is to be kept by Assurer, attached to
|
|
|
|
|
CAcert Assurance Programme (<a href="http://www.cacert.org/cap.php" target="_blank">CAP</a>)
|
|
|
|
|
form. Assurance Points allocation by this assurance is unchanged.
|
|
|
|
|
User's CAcert login account should be annotated to record type of
|
|
|
|
|
additional information: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Arbitration: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Member to participate in Arbitration. This confirms
|
|
|
|
|
their acceptance of the forum as well as trains in the process and
|
|
|
|
|
import </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Member to file Arbitration to present case. This
|
|
|
|
|
allows Arbitrator as final authority; </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Additional training; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Member to be Assurer (at least 100 Assurance Points and
|
|
|
|
|
passed Assurer Challenge); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Member agrees to additional specific agreement(s); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Additional checking/auditing of systems data by CAcert
|
|
|
|
|
support administrators. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p>Applications that might attract additional measures include
|
|
|
|
|
code-signing certificates and administration roles. </p>
|
|
|
|
|
<h2>7. Privacy</h2>
|
|
|
|
|
<p>CAcert is a "privacy" organisation, and takes the
|
|
|
|
|
privacy of its Members seriously. The process maintains the security
|
|
|
|
|
and privacy of both parties. </p>
|
|
|
|
|
<p>Information is collected primarily to make claims within the
|
|
|
|
|
certificates requested by users and to contact the Members. It is
|
|
|
|
|
used secondarily for training, testing, administration and other
|
|
|
|
|
internal purposes. </p>
|
|
|
|
|
<p>The Member's information can be accessed under these
|
|
|
|
|
circumstances: </p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>
|
|
|
|
|
<p>Under Arbitrator ruling, in a duly filed dispute (<a href="http://www.cacert.org/policy/DisputeResolutionPolicy.html" target="_blank">Dispute Resolution Policy</a>
|
|
|
|
|
=> COD7); </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>An Assurer in the process of an Assurance, as permitted on
|
|
|
|
|
the CAcert Assurance Programme (<a href="http://www.cacert.org/cap.php" target="_blank">CAP</a>)
|
|
|
|
|
form; </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>CAcert support administration and CAcert systems
|
|
|
|
|
administration when operating under the authority of Arbitrator or
|
|
|
|
|
under CAcert policy. </p>
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<p><a href="http://validator.w3.org/check?uri=referer"><img src="../Images/valid-xhtml11-blue" name="graphics2" alt="Valid XHTML 1.1" align="bottom" border="0" height="33" width="90"></a>
|
|
|
|
|
</p>
|
|
|
|
|
</body></html>
|
