diff --git a/AssurancePolicy.html b/AssurancePolicy.html index a61dbf8..0c15e66 100644 --- a/AssurancePolicy.html +++ b/AssurancePolicy.html @@ -21,6 +21,7 @@ H3 { color: #000000 } TH P { color: #000000 } --> +

Assurance Policy for CAcert Community Members

CAcert Policy Status @@ -28,75 +29,89 @@ TH P { color: #000000 } Editor: Teus Hagen
Creation date: 2008-05-30
Last change by: Iang
-Last change date: 2008-07-09 16:14 MET
-Status: WIP 2008-05-30
-Next status: DRAFT 12th July 2008

-

0. Preamble

-

Definitions of terms:

+Last change date: 2008-07-14 18:00 MET
+Status: DRAFT 2008-07-12
+Next status: POLICY 2008-09-30

+ +

0. Preamble

+

0.1. Definition of Terms

Member
A Member is an individual who has agreed to the CAcert -Community Agreement (CCA) and has created successfully +Community Agreement +(CCA) +and has created successfully a CAcert login account on the CAcert web site.
Assurance
Assurance is the process by which a Member of CAcert Community (Assurer) identifies an individual (Assuree).
Prospective Member
-
An individual who has been assured in an Assurance -process, but has not yet created successfully a CAcert login account.
+
An individual who participates in the process of Assurance, +but has not yet created successfully a CAcert login account.
Name
-
A Name is the full name of an individual, with all +
A Name is the full name of an individual. +
with all components of that name.
-
(Title(s), first name(s), family name(s), name extensions, +(Title(s), first name(s), family name(s), name extensions, abbreviation of name(s), etc.
The Name is technically spoken a string exactly taken e.g. from a -governmental issued photo ID.)
+governmental issued photo ID.) +
Secondary Distinguishing Feature -(DoB)
-
A Name for an individual is discriminated from similar + +
An additional personal data item of the Member +that assists discrimination from Members with similar full names. +Currently this is the Date of Birth (DoB). + A Name for an individual is discriminated from similar full names by a secondary distinguished feature, as recorded on the on-line CAcert (web) account.
-(Currently this is the date of birth (DoB) of the individual. )
+(Currently this is the date of birth (DoB) of the individual. ) +
-

-The CAcert Web of Trust

-

At each Assurance one allocates a number of Assurance Points, -applied to the assured Member. By combining the Assurances, and the -Assurance Points, CAcert constructs a global Web-of-Trust -or -"WoT".

+ +

0.2. The CAcert Web of Trust

+

In face-to-face meetings, +an Assurer allocates a number of Assurance Points +to the Member being Assured. +CAcert combines the Assurance Points +into a global Web-of-Trust (or "WoT"). +
At each Assurance one allocates a number of Assurance Points, +-applied to the assured Member. By combining the Assurances, and the +-Assurance Points, CAcert constructs a global Web-of-Trust

CAcert explicitly chooses to meet its various goals by -construction of a Web-of-Trust of all Members. This is done by -face-to-face meetings, identifying and sharing claims in a network. -Maintaining a sufficient strength for the Web-of-Trust is a +construction of a Web-of-Trust of all Members. + This is done by +-face-to-face meetings, identifying and sharing claims in a network. +Maintaining a sufficient strength of the Web-of-Trust is a high-level objective of the Assurance process.

-

Related Documentation

+

0.3. Related Documentation

Documentation on Assurance is split between this Assurance Policy (AP) and the Assurance Handbook. The policy is controlled by Configuration Control Specification (CCS) under Policy on Policy (PoP) -policy document regime.
-Because Assurance is an active area, much +policy document regime. Because Assurance is an active area, much of the practice is handed over to the Assurance Handbook, which is not a controlled policy document, and can more easily respond to experience and circumstances. It is also more readable.

See also Organisation Assurance Policy (OAP) and CAcert Policy Statement (CPS).

-

1. Assurance Purpose

+

1. Assurance Purpose

The purpose of Assurance is to add confidence in the Assurance Statement made by the CAcert Community of a Member.

-

With sufficient assurances, a Member may: (a) issue -certificates +

With sufficient assurances, a Member may: (a) issue certificates with their assured Name included, (b) participate in assuring others, and (c) other related activities. The strength of these activities is based on the strength of the assurance.

-

The Assurance Statement

-

The following claims can be made about a person who is -assured:

+

1.1.The Assurance Statement

+

The Assurance Statement makes the following claims +about a person: +
The following claims can be made about a person who is +assured: +

  1. The person is a bona fide Member. In other words, the @@ -113,68 +128,85 @@ issued by the Account;

  2. The Member is bound into CAcert's Arbitration as defined -by the Community Agreement;

    +by the CAcert Community Agreement;

  3. Some personal details of the Member are known to CAcert: the individual Name(s), primary and other listed individual email -address(es), secondary distinguished feature (e.g. DoB).

    +address(es), secondary distinguishinged feature (e.g. DoB).

-

The confidence level of the Assurance Statement is expressed -by +

The confidence level of the Assurance Statement is expressed by the Assurance Points.

-

Relying Party Statement

+

1.2.Relying Party Statement

The primary goal of the Assurance Statement is for the express -purpose of certificates to meet the needs of the Relying -Party -Statement, which latter is found in the Certification -Practice +purpose of certificates to meet the needs of the Relying Party +Statement, which latter is found in the Certification Practice Statement (CPS).

-

When a certificate is issued, some of the Assurance Statement -may +

When a certificate is issued, some of the Assurance Statement may be incorporated, e.g. Name. Other parts may be implied, e.g. Membership, exact account and status. They all are part of the -Relying Party Statement. In short, this means that -other +Relying Party Statement. In short, this means that other Members of the Community may rely on the information verified by -Assurance and found in the certificate.

-

In particular, certificates are sometimes considered to -provide +Assurance and found in the certificate.

+

In particular, certificates are sometimes considered to provide reliable indications of e.g. the Member's Name and email address. The nature of Assurance, the number of Assurance Points, and other policies and processes should be understood as limitations on any reliance.

-

2. The Member

-

2.1 The Name in the CAcert login account

-

At least one individual Name is recorded -in the -CAcert login account. The Name is recorded as a string of characters, -encoded in unicode -transformation format.

-

A Name should be as fully written in a +

2. The Member

+

2.1. The Member's Name in the CAcert login account

+

At least one individual Name is recorded in the Member's +CAcert login account. The general standard of a Name is: +

+ +

2.2. Multiple Names and variations

+

+ +In order to handle the contradictions in the above general standard, +a Member may record multiple Names or multiple variations of a Name +in her CAcert online Account. +Examples of variations include married names, +variations of initials of first or middle names, +abbreviations of a first name, +different language or country variations, +and transliterations of characters in a name.

+ + +

+A Member may have multiple Names or multiple variations of a Name. For example, married name, variations of initials of first or middle names, abbreviation of a first name, different language or country variations and transliterations of characters in a name.

-

The login account may record multiple Names. Each of the -Assured -Names can be selected to be used in a certificate issued by CAcert.

+

The login account may record multiple Names. Each of the Assured +Names can be selected to be used in a certificate issued by CAcert. +

 -

2.3. Status and Capabilities

-

A Member has the following capabilities derived from -Assurance:

+

2.3. Status and Capabilities

+ +

A Name which has reached +the level of 50 Assurance Points is defined as an Assured +Name. An Assured Name can be used in a certificate issued by CAcert. +A Member with at least one Assured Name has reached the Assured +Member status. +Additional capabilities are described in Table 1.

+ + +

+A Member has the following capabilities derived from +Assurance:

+ +
+

Table 1: +Assurance Capability

@@ -351,7 +397,7 @@ allocation of Assurance Points is awaiting login account creation.

0

-

request unnamed certificates

+

Request unnamed certificates

Member

@@ -366,7 +412,7 @@ recorded in the account, they are not highly assured.

50

 -

request named certificates

+

Request named certificates

Assured Member

@@ -381,7 +427,7 @@ assured to 50 Assurance Points or more

100

 -

become an Assurer

+

Become an Assurer

Prospective Assurer

@@ -393,15 +439,20 @@ more) on at least one Name, and passing the Assurer Challenge.
-

table -Assurance Capability

+

A Member may check the status of another Member, especially -for an -assurance process.

-

The CAcert Policy Statement (CPS) +for an assurance process. + +Status may be implied from information in a certificate. +The number of Assurance Points for each Member is not published. + +

+

The CAcert Policy Statement +(CPS) and other policies may list other capabilities that rely on Assurance Points.

-

3. The Assurer

+ +

3. The Assurer

An Assurer is a Member with the following:

The Assurer Challenge is administered by the Education Team on behalf of the Assurance Officer.

-

The Obligations of the Assurer

+

3.1. The Obligations of the Assurer

The Assurer is obliged to:

-

4. The Assurance

-

4.1. The Assurance Process

+

4. The Assurance

+

4.1. The Assurance Process

The Assurer conducts the process of Assurance with each Member.

The process consists of:

@@ -474,11 +525,11 @@ Distinguishing Feature, e.g., DoB);

Assuree (Mutual Assurance);

  • -

    Safe keeping of the CAcert Assurance Programme (CAP) +

    Safekeeping of the CAcert Assurance Programme (CAP) forms by Assurer.

    • -

    4.2. Mutual Assurance

    +

    4.2. Mutual Assurance

    Mutual Assurance follows the principle of reciprocity. This means that the Assurance may be two-way, and that each member participating @@ -491,13 +542,17 @@ procedure and process, and is responsible for the results.

    the Assurer, and reduces any sense of power. It is also an important aid to the assurance training for future Assurers.

    + +

    4.3. Evidence of Assurer status

    On the question of providing evidence that one is an Assurer, CAcert Policy Statement (CPS) says: "The level at which each Member is Assured is public data. The number of Assurance Points for each Member is not published..".

    -

    4.4. Assurance Points

    +     + +

    4.3. Assurance Points

    The Assurance applies Assurance Points to each Member which measure the increase of confidence in the Statement (above). Assurance Points should not be interpreted for any other purpose. @@ -525,45 +580,50 @@ information presented:

    The Assurance Statement is confirmed.

    -

    Any lesser confidence should result in less Assurance Points -for a +

    Any lesser confidence should result in less Assurance Points for a Name. If the Assurer has no confidence in the information presented, -then zero Assurance Points may be allocated by -the Assurer. +then zero Assurance Points may be allocated by the Assurer. For example, this may happen if the identity documents are totally unfamiliar to the Assurer. The number of Assurance Points from zero to maximum is guided by the Assurance Handbook -and the -judgement of the Assurer.

    -

    Multiple Names should be allocated separately in a single -Assurance.

    -

    A (new) Member who is not an Assurer may award an Assurer in a -reciprocal process a maximum of 2 Assurance Points, according to his +and the judgement of the Assurer. + +If there is negative confidence the Assurer should consider +filing a dispute.

    +

    Multiple Names should be allocated Assurance Points +independently within a single Assurance.

    +

    A (new) Member who is not an Assurer may award an Assurer in a +reciprocal process a maximum of 2 Assurance Points, according to +her his judgement. The Assurer should strive to have the Member allocate -according to the Member's judgement, and stay on the cautious side a -maximum of Assurance Points per Name; a (new) Member new to the -assurance process should allocate zero Assurance -Points -until they get some confidence in what is happening.

    -

    To reach 50 Assurance Points for a Name the Member must +according to the Member's judgement, and stay on the cautious side +a maximum of AssurancePoints per Name ; +the (new) Member new to the assurance process +should allocate zero Assurance Points +until she gains they gets some confidence in what is happening.

    +

    In general, for a Member to reach 50 Assurance Points, the Member must +have participated in at least two assurances, and +at least one Name will have been assured to that level. +
    To reach 50 Assurance Points for a Name the Member must have had at least two assurances on that Name: the Assured Member has -at least one Name assured, the Assured Name.

    +at least one Name assured, the Assured Name. +

    +

    To reach 100 Assurance Points, at least one Name of the Assured Member must have been assured at least three times.

    -

    The maximum number of -Assurance -Points, which can be allocated for a Name assurance under this policy -and subsidiary policies is 50 Assurance Points.

    -

    If there is negative confidence the Assurer should consider -filing -a dispute.

    -

    4.5. Experience Points

    +

    The maximum number of Assurance +Points which can be allocated for an Name Assurance under this policy +and under any act under any +Subsidiary Policy (below) is 50 Assurance Points.

    +

    4.4. Experience Points

    The maximum number of Assurance Points that may be awarded by an Assurer is determined by the Experience Points of the Assurer.

    -
    -
    +
    +

    Table 2: +Maximum of Assurance Points +

    @@ -624,11 +684,7 @@ Assurer is determined by the Experience Points of the Assurer.

    -
    -
    -

    table -Maximum of Assurance Points -

    +

    An Assurer is given a maximum of 2 Experience Points for every completed Assurance. On reaching Assurer status, the Experience Points start at 0 (zero).

    @@ -640,7 +696,7 @@ permanently to an Assurer by CAcert Inc.'s Committee (board), on recommendation from the Assurance Officer.

    Experience Points are not to be confused with Assurance Points.

    -

    4.6. CAcert Assurance Programme (CAP) form

    +

    4.5. CAcert Assurance Programme (CAP) form

    The CAcert Assurance Programme (CAP) form requests the following details of each Member or Prospective Member:

    @@ -692,7 +748,7 @@ required as well;

    The CAP forms are to be kept at least for 7 years by the Assurer.

    -

    5. The Assurance Officer

    +

    5. The Assurance Officer

    The Committee (board) of CAcert Inc. appoints an Assurance Officer with the following responsibilities:

    @@ -732,57 +788,50 @@ procedures or guidelines;

    (web-of-trust) to meet the agreed needs of the Community.

    -

    6. Subsidiary Policies

    -

    The Assurance Officer manages various exceptions and -additional +

    6. Subsidiary Policies

    +

    The Assurance Officer manages various exceptions and additional processes. Each must be covered by an approved Subsidiary Policy (refer to Policy on Policy => CAcert Official Document COD1). Subsidiary Policies specify any additional tests of knowledge required and variations to process and documentation, within the general standard stated here.

    -

    6.1. Standard

    +

    6.1. Standard

    Each Subsidiary Policy must augment and improve the general standards in this Assurance Policy. It is the responsibility of each Subsidiary Policy to describe how it maintains and improves the specific and overall goals. It must describe exceptions and potential areas of risk.

    -

    6.2. High Risk Applications

    +

    6.2. High Risk Applications

    In addition to the Assurance or Experience Points ratings set -here -in and in other policies, Assurance Officer or policies can +here and in other subsidiary policies, the Assurance Officer or policies can designate certain applications as high risk. If so, additional measures may be added to the Assurance process that specifically address the risks.

    -

    Additional measures may include additional information. -Additional -information can be required in process of assurance:

    +

    Additional measures may include additional information:

    -

    Valid XHTML 1.1 +

    Valid XHTML 1.1