+
+
Editor: Teus Hagen
Creation date: 2008-05-30
Last change by: Iang
-Last change date: 2008-07-14 18:00 MET
+Last change date: 2008-08-18 14:00 MET
Status: DRAFT p20080712.1
Next status: POLICY 2008-10-12
In face-to-face meetings, +
+In face-to-face meetings,
an Assurer allocates a number of Assurance Points
to the Member being Assured.
CAcert combines the Assurance Points
-into a global Web-of-Trust (or "WoT").
-
At each Assurance one allocates a number of Assurance Points,
--applied to the assured Member. By combining the Assurances, and the
--Assurance Points, CAcert constructs a global Web-of-Trust
CAcert explicitly chooses to meet its various goals by +into a global Web-of-Trust (or "WoT"). +
+
+CAcert explicitly chooses to meet its various goals by
construction of a Web-of-Trust of all Members.
- This is done by
--face-to-face meetings, identifying and sharing claims in a network.
-Maintaining a sufficient strength of the Web-of-Trust is a
-high-level objective of the Assurance process.
Documentation on Assurance is split between this Assurance
-Policy
-(AP) and the Assurance
+
+Documentation on Assurance is split between this
+Assurance Policy (AP) and the
+Assurance
Handbook. The policy is controlled by Configuration Control
-Specification (CCS)
-under Policy on Policy (PoP)
+Specification
+(CCS)
+under Policy on Policy
+(PoP)
policy document regime. Because Assurance is an active area, much
of the practice is handed over to the Assurance Handbook, which is
not a controlled policy document, and can more easily respond to
-experience and circumstances. It is also more readable. See also Organisation Assurance Policy (OAP)
+experience and circumstances. It is also more readable.
+
+See also Organisation Assurance Policy (OAP)
and CAcert Policy Statement (CPS).
The purpose of Assurance is to add confidence
in the Assurance Statement made by the CAcert Community of a Member. 1. Assurance Purpose
The Assurance Statement makes the following claims
-about a person:
-
The following claims can be made about a person who is
-assured:
+The Assurance Statement makes the following claims +about a person:
Some personal details of the Member are known to CAcert:
the individual Name(s), primary and other listed individual email
-address(es), secondary distinguishinged feature (e.g. DoB).
The confidence level of the Assurance Statement is expressed by @@ -155,26 +149,24 @@ nature of Assurance, the number of Assurance Points, and other policies and processes should be understood as limitations on any reliance.
At least one individual Name is recorded in the Member's -CAcert login account. The general standard of a Name is: +
+At least one individual Name is recorded in the Member's +CAcert login account. The general standard of a Name is:
The Name should be recorded as fully written in a
-government-issued photo identity document (ID).
+The Name should be recorded as written in a +government-issued photo identity document (ID). +
The Name should be recorded as completely as possible. +
+The Name should be recorded as completely as possible.
That is, including all middle names, any titles and extensions,
without abbreviations, and without transliteration of characters.
-
-
-A Name should be as fully written in a
-government-issued identity document (ID). A Name should be as
-complete as possible, that is not abbreviated, no transliteration of
-characters in the Name.
-
The Name is recorded as a string of characters, @@ -184,7 +176,6 @@ transformation format.
- In order to handle the contradictions in the above general standard, a Member may record multiple Names or multiple variations of a Name in her CAcert online Account. @@ -192,18 +183,10 @@ Examples of variations include married names, variations of initials of first or middle names, abbreviations of a first name, different language or country variations, -and transliterations of characters in a name.
+and transliterations of characters in a name. + --A Member may have multiple Names or multiple variations of a -Name. -For example, married name, variations of initials of first or middle -names, abbreviation of a first name, different language or country -variations and transliterations of characters in a name.
-The login account may record multiple Names. Each of the Assured -Names can be selected to be used in a certificate issued by CAcert. -
+ + +A Name which has reached +
+A Name which has reached the level of 50 Assurance Points is defined as an Assured Name. An Assured Name can be used in a certificate issued by CAcert. A Member with at least one Assured Name has reached the Assured Member status. -Additional capabilities are described in Table 1.
- - --A Member has the following capabilities derived from -Assurance:
+Additional capabilities are described in Table 1. +-Table 1: @@ -440,17 +422,21 @@ more) on at least one Name, and passing the Assurer Challenge.
A Member may check the status of another Member, especially + + +
+A Member may check the status of another Member, especially for an assurance process. - Status may be implied from information in a certificate. The number of Assurance Points for each Member is not published. -
-The CAcert Policy Statement + +
+The CAcert Policy Statement (CPS) and other policies may list other capabilities that rely on Assurance -Points.
+Points. +An Assurer is a Member with the following:
@@ -543,15 +529,6 @@ the Assurer, and reduces any sense of power. It is also an important aid to the assurance training for future Assurers. -On the question of providing evidence that one is an Assurer, -CAcert Policy Statement (CPS) -says: "The level at which each Member is Assured is public -data. The number of Assurance Points for each Member is not -published..".
- -The Assurance applies Assurance Points to each Member which measure the increase of confidence in the Statement (above). @@ -580,42 +557,45 @@ information presented:
The Assurance Statement is confirmed.
-Any lesser confidence should result in less Assurance Points for a +
+Any lesser confidence should result in less Assurance Points for a Name. If the Assurer has no confidence in the information presented, then zero Assurance Points may be allocated by the Assurer. For example, this may happen if the identity documents are totally unfamiliar to the Assurer. The number of Assurance Points from zero -to maximum is guided by the Assurance Handbook +to maximum is guided by the Assurance Handbook and the judgement of the Assurer. - If there is negative confidence the Assurer should consider -filing a dispute.
+filing a dispute. +Multiple Names should be allocated Assurance Points independently within a single Assurance.
-A (new) Member who is not an Assurer may award an Assurer in a
+
+A Member who is not an Assurer may award an Assurer in a
reciprocal process a maximum of 2 Assurance Points, according to
-her his
-judgement. The Assurer should strive to have the Member allocate
-according to the Member's judgement, and stay on the cautious side
-a maximum of AssurancePoints per Name ;
-the (new) Member new to the assurance process
+her judgement. The Assurer should strive to have the Member allocate
+according to the Member's judgement, and stay on the cautious side;
+the Member new to the assurance process
should allocate zero Assurance Points
-until she gains they gets some confidence in what is happening.
In general, for a Member to reach 50 Assurance Points, the Member must +until she gains some confidence in what is happening. +
+
+In general, for a Member to reach 50 Assurance Points, the Member must
have participated in at least two assurances, and
-at least one Name will have been assured to that level.
-
To reach 50 Assurance Points for a Name the Member must
-have had at least two assurances on that Name: the Assured Member has
-at least one Name assured, the Assured Name.
+To reach 100 Assurance +Points, at least one Name of the Assured Member must have been +assured at least three times. +
++The maximum number of Assurance +Points which can be allocated for an Assurance under this policy +and under any act under any +Subsidiary Policy (below) is 50 Assurance Points.
-To reach 100 Assurance -Points, at least one Name of the Assured Member must have been -assured at least three times.
-The maximum number of Assurance
-Points which can be allocated for an Name Assurance under this policy
-and under any act under any
-Subsidiary Policy (below) is 50 Assurance Points.
The maximum number of Assurance Points that may be awarded by an @@ -801,13 +781,14 @@ standards in this Assurance Policy. It is the responsibility of each Subsidiary Policy to describe how it maintains and improves the specific and overall goals. It must describe exceptions and potential areas of risk.
+In addition to the Assurance or Experience Points ratings set here and in other subsidiary policies, the Assurance Officer or policies can designate certain applications as high risk. If so, additional measures may be added to the Assurance process that specifically address the risks.
-Additional measures may include additional information:
+
Additional measures may include: