cacert/cacert-policies
9
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

committed the last block of changes as per rough consensus on policy group

Browse source 
git-svn-id: http://svn.cacert.org/CAcert/Policies@911 14b1bab8-4ef6-0310-b690-991c95c89dfd
This commit is contained in:
Ian Grigg 2008-08-18 14:46:39 +00:00
parent a4d8807339
commit c6dba8bd4d
1 changed files with 88 additions and 107 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

195
AssurancePolicy.html
View file

@ -23,12 +23,12 @@ TH P { color: #000000 }
</style></head> </style></head>
<body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB"> <body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB">
<h1>Assurance Policy for CAcert Community Members</h1> <h1>Assurance Policy for CAcert Community Members</h1>
<p><a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" name="graphics1" alt="CAcert Policy Status" align="bottom" border="0" height="33" width="90"></a> <p><a href="PolicyOnPolicy.html"><img src="Images/cacert-draft.png" name="graphics1" alt="CAcert Policy Status" align="bottom" border="0" height="33" width="90"></a>
<br> <br>
Editor: Teus Hagen<br> Editor: Teus Hagen<br>
Creation date: 2008-05-30<br> Creation date: 2008-05-30<br>
Last change by: Iang<br> Last change by: Iang<br>
Last change date: 2008-07-14 18:00 MET<br> Last change date: 2008-08-18 14:00 MET<br>
Status: DRAFT p20080712.1<br> Status: DRAFT p20080712.1<br>
Next status: POLICY 2008-10-12 </p> Next status: POLICY 2008-10-12 </p>
@ -47,57 +47,51 @@ Community (Assurer) identifies an individual (<span lang="en-US">Assuree</span>)
</dd> </dd>
<dt> <i>Prospective Member</i> </dt> <dt> <i>Prospective Member</i> </dt>
<dd> An individual who participates in the process of Assurance, <dd> An individual who participates in the process of Assurance,
but has not yet created <s>successfully</s> a CAcert login account. </dd> but has not yet created a CAcert login account. </dd>
<dt> <i>Name</i> </dt> <dt> <i>Name</i> </dt>
<dd> A Name is the full name of an individual. <dd> A Name is the full name of an individual.
<s> <br> with all
components of that name.
(Title(s), first name(s), family name(s), name extensions,
abbreviation of name(s), etc. <br>
The Name is technically spoken a string exactly taken e.g. from a
governmental issued photo ID.) </s>
</dd> </dd>
<dt> <i>Secondary Distinguishing Feature</i> <dt> <i>Secondary Distinguishing Feature</i>
</dt> </dt>
<dd> <b> An additional personal data item of the Member <dd> An additional personal data item of the Member
that assists discrimination from Members with similar full names. that assists discrimination from Members with similar full names.
(Currently this is the Date of Birth (DoB).) </b> (Currently this is the Date of Birth (DoB).)
<s> A Name for an individual is discriminated from similar
full names by a secondary distinguished feature, as recorded on the
on-line CAcert (web) account. <br>
(Currently this is the date of birth (DoB) of the individual. )</s>
</dd> </dd>
</dl> </dl>
<h3><a name="0.2">0.2.</a> The CAcert Web of Trust</h3> <h3><a name="0.2">0.2.</a> The CAcert Web of Trust</h3>
<p><b>In face-to-face meetings, <p>
In face-to-face meetings,
an Assurer allocates a number of Assurance Points an Assurer allocates a number of Assurance Points
to the Member being Assured. to the Member being Assured.
CAcert combines the Assurance Points CAcert combines the Assurance Points
into a global <i>Web-of-Trust</i> (or "WoT").</b> into a global <i>Web-of-Trust</i> (or "WoT").
<s><br> At each Assurance one allocates a number of Assurance Points, </p>
-applied to the assured Member. By combining the Assurances, and the <p>
-Assurance Points, CAcert constructs a global <i>Web-of-Trust</i> </s> </p> CAcert explicitly chooses to meet its various goals by
<p>CAcert explicitly chooses to meet its various goals by
construction of a Web-of-Trust of all Members. construction of a Web-of-Trust of all Members.
<s> This is done by </p>
-face-to-face meetings, identifying and sharing claims in a network.</s>
Maintaining a sufficient strength of the Web-of-Trust is a
high-level objective of the Assurance process. </p>
<h3><a name="0.3">0.3.</a> Related Documentation</h3> <h3><a name="0.3">0.3.</a> Related Documentation</h3>
<p>Documentation on Assurance is split between this Assurance <p>
Policy Documentation on Assurance is split between this
(AP) and the <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance Assurance Policy (AP) and the
<a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance
Handbook</a>. The policy is controlled by Configuration Control Handbook</a>. The policy is controlled by Configuration Control
Specification (<a href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification" target="_blank">CCS</a>) Specification
under Policy on Policy (<a href="http://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>) (<a href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification" target="_blank">CCS</a>)
under Policy on Policy
(<a href="http://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>)
policy document regime. Because Assurance is an active area, much policy document regime. Because Assurance is an active area, much
of the practice is handed over to the Assurance Handbook, which is of the practice is handed over to the Assurance Handbook, which is
not a controlled policy document, and can more easily respond to not a controlled policy document, and can more easily respond to
experience and circumstances. It is also more readable. </p> experience and circumstances. It is also more readable.
<p>See also Organisation Assurance Policy (<a href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php" target="_blank">OAP</a>) </p>
<p>
See also Organisation Assurance Policy (<a href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php" target="_blank">OAP</a>)
and CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>). and CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>).
</p> </p>
<h2><a name="1">1.</a> Assurance Purpose</h2> <h2><a name="1">1.</a> Assurance Purpose</h2>
<p>The purpose of Assurance is to add confidence <p>The purpose of Assurance is to add confidence
in the Assurance Statement made by the CAcert Community of a Member. </p> in the Assurance Statement made by the CAcert Community of a Member. </p>
@ -105,11 +99,11 @@ in the Assurance Statement made by the CAcert Community of a Member. </p>
with their assured Name included, (b) participate in assuring others, with their assured Name included, (b) participate in assuring others,
and (c) other related activities. The strength of these activities is and (c) other related activities. The strength of these activities is
based on the strength of the assurance. </p> based on the strength of the assurance. </p>
<h3><a name="1.1">1.1.</a>The Assurance Statement</h3> <h3><a name="1.1">1.1.</a>The Assurance Statement</h3>
<p><b>The Assurance Statement makes the following claims <p>
about a person</b>: The Assurance Statement makes the following claims
<s><br>The following claims can be made about a person who is about a person:
assured:</s>
</p> </p>
<ol> <ol>
<li> <li>
@ -132,7 +126,7 @@ by the CAcert Community Agreement; </p>
<li> <li>
<p>Some personal details of the Member are known to CAcert: <p>Some personal details of the Member are known to CAcert:
the individual Name(s), primary and other listed individual email the individual Name(s), primary and other listed individual email
address(es), secondary distinguish<b>ing</b><s>ed</s> feature (e.g. DoB). </p> address(es), secondary distinguishing feature (e.g. DoB). </p>
</li> </li>
</ol> </ol>
<p>The confidence level of the Assurance Statement is expressed by <p>The confidence level of the Assurance Statement is expressed by
@ -155,26 +149,24 @@ nature of Assurance, the number of Assurance Points, and other
policies and processes should be understood as limitations on any policies and processes should be understood as limitations on any
reliance. </p> reliance. </p>
<h2><a name="2">2.</a> The Member</h2> <h2><a name="2">2.</a> The Member</h2>
<h3><a name="2.1">2.1.</a> The <b>Member's</b> Name <s>in the CAcert login account</s> </h3> <h3><a name="2.1">2.1.</a> The Member's Name </h3>
<p>At least one individual Name is recorded in the Member's <p>
CAcert login account. <b>The general standard of a Name is:</b> At least one individual Name is recorded in the Member's
CAcert login account. The general standard of a Name is:
</p> </p>
<ul> <ul>
<li> <li>
<p>The Name should be <b>recorded</b> as <s>fully</s> written in a <p>
government-issued <b>photo</b> identity document (ID).</p> The Name should be recorded as written in a
government-issued photo identity document (ID).
</p>
</li> </li>
<li> <li>
<p> <b>The Name should be recorded as completely as possible. <p>
The Name should be recorded as completely as possible.
That is, including all middle names, any titles and extensions, That is, including all middle names, any titles and extensions,
without abbreviations, and without transliteration of characters. without abbreviations, and without transliteration of characters.
</b> </p>
<s><br>
A Name should be as fully written in a
government-issued identity document (ID). A Name should be as
complete as possible, that is not abbreviated, no transliteration of
characters in the Name.
</s></p>
</li> </li>
<li> <li>
<p>The Name is recorded as a string of characters, <p>The Name is recorded as a string of characters,
@ -184,7 +176,6 @@ transformation format.</p>
</ul> </ul>
<h3><a name="2.2">2.2.</a> Multiple Names and variations</h3> <h3><a name="2.2">2.2.</a> Multiple Names and variations</h3>
<p> <p>
<b>
In order to handle the contradictions in the above general standard, In order to handle the contradictions in the above general standard,
a Member may record multiple Names or multiple variations of a Name a Member may record multiple Names or multiple variations of a Name
in her CAcert online Account. in her CAcert online Account.
@ -192,18 +183,10 @@ Examples of variations include married names,
variations of initials of first or middle names, variations of initials of first or middle names,
abbreviations of a first name, abbreviations of a first name,
different language or country variations, different language or country variations,
and transliterations of characters in a name.</b></p> and transliterations of characters in a name.
</p>
<s> <p>
A Member may have multiple Names or multiple variations of a
Name.
For example, married name, variations of initials of first or middle
names, abbreviation of a first name, different language or country
variations and transliterations of characters in a name.</p>
<p>The login account may record multiple Names. Each of the Assured
Names can be selected to be used in a certificate issued by CAcert.
</p> </s>
<!-- <!--
FOLLOWING GOES TO ASSURER HANDBOOK FOLLOWING GOES TO ASSURER HANDBOOK
<h3><a name=""> </a>Comparison of names</h3> <h3><a name=""> </a>Comparison of names</h3>
@ -343,19 +326,18 @@ is not checked by CAcert.</p>
Examples of names in Examples of names in
different contexts</font></p> different contexts</font></p>
--> -->
<h3><a name="2.3">2.3.</a> Status and Capabilities</h3> <h3><a name="2.3">2.3.</a> Status and Capabilities</h3>
<b> <p>
<p>A Name which has reached A Name which has reached
the level of 50 Assurance Points is defined as an Assured the level of 50 Assurance Points is defined as an Assured
Name. An Assured Name can be used in a certificate issued by CAcert. Name. An Assured Name can be used in a certificate issued by CAcert.
A Member with at least one Assured Name has reached the Assured A Member with at least one Assured Name has reached the Assured
Member status. Member status.
Additional capabilities are described in Table 1.</p> Additional capabilities are described in Table 1.
</b> </p>
<s><p>
A Member has the following capabilities derived from
Assurance: </p></s>
<blockquote> <blockquote>
<p align="left"><font size="2"><i>Table 1: <p align="left"><font size="2"><i>Table 1:
@ -440,17 +422,21 @@ more) on at least one Name, and passing the Assurer Challenge.</p>
</tbody> </tbody>
</table> </table>
</blockquote> </blockquote>
<p>A Member may check the status of another Member, especially
<p>
A Member may check the status of another Member, especially
for an assurance process. for an assurance process.
<b>
Status may be implied from information in a certificate. Status may be implied from information in a certificate.
The number of Assurance Points for each Member is not published. The number of Assurance Points for each Member is not published.
</b>
</p> </p>
<p>The CAcert Policy Statement
<p>
The CAcert Policy Statement
(<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>) (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>)
and other policies may list other capabilities that rely on Assurance and other policies may list other capabilities that rely on Assurance
Points. </p> Points.
</p>
<h2><a name="3">3.</a> The Assurer</h2> <h2><a name="3">3.</a> The Assurer</h2>
<p>An Assurer is a Member with the following: </p> <p>An Assurer is a Member with the following: </p>
@ -543,15 +529,6 @@ the
Assurer, and reduces any sense of power. It is also an important aid Assurer, and reduces any sense of power. It is also an important aid
to the assurance training for future Assurers. </p> to the assurance training for future Assurers. </p>
<s>
<h3>4.3. Evidence of Assurer status</h3>
<p>On the question of providing evidence that one is an Assurer,
CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm#p3.2" target="_blank">CPS</a>)
says:<i> "The level at which each Member is Assured is public
data. The number of Assurance Points for each Member is not
published.</i>.".</p>
</s>
<h3><a name="4.3">4.3.</a> Assurance Points</h3> <h3><a name="4.3">4.3.</a> Assurance Points</h3>
<p>The Assurance applies Assurance Points to each Member which <p>The Assurance applies Assurance Points to each Member which
measure the increase of confidence in the Statement (above). measure the increase of confidence in the Statement (above).
@ -580,42 +557,45 @@ information presented: </p>
<p>The Assurance Statement is confirmed. </p> <p>The Assurance Statement is confirmed. </p>
</li> </li>
</ul> </ul>
<p>Any lesser confidence should result in less Assurance Points for a <p>
Any lesser confidence should result in less Assurance Points for a
Name. If the Assurer has no confidence in the information presented, Name. If the Assurer has no confidence in the information presented,
then <i>zero</i> Assurance Points may be allocated by the Assurer. then <i>zero</i> Assurance Points may be allocated by the Assurer.
For example, this may happen if the identity documents are totally For example, this may happen if the identity documents are totally
unfamiliar to the Assurer. The number of Assurance Points from <i>zero</i> unfamiliar to the Assurer. The number of Assurance Points from <i>zero</i>
to <i>maximum </i>is guided by the Assurance Handbook to <i>maximum</i> is guided by the Assurance Handbook
and the judgement of the Assurer. and the judgement of the Assurer.
<b>
If there is negative confidence the Assurer should consider If there is negative confidence the Assurer should consider
filing a dispute.</b></p> filing a dispute.
</p>
<p>Multiple Names should be allocated Assurance Points <p>Multiple Names should be allocated Assurance Points
independently within a single Assurance. </p> independently within a single Assurance. </p>
<p>A <s>(new)</s> Member who is not an Assurer may award an Assurer in a <p>
A Member who is not an Assurer may award an Assurer in a
reciprocal process a maximum of 2 Assurance Points, according to reciprocal process a maximum of 2 Assurance Points, according to
<b>her</b> <s>his</s> her judgement. The Assurer should strive to have the Member allocate
judgement. The Assurer should strive to have the Member allocate according to the Member's judgement, and stay on the cautious side;
according to the Member's judgement, and stay on the cautious side the Member new to the assurance process
<s>a maximum of AssurancePoints per Name</s> ;
the <s>(new)</s> Member new to the assurance process
should allocate <i>zero</i> Assurance Points should allocate <i>zero</i> Assurance Points
until <b>she gains</b> <s>they gets</s> some confidence in what is happening.</p> until she gains some confidence in what is happening.
<p><b>In general, for a Member to reach 50 Assurance Points, the Member must </p>
<p>
In general, for a Member to reach 50 Assurance Points, the Member must
have participated in at least two assurances, and have participated in at least two assurances, and
at least one Name will have been assured to that level.</b> at least one Name will have been assured to that level.
<s><br> To reach 50 Assurance Points for a Name the Member must </p>
have had at least two assurances on that Name: the Assured Member has <p>
at least one Name assured, the Assured Name.</s> To reach 100 Assurance
Points, at least one Name of the Assured Member must have been
assured at least three times.
</p>
<p>
The maximum number of Assurance
Points which can be allocated for an Assurance under this policy
and under any act under any
Subsidiary Policy (below) is 50 Assurance Points.
</p> </p>
<p>To reach 100 Assurance
Points, at least one Name of the Assured Member must have been
assured at least three times.</p>
<p>The maximum number of Assurance
Points which can be allocated for an <s>Name</s> Assurance under this policy
and <b>under any act under any</b>
Subsidiary Policy (below) is 50 Assurance Points.</p>
<h3><a name="4.4">4.4.</a> Experience Points</h3> <h3><a name="4.4">4.4.</a> Experience Points</h3>
<p>The maximum number of Assurance Points that may be awarded by <p>The maximum number of Assurance Points that may be awarded by
an an
@ -801,13 +781,14 @@ standards in this Assurance Policy. It is the responsibility of each
Subsidiary Policy to describe how it maintains and improves the Subsidiary Policy to describe how it maintains and improves the
specific and overall goals. It must describe exceptions and potential specific and overall goals. It must describe exceptions and potential
areas of risk. </p> areas of risk. </p>
<h3><a name="6.2">6.2.</a> High Risk Applications</h3> <h3><a name="6.2">6.2.</a> High Risk Applications</h3>
<p>In addition to the Assurance or Experience Points ratings set <p>In addition to the Assurance or Experience Points ratings set
here and in other subsidiary policies, the Assurance Officer or policies can here and in other subsidiary policies, the Assurance Officer or policies can
designate certain applications as high risk. If so, additional designate certain applications as high risk. If so, additional
measures may be added to the Assurance process that specifically measures may be added to the Assurance process that specifically
address the risks.</p> address the risks.</p>
<p>Additional measures may include <s>additional information</s>: <p>Additional measures may include:
</p> </p>
<ul> <ul>
<li> <li>