f767aae1a3
git-svn-id: http://svn.cacert.org/CAcert/Policies@872 14b1bab8-4ef6-0310-b690-991c95c89dfd
812 lines
No EOL
26 KiB
HTML
812 lines
No EOL
26 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
|
<html><head>
|
|
<meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8"><title>Assurance Policy</title>
|
|
|
|
<meta name="CREATEDBY" content="Ian Grigg">
|
|
<meta name="CREATED" content="20080530;0">
|
|
<meta name="CHANGEDBY" content="Teus Hagen">
|
|
<meta name="CHANGED" content="20080701;17220500">
|
|
<meta name="CHANGEDBY" content="Teus Hagen">
|
|
</head>
|
|
|
|
<body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB">
|
|
<h1>Assurance Policy for CAcert Community Members</h1>
|
|
<p><a href="PolicyOnPolicy.html"><img src="Images/cacert-wip.png" name="graphics1" alt="CAcert Policy Status" align="bottom" border="0" height="33" width="90"></a> <br>
|
|
Author: Ian Grigg<br>
|
|
Creation date: 2008-05-30<br>
|
|
Status: WIP 2008-05-30<br>
|
|
Next status: DRAFT June 2008</p>
|
|
<h2 class="western">0. Preamble</h2>
|
|
<p>Definitions of terms: </p>
|
|
<dl>
|
|
<dt> <em>Member</em> </dt>
|
|
<dd> A Member is an individual who has agreed to the CAcert
|
|
Community Agreement (CCA) and has created successfully a CAcert
|
|
(web)account on http://www.cacert.org.</dd>
|
|
<dt><em>Assurance</em> </dt>
|
|
<dd> Assurance is the process by which a Member of CAcert
|
|
Community (Assurer) identifies an individual (<span lang="en-US">Assuree</span>).
|
|
<br>
|
|
With sufficient assurances, a Member may: (a) issue certificates with
|
|
their name included, (b) participate in assuring others, and (c) other
|
|
related activities. The strength of these activities is based on the
|
|
strength of the assurance.</dd>
|
|
<dd> </dd>
|
|
<dt> <em>Name</em> </dt>
|
|
<dd> A Name is the full name of an individual: first
|
|
name(s), family name(s), name extensions, abbreviation of name(s), etc.
|
|
The Name is technically spoken a string exactly taken from a
|
|
governmental issued photo ID. </dd>
|
|
<dt> <em>Secondary Distinguishing Feature</em>
|
|
(DoB) </dt>
|
|
<dd style="margin-bottom: 0.5cm;"> A Name for an
|
|
individual is discriminated from similar full names by a secondary
|
|
distinguished feature, as recorded on the on-line CAcert (web) account.
|
|
Currently this is the date of birth (DoB) of the individual. </dd>
|
|
</dl>
|
|
<h3 class="western">
|
|
The CAcert Web of Trust</h3>
|
|
<p>Each Assurance claims a number of Assurance Points, applied to
|
|
the
|
|
assured Member or Member prospect. By combining the Assurances, and
|
|
the Assurance Points, CAcert constructs a global <em>Web-of-Trust</em>
|
|
or "WoT". </p>
|
|
<p>CAcert explicitly chooses to meet its various goals by
|
|
construction of a Web-of-Trust of all Members. This is done by
|
|
face-to-face meetings, identifying and sharing claims in a network.
|
|
Maintaining a sufficient strength for the Web-of-Trust is a
|
|
high-level objective of the Assurance process. </p>
|
|
<h3 class="western">Related Documentation</h3>
|
|
<p>Documentation on Assurance is split between this Assurance
|
|
Policy
|
|
(AP) and the <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance
|
|
Handbook</a>. The policy is controlled by Configuration Control
|
|
Specification (<a href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification" target="_blank">CCS</a>)
|
|
under Policy on Policy (<a href="http://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>)
|
|
policy document regime. <br>
|
|
Because Assurance is an active area, much
|
|
of the practice is handed over to the Assurance Handbook, which is
|
|
not a controlled policy document, and can more easily respond to
|
|
experience
|
|
and circumstances. It is also more readable. </p>
|
|
<p>See also Organisation Assurance Policy (<a href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php" target="_blank">OAP</a>)
|
|
and CAcert Policy Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>).
|
|
</p>
|
|
<h2 class="western">1. Purpose</h2>
|
|
<p>The purpose of Assurance is to add <span style="font-style: italic;">confidence</span> in the
|
|
Assurance
|
|
Statement made by a Member of the CAcert Community. </p>
|
|
<h3 class="western">The Assurance Statement</h3>
|
|
<p>The following claims can be made about a person who is
|
|
assured: </p>
|
|
<ol>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">The person is a bona
|
|
fide Member. In other words, the person is a member of the CAcert
|
|
Community, as defined by the CAcert Community Agreement (CCA). </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">The Member has a
|
|
(login) (web)Account with CAcert's on-line registration and service
|
|
system. </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">The Member can be
|
|
determined from any CAcert certificate issued by the Account. </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">The Member is bound
|
|
into CAcert's Arbitration, as defined by the CCA. </p>
|
|
</li>
|
|
<li>
|
|
<p>Some personal details of the Member (Name(s), primary and
|
|
other listed email address(es), secondary distinguished feature (eg
|
|
DoB)) are known to CAcert. </p>
|
|
</li>
|
|
</ol>
|
|
<p>The confidence level of the Assurance Statement is expressed
|
|
by
|
|
the Assurance Points. </p>
|
|
<h3 class="western">Relying Party Statement</h3>
|
|
<p>The primary goal of the Assurance Statement is to meet the
|
|
needs
|
|
of the <em>Relying Party Statement</em>, which latter is
|
|
found in the
|
|
Certification Practice Statement (<a href="http://svn.cacert.org/CAcert/policy.htm" target="_blank">CPS</a>)
|
|
for the express purpose of certificates. </p>
|
|
<p>When a certificate is issued, some or all of the Assurance
|
|
Statement may be incorporated (e.g. full name) or implied (e.g.
|
|
comparable name, unique certificate serial number, membership or
|
|
status) into the certificate and be part of the <em>Relying
|
|
Party Statement</em>. In short, this means that other Members of
|
|
the
|
|
Community may rely on the information verified by Assurance and found
|
|
in the certificate. </p>
|
|
<p>In particular, certificates are sometimes considered to
|
|
provide
|
|
reliable indications of the Member's Name and eg. email address. The
|
|
nature of Assurance,
|
|
the number of Assurance Points, and other policies and processes
|
|
should be understood as limitations on any reliance. </p>
|
|
<h2 class="western">2. The Member</h2>
|
|
<h3 class="western">Name(s) in an account</h3>
|
|
<p>In principle the Name in the CAcert web account is identical
|
|
to
|
|
the name in at least one of the ID document of that individual. Names
|
|
in an ID can differ, so a CAcert account can have more as one
|
|
Name.<br>
|
|
The technical form of a Name is a string of characters. Each Name
|
|
should be exactly copied once from a governmental-issued photo
|
|
ID. </p>
|
|
<h3 class="western">Multiple Names</h3>
|
|
<p>A Member can have multiple individual names. For example,
|
|
married
|
|
name, variations of initials of first or middle names, abbreviation
|
|
of a first name, different language or country variations and
|
|
transliterations of characters in a name. Each individual Name
|
|
originating from a governmental ID must
|
|
be assured to the applicable level of 50
|
|
Assurance Points before the (comparable) name can be used as Common
|
|
Name in a certificate. </p>
|
|
<h3 class="western">Comparison of names</h3>
|
|
<p><a href="http://en.wikipedia.org/wiki/Transliteration" target="_blank">Transliteration</a>
|
|
of characters as defined in the transliteration character table (<a href="http://svn.cacert.org/CAcert/Policies/transtab.utf" target="_blank">UTF
|
|
Transtab</a>) for names is permitted, but the result must be
|
|
7-bit
|
|
ASCII for the full name. Transliteration is one way and is
|
|
towards 7-bit ASCII. Transliteration is a way to compare two names.
|
|
However transliteration of a name makes the name less discriminative.</p>
|
|
<p>In general names are handled case insensitively.</p>
|
|
<p>Abbreviation of second given name(s), middle name(s), titles
|
|
and
|
|
name extensions in the name of an individual to one character and the
|
|
dot indicating the abbreviation, is permitted. If the first given name
|
|
in the ID document is abbreviated, the first given name in the web
|
|
account Name may be abbreviated. Abbreviation of a name makes
|
|
the name less discriminative.</p>
|
|
<p>Titles and name extensions in the name of an individual may be
|
|
omitted.</p>
|
|
<p>The assurance ambition is to pursuit for a highly
|
|
discriminative
|
|
assured Name. The ambition is to have a Name in the account with no
|
|
abbreviation(s), no transliteration and case sensitive.</p>
|
|
<p>The Common Name and related certificate fields in the issued
|
|
certificate is dependent on the assurance of the Name in the web
|
|
account. Abbreviation and transliteration handling in the CN is
|
|
defined in the Certificate Implementation Policy (<a href="http://svn.cacert.org/CAcert/Policies/CertificateImplementationPolicy.html" target="_blank">CIP</a>)
|
|
and is similar to the name comparison as defined in this policy.
|
|
However the
|
|
Common Name may become less discriminative as the assured Name as the
|
|
unique certificate serial number will lead to the account of the
|
|
individual in a unique way, and in this way to
|
|
the Name and email address of the individual or organisation. The
|
|
first given name in the Common Name may be abbreviated on request.</p>
|
|
<table border="1" cellpadding="2" cellspacing="0">
|
|
<tbody>
|
|
<tr>
|
|
<th width="25%">
|
|
<p style=""><i>name on the ID</i></p>
|
|
</th>
|
|
<th width="25%">
|
|
<p style=""><i>Name in the account</i></p>
|
|
</th>
|
|
<th width="25%">
|
|
<p style=""><i>name in the certificate request</i></p>
|
|
</th>
|
|
<th width="25%">
|
|
<p style=""><i>name on the issued certificate</i></p>
|
|
</th>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p>Maria Kate Marvel-Java sr</p>
|
|
</td>
|
|
<td>
|
|
<p>Maria K. Marvel-Java</p>
|
|
</td>
|
|
<td>
|
|
<p>M. K. Marvel-Java</p>
|
|
</td>
|
|
<td>
|
|
<p>Maria K. Marvel-Java</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p>prof. dr. John K. Marvel sr</p>
|
|
</td>
|
|
<td>
|
|
<p>John K. Marvel</p>
|
|
</td>
|
|
<td>
|
|
<p>John K. Marvel</p>
|
|
</td>
|
|
<td>
|
|
<p>John K. Marvel</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p>Moeria Koete v. Java</p>
|
|
</td>
|
|
<td>
|
|
<p>Möria Kœté von Java</p>
|
|
</td>
|
|
<td>
|
|
<p>Möria K. v. Java</p>
|
|
</td>
|
|
<td>
|
|
<p>Möria K. v. Java</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p>Jamé de Häring</p>
|
|
</td>
|
|
<td>
|
|
<p>Jame de Haering</p>
|
|
</td>
|
|
<td>
|
|
<p>J. d. Häring</p>
|
|
</td>
|
|
<td>
|
|
<p>J. d. Haering</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p>Jame d. Haering</p>
|
|
</td>
|
|
<td>
|
|
<p>dr Jamé de Häring</p>
|
|
</td>
|
|
<td>
|
|
<p>John de Haering</p>
|
|
</td>
|
|
<td>
|
|
<p>dr Jamé de Häring</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<p style="margin-bottom: 0cm;" align="center"><font size="2">table
|
|
Examples of names in different contexts</font></p>
|
|
<p><strike>If the governmental ID indicates for part of the
|
|
Name a
|
|
type (title, first given name, secondary given name(s),
|
|
middlename(s), family name, and/or name extensions) and the Name in
|
|
the web account provides the type of name field attribute, this will
|
|
be assured in the Name account administration. </strike>
|
|
</p>
|
|
<h3 class="western">Capabilities</h3>
|
|
<p>A Member has the following capabilities derived from an
|
|
Assurance:
|
|
</p>
|
|
<table border="1" cellpadding="5" cellspacing="0">
|
|
<tbody>
|
|
<tr>
|
|
<td width="10%">
|
|
<p align="left"><em>Minimum Assurance Points</em></p>
|
|
</td>
|
|
<td width="25%">
|
|
<p align="left"><em>Capability</em></p>
|
|
</td>
|
|
<td width="65%">
|
|
<p align="left"><em>Comment</em></p>
|
|
</td>
|
|
</tr>
|
|
<tr valign="top">
|
|
<td>
|
|
<p align="center">0</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">request un-named certificates</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">although the Member's details are
|
|
recorded in the account, they are not highly assured.</p>
|
|
</td>
|
|
</tr>
|
|
<tr valign="top">
|
|
<td>
|
|
<p align="center">50</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">request named certificates</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">the name and Assurance Statement is
|
|
assured to 50 Assurance Points or more</p>
|
|
</td>
|
|
</tr>
|
|
<tr valign="top">
|
|
<td>
|
|
<p align="center">100</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">become an Assurer</p>
|
|
</td>
|
|
<td>
|
|
<p align="left">assured to 100 Assurance Points or
|
|
more, and other requirements listed below</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<p style="margin-bottom: 0cm;" align="center"><font size="2"><i>table
|
|
Assurance Capability</i></font></p>
|
|
<p>The CAcert Policy Statement (CPS) and other policies may list
|
|
other capabilities that rely on Assurance Points. </p>
|
|
<h2 class="western">3. The Assurer</h2>
|
|
<p>An Assurer is a Member with the following: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Is assured to a minimum
|
|
of 100 Assurance Points; </p>
|
|
</li>
|
|
<li>
|
|
<p>Has passed the Assurer Challenge. </p>
|
|
</li>
|
|
</ul>
|
|
<p>The Assurer Challenge is administered by the Education Team on
|
|
behalf of the Assurance Officer. </p>
|
|
<h3 class="western">The Obligations of the Assurer</h3>
|
|
<p>The Assurer is obliged to: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Follow this Assurance
|
|
Policy; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Follow any additional
|
|
rules of detail laid out by the Assurance Officer; </p>
|
|
</li>
|
|
<li>
|
|
<p>Be guided by the <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance Handbook</a> in their
|
|
judgement; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Make a good faith
|
|
effort at identifying and verifying Members; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Maintain the
|
|
documentation on each Assurance; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Deliver documentation
|
|
to Arbitration, or as otherwise directed by the Arbitrator; </p>
|
|
</li>
|
|
<li>
|
|
<p>Keep up-to-date with developments within the CAcert
|
|
Community. </p>
|
|
</li>
|
|
</ul>
|
|
<h2 class="western">4. The Assurance</h2>
|
|
<h3 class="western">The Assurance Process</h3>
|
|
<p>The Assurer conducts the process of Assurance with each
|
|
Member. </p>
|
|
<p>The process consists of: </p>
|
|
<ol>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Voluntary agreement by
|
|
both Assurer and Member or prospect Member to conduct the Assurance; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Personal meeting of
|
|
Assurer and Member or prospect Member; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Recording of essential
|
|
details on CAP form (below); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Examination of Identity
|
|
documents by Assurer and verification of recorded details (Name(s) and
|
|
Secondary Distinguishing Feature, e.g., DoB); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Allocation of Assurance
|
|
Points by Assurer; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Optional: supervision
|
|
of reciprocal Assurance made by Assuree (Mutual Assurance); </p>
|
|
</li>
|
|
<li>
|
|
<p>Safe keeping of the CAP forms by Assurer. </p>
|
|
</li>
|
|
</ol>
|
|
<h3 class="western">Mutual Assurance</h3>
|
|
<p>Mutual Assurance follows the principle of reciprocity. This
|
|
means
|
|
that the Assurance may be two-way, and that each member participating
|
|
in the Assurance procedure should be able to show evidence of their
|
|
identity to the other. </p>
|
|
<p>In the event that an Assurer is assured by a Member who is not
|
|
certified as an Assurer, the Assurer supervises the Assurance
|
|
procedure and process, and is responsible for the results. </p>
|
|
<p>Reciprocity maintains a balance between the (new) member and
|
|
the
|
|
Assurer, and reduces any sense of power. It is also an important aid
|
|
to the assurance training for future Assurers. </p>
|
|
<p><em>Evidence of Assurer status</em> <br>
|
|
On the question of
|
|
providing evidence that one is an Assurer, CAcert Policy Statement
|
|
(<a href="http://svn.cacert.org/CAcert/policy.htm#p3.2" target="_blank">CPS</a>)
|
|
says:<em> "The level at which each Member is Assured is public
|
|
data. The number of Assurance Points for each Member is not
|
|
published.</em>.". </p>
|
|
<h3 class="western">Assurance Points</h3>
|
|
<p>The Assurance applies Assurance Points to each Member which
|
|
measure the increase of confidence in the Statement (above).
|
|
Assurance Points should not be interpreted for any other purpose.
|
|
Note that, even though they are sometimes referred to as <em>Web-of-Trust</em>
|
|
(Assurance) Points, or <em>Trust</em> Points, the meaning
|
|
of the word
|
|
'Trust' is not well defined. </p>
|
|
<p><em>Assurance Points Allocation.</em> <br>
|
|
An Assurer can allocate
|
|
a number of Assurance Points to the Member according to the Assurer's
|
|
experience (Experience Point system, see below). The allocation of
|
|
the maximum means that the Assurer is 100% confident in the
|
|
information presented: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Detail on form, system,
|
|
documents, person in accordance; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Sufficient quality
|
|
identity documents have been checked; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Assurer's familiarity
|
|
with identity documents; </p>
|
|
</li>
|
|
<li>
|
|
<p>The Assurance Statement is confirmed. </p>
|
|
</li>
|
|
</ul>
|
|
<p>Any lesser confidence should result in less Assurance Points
|
|
for a
|
|
Name. If the Assurer has no confidence in the information presented,
|
|
then <em>zero </em>Assurance Points may be allocated by
|
|
the
|
|
Assurer. For example, this may happen if the identity
|
|
documents
|
|
are totally unfamiliar to the Assurer. The number of Assurance Points
|
|
from <em>zero</em> to <em>maximum </em>is
|
|
guided by the Assurance
|
|
Handbook and the judgement of the Assurer. </p>
|
|
<p>Multiple Names should be allocated separately in a single
|
|
Assurance. <strike>That is, the Assurer may allocate the maximum
|
|
to
|
|
one Name, half that amount to another Name, and zero to a third Name.</strike>
|
|
</p>
|
|
<p>A (new) Member who is not an Assurer may award an Assurer in a
|
|
reciprocal process a maximum of 2 Assurance Points, according to his
|
|
judgement. The Assurer should strive to have the Member allocate
|
|
according to the Member's judgement, and stay on the cautious side a
|
|
maximum of Assurance Points per Name; a (new) Member new to the
|
|
assurance process should allocate <em>zero</em> Assurance
|
|
Points
|
|
until they get some confidence in what is happening.</p>
|
|
<p>Each Name of a Member must have had at least two assurances to
|
|
reach 50 Assurance Points per Name. To reach 100 Assurance Points, at
|
|
least one Name of the Member must have been assured at least three
|
|
times. </p>
|
|
<p><strike>No Assurance process can give more than 50
|
|
Assurance
|
|
Points per Name. This means that to reach 50 Assurance Points
|
|
(certificate with a Name), a Member must have been assured at least
|
|
once. To reach 100 Assurance Points, at least one Name of the Member
|
|
must have been assured at least twice. </strike>
|
|
</p>
|
|
<h3 class="western">Experience Points</h3>
|
|
<p>The maximum number of Assurance Points that may be awarded by
|
|
an
|
|
Assurer is determined by the Experience Points of the Assurer. </p>
|
|
<dl>
|
|
<dt></dt>
|
|
<dd>
|
|
<table border="1" cellpadding="1" cellspacing="0" width="15%">
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<p><em>Assurer's Experience Points</em></p>
|
|
</td>
|
|
<td>
|
|
<p><em>Allocatable Assurance Points</em></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">0</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">10</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">10</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">15</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">20</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">20</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">30</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">25</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">40</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">30</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<p align="center">>=50</p>
|
|
</td>
|
|
<td>
|
|
<p align="center">35</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<p style="margin-bottom: 0cm;" align="left"><font size="2"><i>table
|
|
Maximum of Assurance Points </i></font></p>
|
|
<p style="margin-bottom: 0cm;" align="left"><br>
|
|
</p>
|
|
<p>An Assurer is given a maximum of 2 Experience Points for every
|
|
completed Assurance. On reaching Assurer status, the Experience
|
|
Points start at 0 (zero). </p>
|
|
<p>Less Experience Points (1) may be given for mass Assurance
|
|
events,
|
|
where each Assurance is quicker. </p>
|
|
<p>Additional Experience Points may be granted temporarily or
|
|
permanently to an Assurer by CAcert Inc.'s Committee (board), on
|
|
recommendation from the Assurance Officer. </p>
|
|
<p>Experience Points are not to be confused with Assurance
|
|
Points. </p>
|
|
<h3 class="western">CAcert Assurance Programme (CAP) form</h3>
|
|
<p>The CAcert Assurance Programme (CAP) form requests the
|
|
following
|
|
details of each Member or prospect Member: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Name(s), as recorded in
|
|
the on-line account; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Primary email address,
|
|
as recorded in the on-line account; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Secondary
|
|
Distinguishing Feature, as recorded in the on-line account (normally,
|
|
date of birth); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Statement of agreement
|
|
with the CAcert Community Agreement (CCA); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Permission to the
|
|
Assurer to conduct the Assurance (required for privacy reasons); </p>
|
|
</li>
|
|
<li>
|
|
<p>Date and signature of the Assuree. </p>
|
|
</li>
|
|
</ul>
|
|
<p>The CAP form requests the following details of the Assurer: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">At least one Name as
|
|
recorded in the on-line account of the Assurer; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Assurance Points for
|
|
each Name in the identity document(s); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Statement of Assurance;
|
|
</p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Optional: If the
|
|
Assurance is reciprocal, then the Assurer's email address and Secondary
|
|
Distinguishing Feature are required as well. </p>
|
|
</li>
|
|
<li>
|
|
<p>Date, location of Assurance and signature of Assurer. </p>
|
|
</li>
|
|
</ul>
|
|
<p>The CAP forms are to be kept at least for 7 years by the
|
|
Assurer. </p>
|
|
<h2 class="western">5. The Assurance Officer</h2>
|
|
<p>The Committee (board) of CAcert Inc. appoints an Assurance
|
|
Officer
|
|
with the following responsibilities: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Reporting to the
|
|
Committee and advising on all matters to do with Assurance; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Training and testing of
|
|
Assurers, in association with the Education Team; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Updating this Assurance
|
|
Policy, under the process established by Policy on Policy (<a href="https://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Management of all
|
|
Subsidiary Policies (see below) for Assurances, under Policy on Policy
|
|
( <a href="https://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Managing and creating
|
|
rules of detail or procedure where inappropriate for policies; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Incorporating rulings
|
|
from Arbitration into policies, procedures or guidelines; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Assisting the
|
|
Arbitrator in any requests; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Managing the Assurer
|
|
Handbook; </p>
|
|
</li>
|
|
<li>
|
|
<p>Maintaining a sufficient strength in the Assurance process
|
|
(web-of-trust) to meet the agreed needs of the Community. </p>
|
|
</li>
|
|
</ul>
|
|
<h2 class="western">6. Subsidiary Policies</h2>
|
|
<p>The Assurance Officer manages various exceptions and
|
|
additional
|
|
processes. Each must be covered by an approved Subsidiary Policy
|
|
(refer to Policy on Policy => COD1). Subsidiary Policies specify
|
|
any additional tests of knowledge required and variations to process
|
|
and documentation, within the general standard stated here. </p>
|
|
<p>Examples of expected subsidiary policies are these: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;"><em>Remote
|
|
Assurance Check (policy);</em> </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;"><em>Super Assurer
|
|
Policy;</em> </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;"><em>Junior
|
|
Assurer Policy;</em> </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;"><em>Code Signing
|
|
Policy;</em> </p>
|
|
</li>
|
|
<li>
|
|
<p><em>Organisation Assurance Policy and sub-policies
|
|
per country or region.</em> </p>
|
|
</li>
|
|
</ul>
|
|
<h3 class="western">Standard</h3>
|
|
<p>Each Subsidiary Policy must augment and improve the general
|
|
standards in this Assurance Policy. It is the responsibility of each
|
|
Subsidiary Policy to describe how it maintains and improves the
|
|
specific and overall goals. It must describe exceptions and potential
|
|
areas of risk. </p>
|
|
<h3 class="western">High Risk Applications</h3>
|
|
<p>In addition to the Assurance or Experience Points ratings set
|
|
here
|
|
in and in other policies, Assurance Officer or policies can designate
|
|
certain applications as high risk. If so, additional measures may be
|
|
added to the Assurance process that specifically address the
|
|
risks. </p>
|
|
<p>Additional measures may include additional information.
|
|
Additional
|
|
information can be required in process of assurance: </p>
|
|
<ul>
|
|
<li><dd>Unique numbers of identity documents; </dd>
|
|
</li>
|
|
<li><dd> Photocopy of identity documents; </dd>
|
|
</li>
|
|
<li><dd> Photo of User; </dd>
|
|
</li>
|
|
<li><dd style="margin-bottom: 0.5cm;"> Address of
|
|
User. </dd>
|
|
</li>
|
|
</ul>
|
|
<p>Additional Information is to be kept by Assurer, attached to
|
|
CAP
|
|
form. Assurance Points allocation by this assurance is unchanged.
|
|
User's CAcert (web)account should be annotated to record type of
|
|
additional information: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Arbitration: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Member to
|
|
participate in Arbitration. This confirms their acceptance of the forum
|
|
as well as trains in the process and import. </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Member to file
|
|
Arbitration to present case. This allows Arbitrator as final authority.
|
|
</p>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Additional training; </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Member to be Assurer
|
|
(>= 100 Assurance Points and passed Assurer Challenge); </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Member agrees to
|
|
additional specific agreement(s); </p>
|
|
</li>
|
|
<li>
|
|
<p>Additional checking/auditing of systems data by CAcert
|
|
support administrators; </p>
|
|
</li>
|
|
</ul>
|
|
<p>Applications that might attract additional measures include
|
|
code-signing certificates and administration roles. </p>
|
|
<h2 class="western">Privacy</h2>
|
|
<p>CAcert is a "privacy" organisation, and takes the
|
|
privacy of its Members seriously. The process maintains the security
|
|
and privacy of both parties. </p>
|
|
<p>Information is collected primarily to make claims within the
|
|
certificates requested by users and to contact the Members. It is
|
|
used secondarily for training, testing, administration and other
|
|
internal purposes. </p>
|
|
<p>The Member's information can be accessed under these
|
|
circumstances: </p>
|
|
<ul>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">Under Arbitrator
|
|
ruling, in a duly filed dispute (<a href="http://www.cacert.org/policy/DisputeResolutionPolicy.html" target="_blank">Dispute Resolution Policy</a>
|
|
=> COD7) </p>
|
|
</li>
|
|
<li>
|
|
<p style="margin-bottom: 0cm;">An Assurer in the
|
|
process of an Assurance, as permitted on the CAP form. </p>
|
|
</li>
|
|
<li>
|
|
<p>CAcert support administration and CAcert systems
|
|
administration when operating under the authority of Arbitrator or
|
|
under CAcert policy. </p>
|
|
</li>
|
|
</ul>
|
|
<p><a href="http://validator.w3.org/check?uri=referer"><img src="../Images/valid-xhtml11-blue" name="graphics2" alt="Valid XHTML 1.1" align="bottom" border="0" height="33" width="90"></a>
|
|
</p>
|
|
</body></html> |