{"action":"created","issue":{"url":"https://api.github.com/repos/uspki/policies/issues/18","repository_url":"https://api.github.com/repos/uspki/policies","labels_url":"https://api.github.com/repos/uspki/policies/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/uspki/policies/issues/18/comments","events_url":"https://api.github.com/repos/uspki/policies/issues/18/events","html_url":"https://github.com/uspki/policies/issues/18","id":186945411,"number":18,"title":"\"Authentication of individual identity\" too restricted?","user":{"login":"grandamp","id":13126304,"avatar_url":"https://avatars.githubusercontent.com/u/13126304?v=3","gravatar_id":"","url":"https://api.github.com/users/grandamp","html_url":"https://github.com/grandamp","followers_url":"https://api.github.com/users/grandamp/followers","following_url":"https://api.github.com/users/grandamp/following{/other_user}","gists_url":"https://api.github.com/users/grandamp/gists{/gist_id}","starred_url":"https://api.github.com/users/grandamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grandamp/subscriptions","organizations_url":"https://api.github.com/users/grandamp/orgs","repos_url":"https://api.github.com/users/grandamp/repos","events_url":"https://api.github.com/users/grandamp/events{/privacy}","received_events_url":"https://api.github.com/users/grandamp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-02T23:18:39Z","updated_at":"2016-11-03T14:37:27Z","closed_at":null,"body":"See:  https://github.com/uspki/policies/blob/master/certificate-policy.md#323-authentication-of-individual-identity\r\n\r\nAs far as I understand, this CP is for issuing device certificates, and *not* certificates to humans.  The only time I assume individuals are *authenticated*, is if they are a POC/device sponsor/etc.\r\n\r\nIf this is the case, the policy requirements for \"Authentication of individual identity\" appears limited, and based on traditional/analog means derived in 1876.  ( I.e., photo ID )  Further, is there any value of understanding the Individual's address?\r\n\r\nThe current language is below:\r\n\r\n> If an Applicant subject to this Section is a natural person, then the CA SHALL verify the Applicant's name, Applicant's address, and the authenticity of the certificate request.\r\n\r\n>The CA SHALL verify the Applicant's name using a legible copy, which discernibly shows the Applicant's face, of at least one currently valid government-issued photo ID (passport, drivers license, military ID, national ID, or equivalent document type). The CA SHALL inspect the copy for any indication of alteration or falsification.\r\n\r\n>The CA SHALL verify the Applicant's address using a form of identification that the CA determines to be reliable, such as a government ID, utility bill, or bank or credit card statement. The CA MAY rely on the same government-issued ID that was used to verify the Applicant's name.\r\n\r\n>The CA SHALL verify the certificate request with the Applicant using a Reliable Method of Communication.\r\n\r\nWe *have* spent a lot of time and public funds for PIV and PIV-I credentials.  Could a digital signature from *any* of those credentials suffice for this requirement?  Further, consider an automated certificate management protocol, such as ACME, and authentication of the administrator.  See:\r\n\r\nhttps://github.com/letsencrypt/acme-spec/blob/master/draft-barnes-acme.md\r\n\r\nAdding emphasis on the item below:\r\n\r\n> Receive CA challenge at a **_(hopefully)_** administrator-controlled e-mail address corresponding to the domain and then respond to it on the CA's web page.\r\n\r\nCould the administrator benefit by receiving an *encrypted* email from the CA that can only be decrypted using the PIV credential?  It does add privacy, and authentication of individual identity, to the automated process for first time retrieval.  Updates/Rekeys could then be fully automated with much less concern."},"comment":{"url":"https://api.github.com/repos/uspki/policies/issues/comments/258160373","html_url":"https://github.com/uspki/policies/issues/18#issuecomment-258160373","issue_url":"https://api.github.com/repos/uspki/policies/issues/18","id":258160373,"user":{"login":"LarryFrank","id":23189292,"avatar_url":"https://avatars.githubusercontent.com/u/23189292?v=3","gravatar_id":"","url":"https://api.github.com/users/LarryFrank","html_url":"https://github.com/LarryFrank","followers_url":"https://api.github.com/users/LarryFrank/followers","following_url":"https://api.github.com/users/LarryFrank/following{/other_user}","gists_url":"https://api.github.com/users/LarryFrank/gists{/gist_id}","starred_url":"https://api.github.com/users/LarryFrank/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LarryFrank/subscriptions","organizations_url":"https://api.github.com/users/LarryFrank/orgs","repos_url":"https://api.github.com/users/LarryFrank/repos","events_url":"https://api.github.com/users/LarryFrank/events{/privacy}","received_events_url":"https://api.github.com/users/LarryFrank/received_events","type":"User","site_admin":false},"created_at":"2016-11-03T14:37:27Z","updated_at":"2016-11-03T14:37:27Z","body":"More important than \"address\" (which is useless in this context) is that the person is affiliated with the government organization that owns the server the TLS cert is for.  I see no reason a department of the treasury person would ask for a gsa.gov cert.  "}}
{"actor":{"display_login":"LarryFrank"}}