• Roots
• NewRootsTaskForce

Background

CAcert uses roots as described at Structure of Roots and many other places. Because the existing roots have been deemed to be Audit Fail here, we have to create new ones that are capable of passing a future audit.

Authority

The Board authorises creation of roots and subroots from time to time. The procedures are authorised under DRAFT Security Policy and are indexed into the Security Manual. Also see the wip DRAFT.

Work List / wip Procedures

We need a collection of procedures and guidelines for each stage:

1. technical organisation of roots:

   • Roots/Structure describes the hierarchy and relationship between the roots

   • Roots/Contents describes the internal fields in each Roots.

2. ceremony for creation of root (s)

   • Roots/CreationCeremony is open as a place to develop this need

   • Roots/TechScript is where the geeky arcania can be collected

3. storage securely on signing server
4. escrow root securely for disaster recovery

   • Roots/EscrowAndRecovery is open for jotting notes...

5. finally, when all is good, start the rollout procedure

   • Roots/RolloutProcedure is open for jotting notes...

   • of which an important part is Roots/TestNewRootCerts

Note that as we decide on the way to do this, the process should be aligned with DRAFT Security Policy and the wip Security Manual. These pages are the works-in-progress procedures and guidelines of the New Roots Task Force, and include any procedures authorised in SP/SM.

Unresolved Issues

These need to be addressed:

• Creation of an offine root escrow method at Roots/EscrowAndRecovery

• Creation of sub-roots for different CAcert functions:
  • Web of Trust (eg CAP)
  • Remote Assurance (eg RAP)
  • Organisation Assurance (eg OAP) (from which our organisations get their certs)

• Creation of sub-roots for assured organisations (from which organisations can issue certificates from their own sub-root)

Planning

Currently there is no plan on the table. In order to proceed, fill in the following:

Team

take a guide from the 2008 team below.

Plan

Time-based.

Logistics

Hotels, locations, travel costs, etc.

Historical

Timeline

• At Top 2007, auditor announced that the old roots had to be replaced.
• Planning for the new roots started around mid 2008, as part of the "May Plan."
• A meeting at or around 20081002 worked through the software and shook out bugs.

• Roots/20081128 resulted in the creation of Top-level root and 2 subroots (Member & Assured). However the follow-up phases did not complete.

• An opportunity for using HAR2009 was suggested but did not work out.

Teams

Root Key Task Force of 2008 was a CAcert Sub-Committee installed by board motion m20081008.1 see Board decision list 2008. Task Force has the following members: Guillaume Rogmany, Teus Hagen and advisor (Philipp Gühring). Audit is observer (Ian Grigg).

The following teams:

CategoryAudit