CAcert assurer handbook

This is still a draft and is thought for internal use only! Please correct and complete it so it is soon useful for our new assurers.

Introduction

This handbook is intended for fresh CAcert assurers. It should give you a first guide on what to do and what to know when acting as a CAcert assurer, and serve as a starting point for more in depth research on specific topics.

Overriding Documents

Although this document can be considered to be your working "Assurer's bible", there are several other documents of importance. Especially,

A word on Policies

This Handbook is not a policy, but a working practices guide. In the case of contradictions, policies are the final authority, so this Handbook has to conform to those documents. If you find such contradictions please make them known to CAcert's policy mailing list at [ cacert-policy@lists.cacert.org ].

Other policies and documents of CAcert can be found at OfficialDocument. The work of creating policies is controlled by Policy on Policy and is conducted in the open at CAcert's policy mailing list at [ cacert-policy@lists.cacert.org ]; any Member may join and contribute. When documents are still being written they are referred to as work-in-progress or WIP, above. When approved in DRAFT, they are binding on the community, but still being finalised. When fully approved they are marked as POLICY and are officially published on the controlled website at https://www.cacert.org/policy.

All policies have an effect on assurance, although they may not address assurance explicitly. For example, the Privacy Policy also has some impact on the process.

Your obligations as an Assurer

Some easy ways to keep you informed about important changes in the policies are

Your risks and liabilities

By joining CAcert you accept the CAcert Community Agreement (CCA), which defines the risks and liabilities of CAcert members. You should be very familiar with this document so that you can understand these risks and liabilities, for yourself, and for any new and prospective Members that ask questions about the issues.

There is both good news and bad news: The CCA places a limit on monetary liability to you of 1.000 EUR (one thousand Euros). Each member accepts Arbitration, which is our system to keep disputes internal, rather than expose our members to courts in far away lands, expensive lawyers, and judgements that might not fully appreciate what certificates are about. The limit of liability is balanced across the Community, as it applies to you as well as to anyone who has a dispute with you, so it is both a maximum to protect you, and a liability directly to you.

Therefore, you should always be careful when doing Assurances, because you can be held responsible by the Arbitrator up to this limit!

The Assurance Procedure

The assurance procedure is the one crucial point in the whole CAcert project. If the assurances are conducted in a reliable way, members will be able to usefully rely on the CAcert certificates. If assurances are made superficially, this reliance will fail and the project will go down the drain. So we all depend on you!

The following procedure is a proposal. You may alter the process, but then you have to make sure that your process conforms to CAcert's CPS!

Make yourself known as a CAcert assurer

Probably the best way to do this is to enter a location into your profile and allow your entry to be shown in the users list. Other ways, like advertising yourself among your friends and colleagues, are left at your discretion.

Preparing yourself for an assurance

Now let's assume that someone has contacted you and asks you to assure his or her identity for CAcert. There are other ways to do a correct assurance, but this is a good way to start with.

Print out a pre-filled CAP form

First of all you should check whether the applicant already has an account at CAcert. Go to https://secure.cacert.org/wot.php?id=5 and enter the applicant's mail address. If the email was correct you will be shown the interactive assurance form. Do not fill out anything at this time! Just use one of the links at the bottom to open and print out a PDF document containing the pre-filled CAP form.

If the email address is not found within the system, ask the Member to give you the primary email address for the account.

Non-Members

If the user has not yet created the account, you will not be able to find it. In this case, the user is not yet a Member, and you should ask her to create her account and become a Member before doing the Assurance.

In some circumstances, such as mass Assurance Events like CeBIT or a chance meeting, it may be reasonable to do the Assurance in advance of the user becoming a Member. However, this should be avoided where possible, as there are some security and legal risks if a person is assured first and the account is created later. For instance, the user will not have had time to read the CCA, which she could more easily do online or later on (at these events, always have copies of the CCA to hand out).

Suggested Procedure: In the case where you decide to go ahead and do the Assurance with a non-Member, in advance of account creation and full acceptance of the CCA, follow this procedure in order to protect the non-Member and yourself:

In this way, you indicate that the member-to-be will have time later on to read the CCA, and on account creation, she will confirm her agreement. If the account is never created, the agreement is null and void, and your CAP can be marked so or destroyed. Meanwhile, you and her have both agreed to conduct the Assurance under CAcert's policies and dispute resolution procedures.

Inform yourself about the documents the applicant wants to present

You should ask the applicant which ID document s/he wants to present. Remind him/her that you have to see the originals of at least one (two are preferred!) photo IDs, at least one of them has to be government issued containing the birthdate. If s/he wants to present unusual or foreign documents please inform yourself in advance about how this documents should look like. You may use the page AcceptableDocuments as a starting point for such a research.

Maybe ask the applicant to check expiry dates of the documents, so s/he does not leave you in the difficult situation to decide whether expired documents are valid.

Plan the meeting

You have to meet the applicant face to face and shake hands with him/her. No assuring on the phone, not even via video phones!

So you have to find a meeting place. If your employer tolerates this, your office may be a good meeting point. Of course you can meet at your home if you want to. Otherwise some not too crowded pub would be a nice place.

Take the pre filled CAP form to the meeting, and don't forget a ballpen, since the applicant has to sign the form!

The meeting

Please try to make sure that you are not in a hurry during the meeting. You should have at least five minutes to check the documents and let the applicant sign the form! Take your time.

Shake hands with the applicant, maybe give him/her a nice smile. Check that the data contained in the documents (that is names and birthdate) is identical to that on the pre filled CAP form. Let the applicant sign the CAP form and note the kind of presented documents (like passport, ID-card, driver's license) on it.

Have a little chat with the applicant, if time permits and both parties are interested. ;-)

Some points to keep in mind:

After the meeting

If you did notice anything unusual, make some notes on the backside of the CAP form. Things you should note include (but are not restricted to):

Those notes might help you to remember what happened later, just in case a dispute is filed and someone asks you about details of the meeting.

Now login to the CAcert website, go to https://secure.cacert.org/wot.php?id=5 once again and enter the applicants email. Now fill out the assurance form, check the data once again and issue your points if there are no reasons against. If the situation was not ideal you should give less points, see PolicyDrafts/IdChecking for some guidelines about the number of points to give.

Please do not issue 0 points in the form, zero points are reserved for special occasions (there is still some discussion about exactly which occations). If there are serious doubts do not complete the assurance form! Also, if you cannot make any statement about the candidate, for example because you cannot read those chinese characters at all, or you have no idea about the issuing country, do not complete the form.

Remember the following issues:

What about that CAP form?

As well as the Assurance details, the CAP form (short for CAcert Assurance Programme form) must contain:

For a normal one-way Assurance, cross out the fields for your email address and Date of Birth, as desired. For a mutual Assurance, fill them in. If the other Member is not an Assurer as yet, then you keep the CAP form(s) on her behalf (and take responsibility for both Assurances) which is why the form itself has both sets of details on it.

As it is stated on the form you have to securely keep that paper CAP form for at least seven years. You are personally responsible for that! It is your evidence that you followed CAcert's policy and that you met the applicant in person (face to face).

For data protection and privacy reasons no-one else should have access to the CAP forms, once completed. Do not scan the CAP form and keep it electronically. CAcert's Assurance is deliberately designed to create a paper foundation on which digital certificates are issued; by maintaining a base of paper, the digital framework is strongly constructed with a classical legal foundation. Not only does scanning weaken that foundation, you may also violate data protection laws on electronic data storage.

In the case of a dispute you may be requested to send the original paper form to a CAcert Arbitrator. If you find yourself unable to keep the CAP forms for whatever reason, file a dispute at support@cacert.org, explain the circumstances, and request the Arbitrator to provide instructions.

Sending CAP forms to CAcert by request

This paragraph is still preliminary and contains some assumptions that are not verified. Please use them as food for thought about the issue.

An Arbitrator may request you to send CAP forms to CAcert, maybe because there was a complaint about a certificate or just as part of a quality assurance process. CAP forms contain personal data, so the requestor has to be authorized to see them and you have to make sure that noone else can read that data.

Fees

The Standard of Assurance

IMHO this paragraph still needs some work to be less confusing for newbie (and experienced) assurers. The CAP links to this handbook for a definition of the "Standard of Assurance", so it has to be done. I'm still thinking about it, if you have an idea feel free to propose it. BernhardFröhlich

Also, see PolicyDrafts/AssurancePolicy as a wip ... which should nail down the Standard of Assurance ... once and for all :) iang.

PolicyDrafts/IdChecking gives two different suggestions to the number of points to be awarded for an Assurance

The approximate standard for an Assured User is:

  1. at least one government-issued photo ID containing the date of birth must be verified
  2. must have been verified by at least two Assurers. Exeptions see below in "Major Variations"

A standard verification is performed by an Assurer as such:

  1. The Assurer and the User meet face-to-face.
  2. The Assurer verifies the following forms of identification:
    1. At least one government-issued photo ID. Acceptable forms include Passports, Drivers Licenses and National Identity Cards
    2. If possible one of the following:
      • A second government-issued photo ID.
      • A government-issued ID without a photo.
  3. The Assurer records the Authoritive Name as found on the forms of identification. The Authoritive Name of a User means as indicated in government-issued documents, and sufficiently narrow as to make dispute resolution feasible.
  4. Authoritive Name, email address and date of birth is the current policy (see Assurance forms). Identity numbers are not to be stored ever due to problems with liability and the potential to cause ID theft.
  5. the Assurer matches the Authoritive Name recorded above to the User's recorded Name in their CAcert account.
  6. each Assurer allocates points to the user according to quality of the documentation in (2) above, and the Assurer's level.

In general, an Assurer can award no more than 35 points. A user becomes an assured User if s/he has been awarded at least 50 points.

At 100 points the user may become an Assurer by successfully completing the AssurerChallenge.

Minor Variations

An Assurer controls minor variation, such as poor quality ID or missing ID, by reducing points.

Major Variations

Three Major Variations exist to the above

Frequently encountered situations

More information on name matching can be found at PolicyDrafts/PolicyOnNames.

Transliterations

Usual transliterations, missing accents and similar things are accepted. So if the ID doc says "André Müller" but the name in the account is "Andre Mueller" that's ok.

Note that the reason for accepting plain ASCII representations of non-ASCII characters are usual restrictions of computer environments. Therefore it is not accepted to assure someone as "Müller" if the ID documents contain "Mueller".

Still it's not defined how names of other character sets (like for example Cyrillic or Hebrew) should be handled. Transliteration rules can be found at http://en.wikipedia.org/wiki/Transliteration

Middle names and Initials

Middle names are optional in the CAcert Account. So someone called "Bernhard Andreas Fröhlich" may create his account as "Bernhard Fröhlich", "Andreas Fröhlich" or "Bernhard Andreas Fröhlich". Initials are deprecated, but are currently tolerated, so if the said person would use the name "Bernhard A. Fröhlich" this would currently be OK. This may change in the future, so keep your eyes open.

But remember, you may not assure an Account with a name you did not see on at least one ID document! If all ID docs state "Bernhard Fröhlich", assuring him as "Bernhard Andreas Fröhlich" is prohibited!

If the name on the presented ID documents is not identical to that on the CAP form it is the best to note the name as exactly as possible somewhere on the paper, including all given/middle names. If the account is disputed later then you can remember the exact name you've seen.

Multiple Names, Pseudonyms

According to the WIP PolicyDrafts/AssurancePolicy multiple names are accepted, if matching ID documents can be presented. But currently the CAcert software cannot handle them.

Some more information on CAcert

You are CAcert's "face to the customer". So you should be able to give at least some basic information about CAcert itself.

What is CAcert

CAcert is a non profit association incorporated in Australia. It is supported by a growing community of assurers (like you) who are part of a "Web-of-Trust" for identity verifications.

What is the goal of CAcert?

For more information see http://svn.cacert.org/CAcert/principles.html.

What is the difference to other CAs?

Arbitration

Arbitration is CAcert's main channel for dealing with anything unexpected or unusual that might go wrong. This includes complaints about inappropriate conduct of an Assurance, invalid or inappropriate data in any member account, or inappropriate usage of certificates. Indeed, just about anything may be disputed, and the policy documents often defer difficult issues by simply saying file a dispute. In this way, the policy documents and Arbitration work hand-in-hand: Policy handles the expected and the easy; Arbitration handles the unexpected and the hard, and both of them together provide the foundation for all work done in CAcert.

As a part of accepting the CAcert Community Agreement (CCA), every member accepts Arbitration according to CAcert's Dispute Resolution Policy (DRP). Anyone who has a complaint about anything relating to CAcert may file a Dispute by sending a mail to mailto:support@cacert.org. You will be notified of any dispute via your primary email address, so you are required in CCA to keep this working.

Once a dispute is filed and notified, an Arbitrator is chosen by CAcert from amongst our own senior and experienced Assurers. Arbitrators are strongly familiar with the policies, rules, principles, customs and specialities of CAcert. As an Assurer, you should be somewhat familiar with the rules, and at the least, know where to find them so as to answer basic questions from members.

The process of an Arbitration is this, in brief:

  1. the Arbitrator looks at the situation by means of evidence,

  2. applies the policies and rules, and if necessary the law (of NSW, Australia), and
  3. delivers a ruling.

The ruling is binding on you, all members, and CAcert itself. It is generally published so that all the Community can watch and govern the system, and we can improve our policies and practices over time.

As we use Arbitration for all sorts of unusual and difficult questions, being named in an Arbitration is no bad thing, in and of itself; indeed, it is a mark of experience to participate. One day, you may be asked to sit as an Arbitrator, and this will likely require you to have been named in Arbitrations. You can find more details and many references at our ArbitrationForum.

Background to Alternative Dispute Resolution

CAcert has introduced Arbitration as a protection for its members.

Normally, if something goes terribly wrong, you might be dragged into a civil court to face a lawsuit. Especially, as CAcert provides certificates making statements about people across the world, it is highly likely that any lawsuit would be filed in a country far away. In your country, the system of justice may have a reputation for looking after you, but this is not true of all places. At a minimum, remote systems of justice will be difficult and expensive for you to understand and navigate, even if they are fair. As well, there will be expensive lawyers, and you may be hit with a harsh judgement that does not fully appreciate what certificates are about and what we as a Community are about. Even if the court rules in your favour, it could be a Phyrric victory, one that you could not afford.

Therefore, instead of using the courts, we agree to deal with all our disputes internally. The authority for this is found under the Arbitration Act in each country, and in the clause in the CCA: 

3.2  Arbitration as Forum of Dispute Resolution

You agree, with CAcert and all of the Community, that all disputes arising out of or in connection to our use of CAcert services shall be referred to and finally resolved by Arbitration under the rules within the Dispute Resolution Policy of CAcert (DRP => COD7). The rules select a single Arbitrator chosen by CAcert from among senior Members in the Community. The ruling of the Arbitrator is binding and final on Members and CAcert alike.

You should be familiar with that clause and how to explain it to new and prospective Members.

Most countries have Arbitration Acts in place as law (see for example the German Arbitration Act) that permits and even encourages internal Arbitration such as ours. This makes sense where a local or specialised community might have a better understanding of their own conventions and rules, where international affairs make it impractical to choose a neutral or cost-effective court, and where the real natures of the disputes do not justify the expense of the courts (and especially the lawyers).

These aspects are a natural fit for CAcert because we are in a complex international environment of Assurances, the Internet and certificates. The Arbitration Act provides us with a way to deal with any disputes internally, rather than going to courts, which likely are in far away countries, involve expensive lawyers, and have little knowledge of the process of certificates. Hence, we achieve a balanced and cost-effective legal approach across the entire Community, which applies to you as well as every other member, and to CAcert itself.

In the event of any lawsuit filed against you in relation to your CAcert activities, you should ask the court to refer the case back to Arbitration, citing the above clause and Act. There is no guarantee that a case will be so referred, and criminal cases are not referred, but as a matter of public policy courts will routinely refer cases back to Arbitration where this was the agreement.

The intent to protect you and all members. This means that, in order to protect other members, an Arbitration case may result in some penalty imposed upon you if the Arbitrator finds that you were acting against CAcert's policies, rules and/or principles! See DRP section on remedies for more details.

How is privacy protected?

For more details look at the official privacy policy at http://www.cacert.org/index.php?id=10

Is CAcert included in browsers by default?

How many people use CAcert?

Point scheme

Note: The meaning of the points is different below and above 100 points. Below 100 the number of points show the amount of trust CAcert has in your identity. The points above 100 make some statement about your experience as an Assurer, so they are sometimes called Experience Points.

Currently points acquired do not "expire" or "decay", but this might be changed in the future.

Table of issueable points

Your Assurance Points

Issuable Points

100

10

110

15

120

20

130

25

140

30

150

35

For every assurance one gets 2 points up to the maximum of 150 points.

Some technical aspects

While assuring people they may ask you some technical questions. Just to help you to pose as a real crack, here are some basics. ;-)

What are public and private keys?

"Public key cryptography" works with pairs of public and private keys. Each key can be used to encrypt data that can be decrypted by someone with the other of the other part of the key.

The public part is made available as broadly as possible since this is the one that can be used to encrypt data that only the owner of the private key can decrypt. It also allows decryption of data which has been encrypted by the private key.

So if you want to send someone an encrypted message you need your partner's public key. If you loose your private key you cannot decrypt messages sent to you any more.

By encrypting a document's hash value with your private key you can create a digital signature, which everyone can verify using yur public key.

The public part of the key can be created from the private key, but the public part does not allow to anyone to guess the corresponding private key. Or better, it is really very very hard to guess the private key from the public part if the private key is "big enough".

What is a digital signature?

A digital signature is a kind of "seal" attached to a document that guarantees that the signed document has not been changed since the creation of the signature and it guarantees that it was created by someone who has access to the corresponding private key.

Technically speaking it is a hash value of the document encrypted by the private key of the signer. There are many different ways on how to implement this in details.

What is a certificate

A certificate in this context is a "document" containing a public key and some informations about the owner of this key, which is signed by a Certification Authority ("CA"). A typical CA defines the exact meaning of a certificate, for example who can get one and what checks are made, in its "Certificate Practice Statement" (CPS).

In theory you should examine a CA's CPS very closely before deciding whether to trust this CA's certificates or not.

Certificates following the X509 standard, like those issued by CAcert, contain an issuing date and an expiry date as well as hashes (or "data fingerprints") used to validate the certificate. In addition CAcert's certificate can include some information about the user, like his/her name or eMail-address, if the user requests inclusion of this information.

What can I do with certificates issued by CAcert

Secure web servers

You can generate certificates for https servers. Though at the moment CAcert's root is not included in standard Mozilla and Internet Explorer, it is already included in several Unix-like distributions.

And it's easy to install CAcert's root certificates manually.

X509 Client certificates

These can be used to encrypt and/or digitally sign emails. They may also used as a way of authenticating with web servers, like the certificate login on CAcerts website or VPN servers.

Code signing and IDN certificates

You can generate certificates for code signing and IDN (International Domain Names). Due to the increased possibilities for abuse those certificates have additional requirements. You need at least 100 points and you have to send a copy of your Photo ID to CAcert.

OpenPGP signatures

Get your PGP keys signed by CAcert's key. This should considerably increase the trust in your PGP key since many people trust CAcert's signature.

Does CAcert use OCSP?

Yes, CAcert offers online certification verification via the OnlineCertificateStatusProtocol: http://ocsp.cacert.org/

Where can I get more help with technical problems

Try http://wiki.cacert.org/wiki/CAcert as a starting point.

Appendix

Hints for organizing events

Help & Support

 CAcert Headquarter
 P.O. Box 4107
 Denistone East NSW 2112
 AU- Australia

 support (at) cacert.org

 CAcert support Austria:
 http://www.cacert.at/
 office@cacert.at

On the internet:

Wiki: http://wiki.cacert.org/

Chat: irc.cacert.org

If you do not know how to use an ircclient you may also try the CAcert Web IRC or Webchaton

CAcert Wiki: AssuranceHandbook2 (last edited 2008-07-07 20:29:20 by Guillaume ROMAGNY)