Assurance Policy

v 0.4 status is work-in-progress. Skip down to Preamble to see the wip text.

-1. TodDo

Hot Debates

Related Changes

Changes that have to be done to meet new assurance requirements:

0. Preamble

Assurance is the process by which a member of CAcert identifies another member. With sufficient assurances, a member may (a) issue certificates with their names included, (b) participate in assuring others, and (c) other related activities. The strength of these activities is based on the strength of the assurance.

The CAcert Web of Trust

Each assurance claims a number of points, applied to the assured member. By combining the assurances, and the points, CAcert constructs a global web of trust ("WoT").

CAcert explicitly chooses to meet its various goals by construction of a WoT of all members. This is done by members meeting face-to-face, identifying and sharing claims in a network. Maintaining a sufficient strength for the WoT is a high-level objective of the Assurance process.

Related Documentation

Documentation on Assurance is split between this policy and the Assurance Handbook. The policy is controlled by CCS under PoP. Because Assurance is an active area, much of the practice is handed over to the Assurance Handbook, which is not a controlled document, and can more easily respond to experience and circumstances. It is also more readable.

See also Organisation Assurance Policy and CPS.

Purpose

The purpose of Assurance is to add confidence in the Statement made of a Member by the Community.

The Statement

The following claims can be made about a person who is assured:

  1. The person is a bona fide CAcert Member. In other words, the person is a member of the CAcert Community, as defined by the CAcert Community Agreement.
  2. The Member has a login account with CAcert's online registration and service system.
  3. The Member account can be determined from any certificate issued by the account.
  4. The Member is bound into CAcert's Arbitration.
  5. Some personal details of the Member (names, emails, Date of Birth) are known to CAcert.

The confidence level of the Statement is expressed by the Assurance Points.

Relying Party Statement

When a certificate is issued, some or all of the above may be implied as the Relying Party Statement for the purposes of the Certification Practice Statement (CPS). This means that other Members of the Community may rely on the information found in the certificate.

In particular, certificates are sometimes considered to provide reliable indications of the member's Name. The nature of the WoT the number of Assurance Points, and other policies and processes should be understood as limitations on any reliance.

Member

The Name

The general standard is that the name of the Member is as written on a government-issued Identity document.

For more details see the PolicyDrafts/PolicyOnNames, where the discussion is carried on.

Should the page be included here? For discussion I guess it's easier to keep them seperated. [BernhardFröhlich] IMHO, yes, agreed both, separate for now, combine later [iang]

Capabilities

A Member has the following capabilities:

Minimum Points

Capability

Comment

0

request un-named certificates

although the Member's name is recorded in the account, it is not highly assured.

50

request certificates with name and/or email

Member's name and primary email address is assured to 50 points or more

Multiple Names

A Member may have multiple names. For example, married names, variations of initials of first or middle names, and different language or country variations. Each individual name must be assured to 50 points to be used in a certificate.

(Note that the Account system has not yet been changed to implement the multiple name feature.)

The Assurer

An Assurer is a Member with the following:

The Assurer Challenge is administered by the Education Team on behalf of the Assurance Officer. Assurance procedures are covered by the Assurance Handbook.

Representations and Warranties

This statement found in CPS:

RAs (Assurers and Trusted Third Parties) represent and warrant that they will conduct a good faith effort at identifying potential subscribers (the process of assurance), and that they will maintain the documentation on each assurance for the period applicable. RAs are responsible for making available such Assurance documentation as ordered by the Arbitrator.

should be incorporated some how to give CPS9.6.2 some force.

The Assurance

The process

The Assurer conducts the process of Assurance with each Member.

The process consists of

  1. voluntary agreement by both Assurer and Member to conduct the Assurance.
  2. personal meeting of Assurer and Member
  3. recording of essential details on CAP form (below).
  4. examination of Identity documents by Assurer and verification of recorded details.
  5. allocation of Assurance Points by Assurer.
  6. safe keeping of the CAP forms by Assurer.

Reciprocity

Assurance follows the principle of reciprocity. This means that it may be two-way, and that each member should be able to show evidence of their status to the other.

In the event that an Assurer is assured by a Member who is not certified as an Assurer, the Assurer supervises the process and is responsible for the results.

Reciprocity maintains a balance between the new Member and the Assurer, and reduces any sense of power. It is also an important aid to training for future Assurers.

Non-policy Notes:

Assurance Points

The Assurance applies Assurance Points to each Member which measure the increase of confidence in the Statement (above).

Assurance Points should not be interpreted for any other purpose. Note that, even though they are sometimes referred to as Web-of-Trust points, or Trust points, the use of the word 'trust' is not well defined.

An Assurance can apply a maximum of 35 Assurance Points to the Member. A full Assurance with 35 points will consist of the following:

Any lesser result should give less points. The number of points is guided by the Assurance Handbook and the judgement of the Assurer.

(Notes: Two tries to specify the number of points to be awarded have been made at PolicyDrafts/IdChecking. Are 2 official IDs essential for 35 points? As discussed on the mailing list the "checking of email address" has to be specified in detail... BernhardFröhlich)

A Member who is not an Assurer may award an Assurer in a reciprocal process a maximum of 2 Assurance Points, according to Member's judgement.

No assurance process can give more than 50 points. This means that to reach 50 points, a Member must have been assured at least once. To reach 100 points, a Member must have been assured at least twice.

Non-policy Notes:

Experience Points

The maximum number of Assurance Points that may be awarded by an Assurer is determined by the Assurer's Experience Points.

An Assurer is given 2 Experience Points for every completed Assurance. For historical reasons, the Experience Points start at 100. Additional Experience Points may be awarded temporarily or permanently to an Assurer by CAcert's board(?).

Experience Points are not to be confused with Assurance Points.

CAP Form

The CAcert Assurance Programme Form requests the following details of the assured Member:

The Form requests the following details of the Assurer:

The CAP forms are to be kept for 7 years by the Assurer.

Subsidiary Policies

The Assurance Officer manages various exceptions and additional processes. Each must be covered by an approved subsidiary policy (Policy on Policy => COD1). Subsidiary policies specify any additional tests of knowledge required and variations to process and documentation, within the general standard stated here.

Note: expected subsidiary policies are these:

Standard

Each subsidiary policy must augment and improve the general standards in this Assurance Policy. It is the responsibility of each subsidiary policy to describe how it maintains and improves the specific and overall goals. It must describe exceptions and potential areas of risk.

High Risk Applications

In addition to the points ratings set here in and in other policies, Assurance Officer or policies can designate certain applications as high risk. If so, additional measures may be added to the Assurance process that specifically address the risks. These may include:

Additional Information is to be kept by Assurer, attached to CAP. Points allocation by this assurance is unchanged. User's account should be annotated to record type of additional information.

Applications that might attract additonal measures include code-signing certificates and administration roles.

Privacy

CAcert is a privacy organisation, and takes the privacy of its members seriously. The process maintains the security and privacy of both parties.

Information is collected primarily to make claims within the certificates requested by users and to contact the users. It is used secondarily for training, testing, administration and other internal purposes.

The Member's information can be accessed under these circumstances:

Completed

DoB

PolicyDrafts/AssurancePolicy (last edited 2008-05-06 19:30:31 by Sun Tzu Melange)