Possible solution for same origin policy problem in Web Certificate API

Hi all,

I presented draft Web Certificate API in April F2F meeting and there were many questions about
same origin policy problem in WebCert.
The following is a possible solution for same origin problem in WebCert to consider.

PKI operates based on the concept of a circle of trust or trust domain with a Trusted Third Party. When a browser sends a digitally signed document to a web server, the server can verify the signature using a certificate sent from the browser. This can only be possible when two entities trust a CA server that issued the certificate. In this case, if the web server and CA server operates in the same domain, then PKI works fine under same origin policy (SOP). Otherwise it will not work unless cross origin policy (COP) is permitted.
We can find an example how PKI used in the web environment without SOP. In SSL client authentication, a web server can send a trusted CA list to a web browser to indicate which certificate can be used for client authentication. This means that TLS/SSL protocol works in the absence of same origin policy.

From this example, I think that the SOP and COP can co-exist in a single web browser as follows.
The Korean banking use case indicates that a user gets a certificate issued by a CA server and uses it to a bank for digital signature. The URL of two websites, CA server and bank, is totally different. So cross origin policy is strongly required to support for this use case.
As it is used in SSL case, if a server sends no trusted CA list to a web browser, the same origin policy governs to access to a stored certificate and the key belongs to the origin server.

On the other hands, if the server sends a trusted CA list, COP governs and the web browser can access any certificate that is issued by trusted CAs and in this case the key belongs to a user and the proof of the ownership is done by decrypting the encrypted private key.
With respect to WebCrypto API, public key can be used under same origin policy. This is ok since public key algorithm can be only used between two entities without involving CA server to issue a certificate. However, Web Certificate API cannot work under SOP because it is operated based on PKI which requires a Trusted Third Party to issue and manage a certificate.

I hope that the group reconsiders the suggested solution for same origin policy problem in WebCert.

Regards

Sangrae Cho
===========================================================
Sangrae Cho
Authentication Research Team
ETRI (Electronics and Telecommunications Research Institute)
218 Gajeongro, Yuseong-Gu, Daejeon, 305-700, KOREA
Phone : +82-42-860-6939   Fax : +82-42-860-1471
===========================================================