Ballot SC003: Two-Factor Authentication and Password Improvements

Ballot overview

• Ballot SC003: Two-Factor Authentication and Password Improvements in the Server Certificate Working Group.
• The ballot page states that the voting period ended and the ballot passed.
• Voting results shown on the page:
  • 17 yes votes from CAs, 0 no votes, 0 abstain.
  • 5 yes votes from browsers, 0 no votes, 0 abstain.
  • Quorum was met.
  • The approval thresholds for CAs and browsers were met.
  • At least one CA member and one browser member voted in favor.

Main policy changes

• Adds definitions for Multi-Factor Authentication and Secure Key Storage Device.
• Requires group accounts or shared role credentials not be used for accountability purposes when authenticating to Certificate Systems.
• Revises username and password controls for Trusted Roles, including:
  • 12-character passwords for accounts accessible only within Secure Zones or High Security Zones.
  • Multi-Factor Authentication for authentications crossing a zone boundary into a Secure Zone or High Security Zone.
  • For accounts accessible from outside a Secure Zone or High Security Zone, passwords must be at least 8 characters, not be one of the user’s previous four passwords, and account lockout must be implemented in accordance with the lockout subsection.
  • CAs should consider NIST 800-63B Appendix A when developing password policies.
  • If a CA has a policy requiring routine periodic password changes, that period should not be less than two years.
• Changes section 2.h to require a policy that requires, and section 2.i to require a procedure to configure.
• Revises account lockout to no more than five failed access attempts, subject to technical and security limitations.
• Requires Multi-Factor Authentication for all Trusted Role accounts on Certificate Systems accessible from outside a Secure Zone or High Security Zone, including those approving certificate issuance and Delegated Third Parties.

Timing and implementation

• The ballot text gives a two-year grace period for password policy improvements.
• It also states that effective April 1, 2020, if the CA has any policy that requires routine periodic password changes, that period shall not be less than two years.

Result

• The ballot passed and became normative.
• No exclusion notices are mentioned in the supplied evidence.