Podcast
Root Causes 371: MPIC Rules Go to CABF Ballot


A ballot for Multi-perspective Issuance Corroboration (MPIC), formerly known as MPDV, has entered a discussion period in the CA/Browser Forum (CABF). We explain the details of what it contains.
Podcast Transcript
Lightly edited for flow and brevity.
One of them is the definition of distance, right? Because the point here is that you need your different validations, you know, you're going to look at the destination, the online destination from different places, in order to defend yourself against a BCP attack and look for some kind of consensus among them, in order to be confident that this is the real domain that really you should be looking at.
And so the first question was, how is that going to work? And the answer here, is that it has to do with it's literally measuring physical distance of the endpoint where the query, if you will, the check of the domain leaves the encrypted tunnel that it has coming from the CA. So they're looking for 500 kilometers physical distance. So literally, if I had one of them happening in Mountain View, California, and another one happening in Virginia, that would meet the physical distance requirement. That's the kind of thing they’re looking for. And that's to prevent multiple queries from being swept up under the same BGP attack.
The second point is we talked about how many, right? Like, do you have to have two inquiries? Do you have to have three? How many do you have to have? What qualifies? And the answer to that is that it grows over time. So the rules here have us a starting with two, and then on a specific cadence, graduating to three and four, and eventually five.
And then the last question we had is, well, when? And so that winds up being interwoven with the question of how many, and there's an actual phase, a rather detailed phase out, with one, two, three, four, five, six - six different steps, six stages, to the end of the process. What you said, in December 15, 2026 and I thought it might be worth just walking through all six of them, and what they are and when they're occurring.
So the first one the first magic date is September 15, 2024. And this isn't really - - this actually isn't a date because it's a should and I'll read the language here. The CA should implement multi-perspective issuance corroboration using at least two remote network perspectives. So they want two remote network perspectives. That's the 500 kilometers different distance thing. And it's a should by September 15, 2024, which means if a CA doesn't, there's actually no penalty. This is more like telling you, guys, you need to get going on this, you need to get into it, you need to start figuring this stuff out. Right?
So in this case, you're actually allowed to get away with one of the two corresponding. That's what that table states. So starting March 15, 2025, you have to have at least two perspectives, and one of them has to match what you expect. So this is us still easing into it, and then rolling this out very gradually so that everybody can get it right because this is a big deal.
Now, the third date is September 15, 2025. A year later from that original should. This is where the CA must implement MPIC using at least two remote network perspectives. The CA must not proceed with certificate issuance if the number of non-corroboration is greater than allowed in the quorum requirements table. So it's a may, right? The one before, the March 15, is they may proceed, so the CA must be doing it but they may proceed regardless of the results they're seeing. Starting September 15, 2025, one year later, they must be obeying the quorum requirements using at least two perspectives. And from here it rolls out relatively predictably.
So the next one is effective March 15, 2026, they must implement it for at least three remote network perspectives and they must not proceed if the number of non-corroborating is greater than the quorum requirements.
The one after that is June 15, 2026. And in June 15, 2026, the CA must implement MPIC for at least four remote network perspectives and other than that, the rules are the same, except the number has gone up to four.
And then in December 15, 2026, the CA must implement MPIC for at least five remote network perspectives. And other than that the rules are the same. So basically, you see what we do is CAs are getting between now and March 15, 2025 to be using at least two perspectives and they're getting between now and September 15, 2025 to be using those two perspectives to make a determination. And then after that, what happens is there's a regular cadence of increasing the number of perspectives required leading up to December 15, 2026.
And I gotta say, and I think you'll agree with me, this is important. I think BGP attacks, they've been proven by white hats and the writing is on the wall that I think as an industry we need to do this. It would just be horrible if we started to see mis-issuance due to BGP attacks. We have to do this.