Chapter 9Getting onto the international official list

01The idea in plain words

The C2PA Trust List is the list of certificate authorities that verifiers have “agreed to trust.” Only when an authority is on it do other companies' verifiers show its files as “trusted.”

Broadly, getting onto the list takes: following the set certificate policy, protecting the secret keys in a dedicated security device, running issuance and revocation lookups steadily, operating openly and being audited, and passing the conformance tests.

The detailed requirements follow the latest documents C2PA publishes. They can change, so write down the document name and the date you looked.

This site is currently a pilot and is not yet on the Trust List. You can check its current state yourself in the public repository, the transparency dashboard and the limits page.

Putting the requirements next to the current state shows what still needs doing. This comparison becomes material for your improvement report in chapter 10.

02See the picture

03Try it yourself

1. On the about page, find how this site describes its own stage.

   What you should see You see the phrase “Korea pilot CA — C2PA Trust List review in progress.”

   Open the about pageNo sign-in
2. On the operations transparency dashboard, list what it makes public.

   What you should see You see the title “Operational Transparency Dashboard” and the items it publishes.

   Open the transparency dashboardNo sign-in
3. In the public repository and on the limits page, find the certificate policy, the revocation lookups and the note that the site is not listed.

   What you should see You found the policy documents, the CRL and OCSP information and the “not on the Trust List” explanation.

   Open the public repositoryOpen the limits pageNo sign-in
4. Make a comparison table. The columns are requirement, current state, evidence page and gap. Where you found no evidence, write “not found in public material.”

   What you should see Each requirement has its current state and an evidence page.

   No sign-in
5. Give a short presentation of your chapter 1–9 practice results. Be sure to include the one result that surprised you most, the one most important limit, and one suggestion.

   What you should see You wrote your mentor's feedback on your record sheet.

   With your mentor

04Check your work

• Can you say in one sentence why getting onto the Trust List matters?
• Did you check this site's current stage from its public material?
• Did you fill in the comparison table with evidence pages?

05Easy to mix up

• Common misunderstandingA site that really runs must be officially certified.
  What is actually trueBeing in operation and being on the official list are different. This site is a pilot in operation, and it is not listed.
• Common misunderstandingOnce you have looked up the requirements, you can keep using them as they are.
  What is actually trueThe requirements can change. Always write down the date you looked and the document name.

06Review questions

1. Question 1What changes once an authority is on the Trust List?Show answerHide answer

   Other companies' verifiers also show the files it signed as “trusted.”
2. Question 2Name two requirements for getting onto the official list.Show answerHide answer

   Any two of: following the set certificate policy, protecting the secret keys in a dedicated security device, running revocation lookups, operating openly and being audited, and passing the conformance tests.
3. Question 3How should you fill in a cell where you found no evidence?Show answerHide answer

   Write “not found in public material.” Do not fill it with a guess.

07Key terms

C2PA Trust List

The official list of certificate authorities that C2PA verifiers have agreed to trust.

Certificate policy

The rule document that sets how certificates are issued and managed.

Conformance

A test of whether something follows the standard correctly.

Transparency

Publishing how a service is run so that outsiders can check it.

08Practice log