[Cscwg-public] Ballot CSC-??: High Risk Requirements Update

[Tim Hollebeek]

+1, will endorse.



-Tim



From: Cscwg-public <cscwg-public-bounces at cabforum.org> On Behalf Of Bruce
Morton via Cscwg-public
Sent: Tuesday, November 21, 2023 2:25 PM
To: cscwg-public at cabforum.org
Subject: [Cscwg-public] Ballot CSC-??: High Risk Requirements Update



Here is a draft of the High Risk Requirements update ballot. Looking for
comments and 2 endorsers. There is no future effectivity date proposed,
since the ballot does not add new requirements.



Thanks, Bruce.





Purpose of the Ballot

This ballot updates the “Baseline Requirements for the Issuance and
Management of Publicly‐Trusted Code Signing Certificates“ version 3.4 in
order to clarify language regarding Signing Service and signing requests.
The main goals of this ballot are to:

1.	Remove references to High Risk Certificate Request, since the CSBRs
do not provide any actions for a high risk application.
2.	Remove references to High Risk Region of Concern, since the CSBR
appendix has never been populated.
3.	Remove rules for a Takeover Attack to require the Subscriber to
generate keys in a crypto device, since crypto device key generation is now
a baseline requirement for all code signing certificates.
4.	Remove option to transfer private key which has been generated in
software.
5.	Cleanup to remove Subscriber key generation option which expired
effective 1 June 2023.
6.	Cleanup to remove “any other method” to verify the Subscriber key
was generated in a crypto device, since this option expired 1 June 2023.

The following motion has been proposed by Bruce Morton of Entrust and
endorsed by ?? and ??.



MOTION BEGINS



This ballot updates the “Baseline Requirements for the Issuance and
Management of Publicly‐Trusted Code Signing Certificates” ("Code Signing
Baseline Requirements") based on version 3.4. MODIFY the Code Signing
Baseline Requirements as specified in the following redline: https://github.
com/cabforum/code-signing/pull/31/files
<https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/pull
/31/files___.YXAzOmRpZ2ljZXJ0OmE6bzo0OWEwYzlkY2NjZmI1NDAxMGRmY2U4MTg2NDlhZmE
zMTo2OjQyMTA6MmM2NjgzZDc1NDQ1YmY2N2Q4MzFjMDgxZDkwZmEyOTY1Yzc0MTVkNjEyYTNlMTF
lYTU3NGUxZGM2NzAzODI3YzpoOkY>



MOTION ENDS

The procedure for this ballot is as follows: Discussion (7 days)



*               Start Time: TBD

*               End Time: TBD



Vote for approval (7 days)



*               Start Time: TBD

*               End Time: TBD



Any email and files/attachments transmitted with it are intended solely for
the use of the individual or entity to whom they are addressed. If this
message has been sent to you in error, you must not copy, distribute or
disclose of the information it contains. Please notify Entrust immediately
and delete the message from your system.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20231121/2357f077/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5231 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20231121/2357f077/attachment-0001.p7s>