<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:958997005;
mso-list-type:hybrid;
mso-list-template-ids:842534632 529938348 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:2.25in;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:3.75in;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:5.25in;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1047218146;
mso-list-template-ids:-100397428;}
@list l1:level1
{mso-level-start-at:5;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2
{mso-list-id:1250890161;
mso-list-template-ids:-1087219526;}
@list l3
{mso-list-id:1880430252;
mso-list-template-ids:163993182;}
@list l4
{mso-list-id:2012370388;
mso-list-type:hybrid;
mso-list-template-ids:-852467314 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l4:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l4:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l4:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal>These are the approved minutes of the subject call:<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Attendees: Dean Coclin, Atsushi Inaba, Tomas Gustavson, Tadahiko Ito, Mike Reilly, Bruce Morton, Joanna Fox, Daniela Hood, Corey Bonnell, Tim Crawford, Jeff Ward, Chris Kemmerer, Hugh Mercer, Nicole Murray, Tim Hollebeek, Ian McMillan (joined after 30 mins).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l4 level1 lfo3'>Antitrust statement was read<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l4 level1 lfo3'>Prior minutes approved with minor correction on next meeting date<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l4 level1 lfo3'>Pre-ballot CSCWG-7: Needs ballot endorsers. Dean asked everyone to review the ballot over the next two weeks and consider endorsing<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l4 level1 lfo3'>Discussion of Tadahiko email:<o:p></o:p></li></ol><p class=MsoPlainText style='margin-left:.75in'>Are following statements (1) to (3) all True?<o:p></o:p></p><p class=MsoPlainText style='margin-left:.5in'><o:p> </o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoPlainText style='margin-left:.75in;mso-list:l0 level1 lfo6'>On Appendix A (2) of BR for Code sign, it says it is for "Timestamp Root, Subordinate CA, and Timestamp Certificates".<o:p></o:p></li></ol><p class=MsoPlainText style='margin-left:1.0in'>"Timestamp Certificates" include "TSA certificates (Defined in RFC3161)"<o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'><i>Discussion</i>: Yes, we believe this is true as stated. <o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoPlainText style='margin-left:1.0in'>2)on Appendix A (3), It only say about hash, but not for RSA key length.<o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'>It is only because requirement for RSA key length is defined in (2), so there is not anything to say about RSA key.<o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'>Hence, "signed value" which is signed by TSA certificate to Timestamp token need to be more than 3072 bits.<o:p></o:p></p><p class=MsoPlainText style='margin-left:.5in'> <i>Discussion result</i>: In table 3, the transition date for hashing algorithm is April 30, 2022, but in Table 2, the key size change is June 1, 2021 for 3072 key size. Hence the distinction.<o:p></o:p></p><p class=MsoPlainText style='margin-left:.5in'><o:p> </o:p></p><p class=MsoPlainText style='margin-left:1.0in'>(3) Appendix A (3) is only for "The digest algorithms used to sign Timestamp tokens ", so (for example) some IDs which is derived with sha1 and written inside of timestamp token is not scope of that requirement.<o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'><i>Discussion result</i>: Yes, we believe this is true (with an asterisk). It’s not possible to determine what is written inside the TS token. If it were HMAC SHA1 it is YES.<o:p></o:p></p><p class=MsoPlainText style='margin-left:1.0in'><o:p> </o:p></p><ol style='margin-top:0in' start=5 type=1><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Discussion of Tomas topic: Section on key protection (16.2). Tomas had reached out to HW vendors that make the silicon for the HW security modules. They need clear explanations of what is expected. Not sure if this is something this forum should do. Decided to hold off discussion until Ian joins the call<o:p></o:p></li><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Parking lot list: reviewed a few items but some needed Ian’s assistance so further discussion was postponed. Audit regimes were discussed but that is still evolving. Updated the latest status here: <a href="https://drive.google.com/file/d/1aJTWNj28ENBKRNowIgR1AsvRTD63jU47/view?usp=sharing">https://drive.google.com/file/d/1aJTWNj28ENBKRNowIgR1AsvRTD63jU47/view?usp=sharing</a><o:p></o:p></li><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Requirement for 3072 roots in June 2021: Daniela said this is problematic if the root needs to be 3072. Could affect 6,000 customers. Ian said the whole chain will need to be minimum 3072, including the root. CAs that don’t have this will need to get this in place. Bruce said this is fine for Microsoft but would also affect other applications like Java. Discussion around the problem of getting new roots in place in time (requirement was not clear in the document). People didn’t think that the root needed to be that size. Daniela asked about pushing the date out further to accommodate CAs that don’t have 3072 roots yet. Ian said he would go back and review the impact by the next call. Corey asked about using the lifetime signing OID to help solve this issue. Ian didn’t think that would be a good customer experience as the developer would have to get another cert and resign everything with the cert that had the lifetime signing OID. Tim said we should look at the overall 10 year requirements for code signing at a separate meeting. <o:p></o:p></li><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Short discussion on FIPS 140-2 vs -3 reqts. Ian would like to add -3 but we will pick this up on the next call.<o:p></o:p></li><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Next call December 3<sup>rd</sup><o:p></o:p></li><li class=MsoPlainText style='mso-list:l4 level1 lfo3'>Adjourned<o:p></o:p></li></ol><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='font-family:"Arial",sans-serif;color:#0174C3'>Dean Coclin<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Arial",sans-serif;color:#48565E'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>