<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:635111594;
mso-list-template-ids:-5594138;}
@list l1
{mso-list-id:1347056202;
mso-list-type:hybrid;
mso-list-template-ids:620805700 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Here are the final minutes of the subject call:<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in;text-indent:-.25in'><o:p> </o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Attendees: Dean Coclin, Atsushi Inaba, Daniella Hood, Bruce Morton, Ian McMillan, Sebastian Schulz, Dimitris Zacharopoulos, Tim Crawford, Karthik Ramasamy, Karina Sirota<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>AntiTrust statement was read by Dean<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Minutes from prior call approved and will be sent to public list<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Ballot Status: Bruce will send a reminder to vote on CSCWG-7 to the list. Dimitris reminded us that only voting members are counted for quorum purposes.<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Discussion of High risk requests and key protection: Ian presented these two topics with suggestions for improvement. For High risk requests, the proposal was to make this more consistent across the board. For any cert request, the CA should check their internal database to see if a prior request had been rejected. Section 11.7 deals with how to process it. For example, Solar Winds would have been considered a high risk request because they signed malicious code. This section says that due to a “takeover attack”, they would then have to use a stronger key protection (16.3). Ian also commented that this section says if you have 2 takeover attacks, the CA cannot issue the cert. He felt this was too harsh and suggested that approval be sought from the platform provider. A discussion then ensued on someone hosting a database of such requests (which we’ve discussed before). Ian suggested “Reversing Labs” could be such a candidate, where CAs could check before issuing. Dimitris suggested something like the “London Protocol”. Bruce will discuss this with Chris Bailey.<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>A discussion about notifying companies if a cert is requested in their name. Ian said he would want to know if anyone (including Microsoft employees) requested a cert in Microsoft’s name. Dean said that was likely true of other companies like Oracle and Adobe. Perhaps something like CAA would be needed here.<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Ian discussed his proposal for key protection. He would like to change the “FIPS or equivalent” text to just FIPS. Bruce said Common Criteria versions should be considered. Dimitris said the CC EAL4+ is higher than FIPS 140-2 Level 2. It was mentioned that Adobe uses this standard. Ian will consider adding CC EAL 4+ and ETSI CEN while removing “or equivalent”<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Tim asked how one would prove that keys were generated properly for audit purposes. Ian will revise 16.2 (3) based on an attestation from the customers. A discussion around subscriber obligations followed and what happens when they don’t adhere. Should the CA mandate no key possession by the customer and enforce a cloud based solution?<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Discussion ended as time was called<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'>Next meeting Feb 11th<o:p></o:p></li></ol><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='font-family:"Arial",sans-serif;color:#0174C3'>Dean Coclin<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='font-family:"Arial",sans-serif;color:#0174C3'>Chair CSCWG<o:p></o:p></span></b></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>