<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Final Minutes for May 20, 2021 CSCWG meeting<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Attendees: <o:p></o:p></p><p class=MsoNormal>- Dean Coclin<o:p></o:p></p><p class=MsoNormal>- Bruce Morton<o:p></o:p></p><p class=MsoNormal>- Janet Hines<o:p></o:p></p><p class=MsoNormal>- Tim Hollebeek<o:p></o:p></p><p class=MsoNormal>- Ian McMillan<o:p></o:p></p><p class=MsoNormal>- Dimitris Zacharopoulos<o:p></o:p></p><p class=MsoNormal>- Tim Crawford<o:p></o:p></p><p class=MsoNormal>- Corey Bonnell<o:p></o:p></p><p class=MsoNormal>- Atsushi Inaba<o:p></o:p></p><p class=MsoNormal>- Tomas Gustavsson<o:p></o:p></p><p class=MsoNormal>- Sebastian Schulz<o:p></o:p></p><p class=MsoNormal>- Roberto Quinones<o:p></o:p></p><p class=MsoNormal>- Iņigo Barreira<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Minute-taker: Tomas Gustavsson<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Roberto Quinones is participating for the first time for Intel, who is an associate member.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Antitrust statement was read by Dean.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Minutes for May 6 meeting were approved.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Certificate policy OID for time stamping update: It was discussed that the OID was specific for code signing. It does not inhibit or do anything to other types of certificates. Bruce said in the OID structure it's under the code signing arc and the purpose is to identify certificates issued in accordance with the CS BRs. The aim is to fix a problem as there is no OID for it today. Tim Hollebeek and Ian McMillan called out that they are in favor of the proposed OID, and to add it to the document. Bruce noted that there is no change of scope and Tim noted that it actually clarifies the scope what is intended for code signing.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Clean-up ballot:<o:p></o:p></p><p class=MsoNormal>A small set of people had action items since the last meeting discussing the clean up ballot. Dimitris have completed his action item, Bruce and Tim Hollebeek have not completed theirs yet. Bruce aims to address items during next week, after that Bruce will clean up the comments and send it out to the group for review. Some comments in the document will not be part of the clean up ballot, but be addressed as separate ballots.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>BR SSL version numbers in CSBR:<o:p></o:p></p><p class=MsoNormal>No action has been taken since the last discussion. The problem is that there needs to be a lot of review and it may be better to keep the version that we have but do a ballot to input into the CS BRs what we want from the SSL BR. Bruce said the logging requirements from the SSL BRs is something the CS BRs want to take advantage of. Dimitris noted that requirement changes need to have a future effective date. There was a discussion about the requirement from the SSL BRs of disclosing of data sources, registration and incorporating agencies and log retention, that may need to have affective dates for CAs that issue code signing certificates but not SSL certificates. A discussion on effective dates followed. Tim noted that if there is no rush, 6 months is the de-facto standard for the effective date period.<o:p></o:p></p><p class=MsoNormal>Ian volunteered to make a suggestion for a ballot for log retention and Tim agreed to review.<o:p></o:p></p><p class=MsoNormal>Bruce suggested when a ballot gets approved from the server group that affects on of the CS documents we should assess the impact if it is something we want to include, for example domain validation changes have no impact on CS while weak keys probably have. This was supported by Ian.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Key Protection:<o:p></o:p></p><p class=MsoNormal>Ian talked about the future plans for key protection is to incorporate language specific to cloud protected keys. The verification of the subscriber protection level is the interesting part. How a CA can witness key generation, subscriber provides a suitable IT audit. Tim asked about what the long term vision is, if subscribers should move to cloud services. Ian said that it was that key generation and key protection was done inside a hardware crypto module.<o:p></o:p></p><p class=MsoNormal>Ian mentioned that he prefer not to have pre-installed keys shipped to customer, based on how that could affect provenance during shipping. There was a discussion between Ian and Dimitris on the benefits, drawbacks and processes of CAs shipping crypto modules with pre-generated keys to subscribers if there is a risk or not, as the typical process is the pre-installed keys are shipped before certificate is issued and there are benefits of verification of the key generation when the CA knows the key was generated inside the hardware crypto module. There was agreement that this was a good process where the subscriber crypto module does not have remote key attestation.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Signing Service:<o:p></o:p></p><p class=MsoNormal>Bruce said that there was a discussion if a separate formal or informal group should split out to sort out the signing service. The BRs is confusing in some ways for signing services and there was agreement that different models should be clarified. It was agreed to gather interested people to lead a specific focused call for signing service, Bruce said he don't mind leading this call gathering volunteers. The first target is to make a presentation on this call or the F2F.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Minute takers for the next four meetings:<o:p></o:p></p><p class=MsoNormal>June 3: Corey Bonnell, followed by<o:p></o:p></p><p class=MsoNormal>Sebastian Schulz<o:p></o:p></p><p class=MsoNormal>Janet Hines<o:p></o:p></p><p class=MsoNormal>Iņigo Barreira<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>