<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>My bad, forgot to add this to the bottom of the message:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[1] <a href="https://docs.microsoft.com/en-us/security/trusted-root/program-requirements">https://docs.microsoft.com/en-us/security/trusted-root/program-requirements</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>From:</b> Cscwg-public <cscwg-public-bounces@cabforum.org> <b>On Behalf Of </b>Corey Bonnell via Cscwg-public<br><b>Sent:</b> Wednesday, September 15, 2021 9:50 AM<br><b>To:</b> cscwg-public@cabforum.org<br><b>Subject:</b> [Cscwg-public] DSA SubCAs: are they allowed?<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hello,<o:p></o:p></p><p class=MsoNormal>In removing the algorithm encoding requirements from the RFC 3647 draft CSBRs (<a href="https://github.com/cabforum/code-signing/pull/6/commits/3e642a8cf2b5b1c7479e7e5031a6301c2fd6b828">https://github.com/cabforum/code-signing/pull/6/commits/3e642a8cf2b5b1c7479e7e5031a6301c2fd6b828</a>), I encountered a potential inconsistency/ambiguity in the current CSBRs and Microsoft Root Program requirements. Appendix A of the current CSBRs allows for Roots and SubCAs to use a DSA key pair, but section B of the Microsoft Root Program [1] requirements for Roots and SubCAs seemingly do not by omission of DSA entirely.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Given this, is it safe to conclude that the Microsoft Root Program currently prohibits DSA Roots and SubCAs? If so, can we disallow DSA ICAs in the RFC 3647 CSBRs to mirror the Microsoft Root Program requirements?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Corey<span style='font-family:"Arial",sans-serif;color:#686869'><o:p></o:p></span></p></div></body></html>