<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1253">
</head>
<body>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
That's OK with me.<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Regards,<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Tomas<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<span id="ms-outlook-android-cursor"></span></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Cscwg-public <cscwg-public-bounces@cabforum.org> on behalf of Ian McMillan via Cscwg-public <cscwg-public@cabforum.org><br>
<b>Sent:</b> Thursday, December 9, 2021 8:02:20 PM<br>
<b>To:</b> Corey Bonnell <Corey.Bonnell@digicert.com>; cscwg-public@cabforum.org <cscwg-public@cabforum.org>; Adriano Santoni <adriano.santoni@staff.aruba.it>; Dimitris Zacharopoulos (HARICA) <dzacharo@harica.gr>; Bruce Morton <bruce.morton@entrust.com><br>
<b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Re: Discussion: Proposed Ballot CSC-6: Update to Subscriber Private Key Protection Requirements</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Consolas}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
pre
{margin:0in;
font-size:10.0pt;
font-family:"Courier New"}
p.x_MsoListParagraph, li.x_MsoListParagraph, div.x_MsoListParagraph
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
span.x_HTMLPreformattedChar
{font-family:Consolas}
span.x_EmailStyle22
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
ol
{margin-bottom:0in}
ul
{margin-bottom:0in}
-->
</style>
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> External Sender - Be cautious when clicking links or opening attachments. Please email InfoSec@keyfactor.com with any questions.</div>
<br>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Hi Corey,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Thank you for this great feedback, and I’ve incorporated your feedback in attach doc for #1 and #2 items in your comments. For #3, I’ve moved to aligning with 11.7, but
I know in a future ballot we’ll be looking to improve section and 11.7 (and thus 16.3.2(6)).
</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Tomas also provided feedback on the definition of the “Hardware Crypto Module” with feedback regarding the “dedicated” adjective to describe the crypto processor being non-inclusive
of HSMs that leverage standard CPUs such as Intel SGX chips or MPCs. Tomas, is it sufficient to remove the “dedicated” adjective from that definition? I’ve updated the definition with that change as well.
</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Thanks,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Ian</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Corey Bonnell <Corey.Bonnell@digicert.com>
<br>
<b>Sent:</b> Thursday, December 9, 2021 8:42 AM<br>
<b>To:</b> Ian McMillan <ianmcm@microsoft.com>; cscwg-public@cabforum.org; Adriano Santoni <adriano.santoni@staff.aruba.it>; Dimitris Zacharopoulos (HARICA) <dzacharo@harica.gr>; Bruce Morton <bruce.morton@entrust.com><br>
<b>Subject:</b> RE: [Cscwg-public] [EXTERNAL] Re: Discussion: Proposed Ballot CSC-6: Update to Subscriber Private Key Protection Requirements</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Hi Ian,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Thank for you for circulating the latest copy of the draft ballot. Comments below.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<ol start="1" type="1" style="margin-top:0in">
<li class="x_MsoListParagraph" style="margin-left:0in"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">As a general comment, it would be more consistent to use the Defined Terms of “Private Key” and “Key Pair” throughout.</span></li></ol>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<ol start="2" type="1" style="margin-top:0in">
<li class="x_MsoListParagraph" style="margin-left:0in"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">“Acceptable methods of satisfying this requirement include the following” is unclear whether the list is exhaustive or is merely a list of
illustrative examples. I believe the intent is that the list of methods is exhaustive, so I suggest changing this to “</span>One of the following methods MUST be employed to satisfy this requirement:”</li></ol>
<p class="x_MsoNormal"> </p>
<ol start="3" type="1" style="margin-top:0in">
<li class="x_MsoListParagraph" style="margin-left:0in"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">“6. The CA or a Qualified Auditor witnesses the key creation in a suitable Hardware Crypto Module solution including a cloud-based
key generation and protection solution;” </span></li></ol>
<p class="x_MsoListParagraph"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">“Qualified Auditor” is a Defined Term that denotes an auditor with specific experience and ability to carry out WebTrust/ETSI audits. Do
we need this level of specificity, especially when Section 11.7 prescribes “relying on a report provided by the Applicant that is signed by an auditor who is approved by the CA and who has IT and security training or is a CISA”? If we do not, perhaps it would
be best to align on the language in Section 16.3.2 (6) with the auditor qualification requirement in Section 11.7.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Thanks,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Corey</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Cscwg-public <</span><a href="mailto:cscwg-public-bounces@cabforum.org"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">cscwg-public-bounces@cabforum.org</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">>
<b>On Behalf Of </b>Ian McMillan via Cscwg-public<br>
<b>Sent:</b> Tuesday, December 7, 2021 5:24 PM<br>
<b>To:</b> Adriano Santoni <</span><a href="mailto:adriano.santoni@staff.aruba.it"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">adriano.santoni@staff.aruba.it</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">>;
</span><a href="mailto:cscwg-public@cabforum.org"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">cscwg-public@cabforum.org</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">; Dimitris Zacharopoulos (HARICA) <</span><a href="mailto:dzacharo@harica.gr"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">dzacharo@harica.gr</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">>;
Bruce Morton <</span><a href="mailto:bruce.morton@entrust.com"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">bruce.morton@entrust.com</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">><br>
<b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Re: Discussion: Proposed Ballot CSC-6: Update to Subscriber Private Key Protection Requirements</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Hi Folks,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Coming out of our last call, I’ve made all the updates we discussed including producing a definition for the term “hardware crypto module” (see below).
</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal" style="margin-left:.5in"><b><i><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Hardware Crypto Module:</span></i></b><i><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> A tamper-resistant device with
a dedicated cryptography processor used for the specific purpose of protecting the lifecycle of cryptographic keys (generating, managing, processing, and storing).</span></i></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Please see the attached redline now with all the latest updates and
<b>provide feedback and willingness to endorse the ballot</b>. </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Thanks,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Ian
</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Cscwg-public <</span><a href="mailto:cscwg-public-bounces@cabforum.org"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">cscwg-public-bounces@cabforum.org</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">>
<b>On Behalf Of </b>Adriano Santoni via Cscwg-public<br>
<b>Sent:</b> Tuesday, November 23, 2021 8:34 AM<br>
<b>To:</b> </span><a href="mailto:cscwg-public@cabforum.org"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">cscwg-public@cabforum.org</span></a><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"><br>
<b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Re: Discussion: Proposed Ballot CSC-6: Update to Subscriber Private Key Protection Requirements</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<p><span style="font-family:"Calibri",sans-serif">Hi all,</span></p>
<p><span style="font-family:"Calibri",sans-serif">I find the language in "Baseline Requirements for the Issuance and Management of Code Signing.v2.6+CSC-6_redline_v2" rather confusing, about private key protection.</span></p>
<p><span style="font-family:"Calibri",sans-serif">It seems to me that section 16.3.1, in the added parts, only allows three options for protecting the private key effective Sep 1, 2022:
</span></p>
<p><span style="font-family:"Calibri",sans-serif">1) hosted hardware crypto module (in short "HCM")<br>
2) cloud-based key generation and protection solution (backed by an HCM) (I am not clear what's the difference with #1)<br>
3) signing service</span></p>
<p><span style="font-family:"Calibri",sans-serif">But later on, section 16.3.2 seems to allow a wider range of options, including a suitable HCM shipped to the subscriber by the CA.</span></p>
<p><span style="font-family:"Calibri",sans-serif">Am I reading wrong? </span></p>
<p><span style="font-family:"Calibri",sans-serif">Also, I am not clear how option #3 in §16.3.2 works:
</span></p>
<p><span style="font-family:"Calibri",sans-serif">"3. The Subscriber uses a CA prescribed CSP and a suitable hardware module combination for the key pair generation and storage;"</span></p>
<p><span style="font-family:"Calibri",sans-serif">Anybody willing to explain?</span></p>
<p><span style="font-family:"Calibri",sans-serif">Adriano</span></p>
<div>
<p class="x_MsoNormal">Il 23/11/2021 11:07, Dimitris Zacharopoulos (HARICA) via Cscwg-public ha scritto:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<p class="x_MsoNormal" style="margin-bottom:12.0pt"> </p>
<div>
<p class="x_MsoNormal">On 18/11/2021 7:03 ì.ì., Dimitris Zacharopoulos (HARICA) via Cscwg-public wrote:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<p class="x_MsoNormal"><br>
Ok, so you are thinking of a Subscriber that owns an HSM and gets an IT audit that has an audit report that asserts that all Keys associated with Code Signing Certificates are generated in an on-prem certified HSM. Is this what this method is supposed to cover?</p>
</blockquote>
<p class="x_MsoNormal" style="margin-bottom:12.0pt"><br>
After our recent meeting, we agreed to tweak the language of 4. to cover this use case described by Bruce. I recommend changing<br>
<br>
<i>"4. The Subscriber provides a suitable IT audit indicating that its operating environment achieves a level of security specified in section 16.3.1"</i><br>
<br>
to<br>
<br>
<i>"4. The Subscriber provides an internal or external IT audit indicating that it is only using a suitable hardware module as specified in section 16.3.1 to generate keys pairs to be associated with Code Signing Certificates"</i><br>
<br>
I also noticed that we don't have consistency among all listed options. Some options just say " suitable hardware module", others point to 16.3.1 and others say both. We could discuss at our next call or someone could take a stab at it and try to use consistent
language.<br>
<br>
<br>
Thanks,<br>
Dimitris.<br>
<br>
</p>
<pre>_______________________________________________</pre>
<pre>Cscwg-public mailing list</pre>
<pre><a href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a></pre>
<pre><a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fcscwg-public&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7Caabcad0bc1a846187aa408d9bb466e81%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637746733604382927%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wz%2BRMZexrWCqsxjztnAUzvnBT2ohp6q8xojda0Lr4Sw%3D&reserved=0" originalsrc="https://lists.cabforum.org/mailman/listinfo/cscwg-public" shash="rZdqmAqz818uHHjh0BQLKZ4H4GRLmgggCWQ1oIL5x38AEXOf7KEmQAFKpnICWDiKieSuhKMmUGz1tXplt6hQKPJnBqmNV+zhcsnSNSHimiEgBlH+kY6aX5ymH+e3pgxcsT7QG2/4d549anXSQZhLnDo4rg9u+B691XnluuCmd50=">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a></pre>
</blockquote>
</div>
</div>
</div>
</body>
</html>