<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Doug,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Regarding the 16.2 section, this statement was also struck-out, “After 2021-06-01, the same protection requirements SHALL apply to Non EV Code Signing Certificates.” So I believe that the requirement already applied to normal code signing certificates. The edits are just a cleanup.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Bruce.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Doug Beattie <doug.beattie@globalsign.com> <br><b>Sent:</b> Thursday, March 3, 2022 6:56 AM<br><b>To:</b> Ian McMillan <ianmcm@microsoft.com>; Tim Hollebeek <tim.hollebeek@digicert.com>; cscwg-public@cabforum.org; Bruce Morton <Bruce.Morton@entrust.com><br><b>Subject:</b> [EXTERNAL] RE: Update to Subscriber Private Key Protection Requirements (CSC-6 to CSC-13)<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>WARNING: This email originated outside of Entrust.<br>DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal>Hi Ian,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Good work on section 16.3, that is much more clear now. I have 2 more comments for your consideration.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Comment #1:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In Section 11.7 we say:<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>If the CA is aware that the Applicant was the victim of a Takeover Attack, the CA MUST verify that the Applicant is protecting its Code Signing Private Keys under Section 16.3.1(1) or Section 16.3.1(2). The CA MUST verify the Applicant’s compliance with Section 16.3.1(1) or Section 16.3.1(2) (i) through technical means that confirm the Private Keys are protected using the method described in 16.3.1(1) or 16.3.1(2) or (ii) by relying on a report provided by the Applicant that is signed by an auditor who is approved by the CA and who has IT and security training or is a CISA.<span style='font-family:"Cambria",serif'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But now there are actually 2 lists in sections 16.3.1(1) or Section 16.3.1(2) with those list numbers. Do we need to be more specific, or renumber the second list a-c? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>After 15 November, what is the right remediation for Take Over attack, do we need to reference one or more of the items in the new list (the list we might renumber a-c), or is there no remediation now?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>There are multiple references to 16.3.1(1) so we’d want to apply the same logic to all instances.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Comment #2:<o:p></o:p></p><p class=MsoNormal>Section 16.2 removed the reference to EV in the scope so this applies to normal Code signing certificates. Since this does not have a date associated with it, do we assume that this requirement change for normal code signing certs is effective immediately?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Ian McMillan <<a href="mailto:ianmcm@microsoft.com">ianmcm@microsoft.com</a>> <br><b>Sent:</b> Wednesday, March 2, 2022 5:56 PM<br><b>To:</b> Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>>; <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>; Doug Beattie <<a href="mailto:doug.beattie@globalsign.com">doug.beattie@globalsign.com</a>>; Bruce Morton <<a href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>><br><b>Subject:</b> RE: Update to Subscriber Private Key Protection Requirements (CSC-6 to CSC-13)<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you, Tim, I really like the structure suggestions here. I’ve made those updates per your suggestion in the attached copy of the redline document. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’ll note your endorsement.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Cheers,<o:p></o:p></p><p class=MsoNormal>Ian<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>> <br><b>Sent:</b> Wednesday, March 2, 2022 4:57 PM<br><b>To:</b> Ian McMillan <<a href="mailto:ianmcm@microsoft.com">ianmcm@microsoft.com</a>>; <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>; Doug Beattie <<a href="mailto:doug.beattie@globalsign.com">doug.beattie@globalsign.com</a>>; Bruce Morton <<a href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>><br><b>Subject:</b> [EXTERNAL] RE: Update to Subscriber Private Key Protection Requirements (CSC-6 to CSC-13)<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I would recommend against using parentheticals to express the deprecation dates, as it makes the sentences more complicated than they need to be. I’d just modify the first sentence of each part so the structure is as follows:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> For Non-EV Code Signing Certificates issued prior to November 15, 2022, …<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> For EV Code Signing Certificates issued prior to November 15, 2022, …<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> Effective November 15, 2022, …<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But otherwise, the updates look good and we are willing to endorse CSC-13.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Ian McMillan <<a href="mailto:ianmcm@microsoft.com">ianmcm@microsoft.com</a>> <br><b>Sent:</b> Wednesday, March 2, 2022 11:31 AM<br><b>To:</b> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>; Doug Beattie <<a href="mailto:doug.beattie@globalsign.com">doug.beattie@globalsign.com</a>>; Bruce Morton <<a href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>>; Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>><br><b>Subject:</b> Update to Subscriber Private Key Protection Requirements (CSC-6 to CSC-13)<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi Folks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Attached you will find an updated redline doc of v2.7 of the CSBRs with the updates to the subscriber private key protection requirements as outlined previously in CSC-6. This updated version also includes edits to address issues Doug Beattie raised during the voting period of CSC-6, so I am looking for confirmation from Doug on these edits addressing the concerns he raised. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Additionally, I’m looking to get endorsements on this ballot under <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.cabforum.org%2Fcscwg%2Fcsc_13_-_update_to_subscriber_private_key_protection_requirements&data=04%7C01%7Cianmcm%40microsoft.com%7Cd4f1031bc20548d5353008d9fc978390%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637818549960291581%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=K2KcmHbxwQ0sUNuNRmUs709PD16hYnqvPbLB%2BGzExng%3D&reserved=0" title="cscwg:csc_13_-_update_to_subscriber_private_key_protection_requirements">CSC 13 - Update to Subscriber Private Key Protection Requirements</a>, and hope that Bruce and Tim, as previous endorsers can review the edits and endorse the new ballot. Once we have endorsers I’ll proceed with the formal ballot process. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Cheers,<o:p></o:p></p><p class=MsoNormal>Ian <o:p></o:p></p></div></div></body></html>