<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Following-up on the discussion about signing services, and the
decisions of previous meetings that a signing service is basically
an entity that manages private keys on behalf of Subscribers, please
take a look at the latest relevant ETSI TS available at:<br>
<ul>
<li><a class="moz-txt-link-freetext" href="https://www.etsi.org/deliver/etsi_ts/119400_119499/11943101/01.02.01_60/ts_11943101v010201p.pdf">https://www.etsi.org/deliver/etsi_ts/119400_119499/11943101/01.02.01_60/ts_11943101v010201p.pdf</a></li>
</ul>
<p>The responsibility to manage keys on behalf of subscribers is not
to be taken lightly as the current CSBRs do. Agreed that we can
take some small improvements to the current CSBRs but if we
believe that the goal is to define a secure environment with
secure policies/practices that will make the ecosystem safer for
subscribers and ultimately Relying Parties, then we probably need
to invest more time if we want to copy good practices from other
schemes.<br>
</p>
<p>On the other hand, this ETSI standard is already auditable and a
legal entity could be audited and certified against ETSI TS 119
431. If a CA or a Subscriber wants to use a signing service, that
signing service could either comply with the CSBRs and be audited
against the requirements of section 17.1, or be audited against
ETSI TS 119 431.</p>
<p>Thoughts?</p>
<p>Dimitris.<br>
</p>
<br>
<div class="moz-cite-prefix">On 10/3/2022 10:00 μ.μ., Bruce Morton
via Cscwg-public wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0100017f756b7d69-5ae0f3f1-8732-45fa-8d5c-61802db7ef59-000000@email.amazonses.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}ol
{margin-bottom:0in;}ul
{margin-bottom:0in;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Here is the text we were discussing in the
CSCWG meeting today.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Bruce.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">=================================<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Proposed Signing Service items:<o:p></o:p></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Service is may be
performed by the CA or a third party<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Service is not a CA
requirement, so is NOT a function of a Delegated Third Party
– this will limit scope<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Service references may
be removed when not required - this will limit implied scope<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Service is not a
Subscriber, so all Private Keys are only associated to
certificate Subscriber<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Service is not an RA, so
will not receive certificate requests from an Applicant – CA
or Delegated Third Party RA will receive certificate
requests<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l2 level1
lfo1;vertical-align:middle">Signing Request requirements
will not be defined in the CSBRs<o:p></o:p></li>
</ul>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Private key generation<o:p></o:p></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="mso-list:l0 level1
lfo2;vertical-align:middle">Signing Service must provide
evidence to the CA that the private key was created by the
Signing Service.
<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l0 level1
lfo2;vertical-align:middle">Question - Ballot CSC-13 allows
the Signing Service to use cloud-based key generation. Can
the CA can operate the cloud-based service?<o:p></o:p></li>
</ul>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Audit<o:p></o:p></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="mso-list:l1 level1
lfo3;vertical-align:middle">Specific compliance sections of
CSBRs and NetSec should be stated in the CSBRs as the
compliance/audit scope should not be determined by the CA,
Signing Service and Auditor. Note, WebTrust for CA or ETSI
EN 319 411-1 would not be in scope for Signing Service.<o:p></o:p></li>
<li class="MsoNormal" style="mso-list:l1 level1
lfo3;vertical-align:middle">For cloud-based key generation,
is there a compliance requirement for the cloud-based
service?<o:p></o:p></li>
</ul>
<p class="MsoNormal"><span style="font-size:18.0pt"><o:p> </o:p></span></p>
</div>
<i>Any email and files/attachments transmitted with it are
confidential and are intended solely for the use of the
individual or entity to whom they are addressed. If this message
has been sent to you in error, you must not copy, distribute or
disclose of the information it contains. <u>Please notify
Entrust immediately</u> and delete the message from your
system.</i>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Cscwg-public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/cscwg-public">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a>
</pre>
</blockquote>
<br>
</body>
</html>