<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:Consolas;}
span.EstiloCorreo24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:472407215;
mso-list-template-ids:-1140559308;}
@list l0:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1
{mso-list-id:601187633;
mso-list-template-ids:-1421305514;}
@list l1:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2
{mso-list-id:882981721;
mso-list-template-ids:599834212;}
@list l2:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3
{mso-list-id:1492260643;
mso-list-template-ids:-1585908446;}
@list l3:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-GB style='mso-fareast-language:EN-US'>Yes, correct. CEN standards are not for free.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='mso-fareast-language:EN-US'>I also think that a starting point would be using the 431 and 432 standards and in case there´s a need to go further we can start looking at the CEN standards.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>De:</b> Cscwg-public <cscwg-public-bounces@cabforum.org> <b>En nombre de </b>Dimitris Zacharopoulos (HARICA) via Cscwg-public<br><b>Enviado el:</b> miércoles, 16 de marzo de 2022 19:32<br><b>Para:</b> Bruce Morton <Bruce.Morton@entrust.com>; cscwg-public@cabforum.org<br><b>Asunto:</b> Re: [Cscwg-public] [EXTERNAL] Re: Signing Service Discussion of 10 March 2022<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div style='border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><p class=MsoNormal style='line-height:12.0pt;background:#FAFA03'><span style='font-size:10.0pt;color:black'>CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On 11/3/2022 9:07 μ.μ., Bruce Morton wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal>Hi Dimitris,<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I see the value in creating greater improvements to signing, but as you stated, I would prefer to make smaller improvements. I believe that the first phase is to update the CSBRs based on the model changes which we have discussed. I don’t think there would be a lot of effort to get this done. I would be happy to draft proposed changes after we have changed the CSBR format.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I was reviewing TS 119 431-1, but also need to see EN 419 241-1. I can’t find this document in my ETSI search. I am hoping that we will find ETSI requirements which we might be able to use in the CSBRs, if we find a gap.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p></blockquote><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><br>EN 419 241-1 standard is produced with CEN and it follows a policy like ISO. You need to purchase a copy.<br><br>We probably need to focus on ETSI TS 119 431-1 (publicly available) which is precisely what we are trying to accomplish with the "signing service" in today's CSBRs. At the very minimum, we need to clarify what "signing service" means. Inigo, please chime-in if I missed anything related to the ETSI/CEN standards.<br><br>If members detect something in this ETSI document that is "too European" as some colleagues mentioned in our last call, we can take a closer look. In my personal opinion, I believe the document can work as a stand-alone standard that would allow any CA or entity that wants to manage keys on behalf of subscribers to be audited separately from the CSBRs.<br><br>As mentioned by others, the current CSBRs don't have any enforceable audit requirements for entities managing keys on behalf of subscribers. The goal would be to introduce some audit requirements in such services so they can be used in 16.2 and 16.3 as an alternative option for Subscribers to manage (generate/protect/use/destroy) their private keys.<br><br><br>Dimitris.<br><br><br><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Thanks, Bruce. <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>From:</b> Cscwg-public <a href="mailto:cscwg-public-bounces@cabforum.org"><cscwg-public-bounces@cabforum.org></a> <b>On Behalf Of </b>Dimitris Zacharopoulos (HARICA) via Cscwg-public<br><b>Sent:</b> Friday, March 11, 2022 7:40 AM<br><b>To:</b> Bruce Morton via Cscwg-public <a href="mailto:cscwg-public@cabforum.org"><cscwg-public@cabforum.org></a><br><b>Subject:</b> [EXTERNAL] Re: [Cscwg-public] Signing Service Discussion of 10 March 2022<o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>WARNING: This email originated outside of Entrust.<br>DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal>Following-up on the discussion about signing services, and the decisions of previous meetings that a signing service is basically an entity that manages private keys on behalf of Subscribers, please take a look at the latest relevant ETSI TS available at:<o:p></o:p></p><ol start=1 type=1><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1'><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.etsi.org%2Fdeliver%2Fetsi_ts%2F119400_119499%2F11943101%2F01.02.01_60%2Fts_11943101v010201p.pdf__%3B!!FJ-Y8qCqXTj2!Ijvhfy-9g01wuZ723tQAyBgBJgGeKkaTuxMc5JXiF3j2ydaMont9Piw0M6hmZP9Hk00%24&data=04%7C01%7Cinigo.barreira%40sectigo.com%7C084fe380f8fe46b0a2a208da077b4673%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637830523742344982%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=IrXcpLmL7cqZ4MNZLrfnSHI5IYb5jWFReJ868LOfmCI%3D&reserved=0">https://www.etsi.org/deliver/etsi_ts/119400_119499/11943101/01.02.01_60/ts_11943101v010201p.pdf</a><o:p></o:p></li></ol><p>The responsibility to manage keys on behalf of subscribers is not to be taken lightly as the current CSBRs do. Agreed that we can take some small improvements to the current CSBRs but if we believe that the goal is to define a secure environment with secure policies/practices that will make the ecosystem safer for subscribers and ultimately Relying Parties, then we probably need to invest more time if we want to copy good practices from other schemes.<o:p></o:p></p><p>On the other hand, this ETSI standard is already auditable and a legal entity could be audited and certified against ETSI TS 119 431. If a CA or a Subscriber wants to use a signing service, that signing service could either comply with the CSBRs and be audited against the requirements of section 17.1, or be audited against ETSI TS 119 431.<o:p></o:p></p><p>Thoughts?<o:p></o:p></p><p>Dimitris.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal>On 10/3/2022 10:00 μ.μ., Bruce Morton via Cscwg-public wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal>Here is the text we were discussing in the CSCWG meeting today.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Thanks, Bruce.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>=================================<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Proposed Signing Service items:<o:p></o:p></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Service is may be performed by the CA or a third party<o:p></o:p></li><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Service is not a CA requirement, so is NOT a function of a Delegated Third Party – this will limit scope<o:p></o:p></li><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Service references may be removed when not required - this will limit implied scope<o:p></o:p></li><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Service is not a Subscriber, so all Private Keys are only associated to certificate Subscriber<o:p></o:p></li><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Service is not an RA, so will not receive certificate requests from an Applicant – CA or Delegated Third Party RA will receive certificate requests<o:p></o:p></li><li class=MsoNormal style='mso-list:l2 level1 lfo2;vertical-align:middle'>Signing Request requirements will not be defined in the CSBRs<o:p></o:p></li></ol><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Private key generation<o:p></o:p></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoNormal style='mso-list:l1 level1 lfo3;vertical-align:middle'>Signing Service must provide evidence to the CA that the private key was created by the Signing Service. <o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo3;vertical-align:middle'>Question - Ballot CSC-13 allows the Signing Service to use cloud-based key generation. Can the CA can operate the cloud-based service?<o:p></o:p></li></ol><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Audit<o:p></o:p></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoNormal style='mso-list:l3 level1 lfo4;vertical-align:middle'>Specific compliance sections of CSBRs and NetSec should be stated in the CSBRs as the compliance/audit scope should not be determined by the CA, Signing Service and Auditor. Note, WebTrust for CA or ETSI EN 319 411-1 would not be in scope for Signing Service.<o:p></o:p></li><li class=MsoNormal style='mso-list:l3 level1 lfo4;vertical-align:middle'>For cloud-based key generation, is there a compliance requirement for the cloud-based service?<o:p></o:p></li></ol><p class=MsoNormal><span style='font-size:18.0pt'> </span><o:p></o:p></p><p class=MsoNormal><i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i> <br><br><br><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>Cscwg-public mailing list<o:p></o:p></pre><pre><a href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a><o:p></o:p></pre><pre><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fcscwg-public__%3B!!FJ-Y8qCqXTj2!Ijvhfy-9g01wuZ723tQAyBgBJgGeKkaTuxMc5JXiF3j2ydaMont9Piw0M6hmIfo-ikE%24&data=04%7C01%7Cinigo.barreira%40sectigo.com%7C084fe380f8fe46b0a2a208da077b4673%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637830523742344982%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=B%2BB2nV7Z5IhsQgxzYnkK3893ovIWtpAQ2VKXKHw4d%2BQ%3D&reserved=0">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a><o:p></o:p></pre></blockquote><p class=MsoNormal> <o:p></o:p></p></blockquote><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p></div></div></body></html>