<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.normaltextrun
{mso-style-name:normaltextrun;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:452863476;
mso-list-template-ids:1861018808;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=en-SE link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Hi Tomas,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>></span><span lang=EN-US style='color:#212121'> </span><span style='color:#212121'>There is no language to not revoke the certificate if it was found to be a false positive? <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#212121'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#212121'>Correct. The existing language didn’t contain this either, however the proposed language does add a bit more clarity (emphasis mine): “</span><span class=normaltextrun><span lang=EN-US>For all incidents <b>that lead the CA to believe</b> that the certificate private key is compromised or is being used for Suspect Code”<o:p></o:p></span></span></p><p class=MsoNormal><span class=normaltextrun><span lang=EN-US>This allows the CA to conclude something is a false positive, and thus would not need to revoke.<o:p></o:p></span></span></p><p class=MsoNormal><span class=normaltextrun><span lang=EN-US><o:p> </o:p></span></span></p><p class=MsoNormal><span lang=EN-US style='color:#212121'>> </span><span style='color:#212121'>What is the reason to not contact the subscriber? <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#212121'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#212121'>The scenario I can see is if the CA becomes aware of a threat actor and does not want to tip them off regarding the upcoming revocation, or if a CA Certificate Beneficiary reaches out to the CA to request revocation. Granted, that last item would probably fall under section “</span>Revocation Based on an Application Software Supplier’s Request<span lang=EN-US>”, but that doesn’t exclude the fact that section </span><span lang=EN-US style='color:#212121'> “</span>Revocation Based on Reported or Detected <span lang=EN-US>Key</span> Compromise or Use in <span lang=EN-US>Suspect Code” may also need to be followed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Regards,<br><br>Martijn</span><span lang=EN-US style='color:#212121'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-SE style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> Tomas Gustavsson <Tomas.Gustavsson@keyfactor.com> <br><b>Sent:</b> Tuesday, 28 June 2022 21:01<br><b>To:</b> Martijn Katerbarg <martijn.katerbarg@sectigo.com>; cscwg-public@cabforum.org<br><b>Subject:</b> Re: [Cscwg-public] Proposal to make changes to revocation based on malware<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div style='border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><p class=MsoNormal style='line-height:12.0pt;background:#FAFA03'><span style='font-size:10.0pt;color:black'>CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal style='background:white'><span style='color:#212121'>I missed the F2F, so just curious. <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'>There is no language to not revoke the certificate if it was found to be a false positive? <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'>What is the reason to not contact the subscriber? <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'>Regards, <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'>Tomas <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='color:#212121'><o:p> </o:p></span></p></div><div id=mail-editor-reference-message-container><p class=MsoNormal><o:p> </o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="98%" align=center></div><div id=divRplyFwdMsg><p class=MsoNormal><strong><span style='font-family:"Calibri",sans-serif'>From:</span></strong> Cscwg-public <<a href="mailto:cscwg-public-bounces@cabforum.org">cscwg-public-bounces@cabforum.org</a>> on behalf of Martijn Katerbarg via Cscwg-public <<a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>><br><strong><span style='font-family:"Calibri",sans-serif'>Sent:</span></strong> Monday, 27 June 2022, 16:04<br><strong><span style='font-family:"Calibri",sans-serif'>To:</span></strong> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a> <<a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>><br><strong><span style='font-family:"Calibri",sans-serif'>Subject:</span></strong> [Cscwg-public] Proposal to make changes to revocation based on malware<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div style='border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><p class=MsoNormal style='line-height:12.0pt;background:#FFEB9C'><b><span style='font-size:10.0pt;color:#9C6500'>CAUTION:</span></b><span style='font-size:10.0pt;color:black'> External Sender - Be cautious when clicking links or opening attachments. Please email <a href="mailto:InfoSec@keyfactor.com">InfoSec@keyfactor.com</a> with any questions.<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span lang=EN-US>All,</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>As already hinted during the last meeting during the F2F, Ian and I, have been working on a proposal affecting the guidelines regarding malware based revocation.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>The intent of this change is to:</span><o:p></o:p></p><ul style='margin-top:0cm' type=disc><li class=MsoListParagraph style='margin-top:0cm;margin-bottom:0cm;mso-list:l0 level1 lfo1'><span lang=EN-US>Limit the number of days before a certificate needs to be revoked, especially when the subscriber is not responding to inquiries</span><o:p></o:p></li><li class=MsoListParagraph style='margin-top:0cm;margin-bottom:0cm;mso-list:l0 level1 lfo1'><span lang=EN-US>Remove the OCSP log analysis requirements</span><o:p></o:p></li><li class=MsoListParagraph style='margin-top:0cm;margin-bottom:0cm;mso-list:l0 level1 lfo1'><span lang=EN-US>Simplify the process that has to be followed</span><o:p></o:p></li></ul><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>I have attached 3 documents: one with the current language, one with the proposed language, as well as a redlined version.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>The changes have been made based on upcoming version 3.0 of the CSCBRs. In case you wish to compare with version 2.8, the relevant section is 13.1.5.3. Besides to that section, there is also a change to the “Suspect Code” definition, as well as a new definition in the proposal.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Once <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fcode-signing%2Fpull%2F6&data=05%7C01%7Cmartijn.katerbarg%40sectigo.com%7C8a755fea2eb34242ff1708da59387cd2%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637920396957506961%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=Gl20CtakpivVtC%2BOrcx58TEJIq%2FRAeuVjMHX8Bzi2PM%3D&reserved=0">PR6</a> has been merged, I will also prepare the changes in GIT for those that prefer comparing there.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Looking forward to comments to this and move towards a potential ballot.<br><br>Regards,<br><br>Martijn</span><o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></div></body></html>