<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1641381749;
mso-list-template-ids:28624292;}
@list l1
{mso-list-id:1789470742;
mso-list-type:hybrid;
mso-list-template-ids:-1345538374 -339069402 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=en-SE link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Ian,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Thank you for the explanation regarding a new target date. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>It does seems we’re already on a tight schedule to propose and get through the approval process of a potential ballot. Lets not forget that until we get this through a vote (if brought to a ballot), CAs and Subscribers will still be working on trying to make the existing deadline.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>I would like to suggest we also update the language in such a way that any CA wanting to keep going on their current schedule, should be able to. We could possibly do this by changing the current SHALLs to MAYs, adding a SHOULD for possibly June, and a SHALL for October. (I’m generalizing here, obviously we need to be clear in the actual language)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Regarding the SHALL, I can’t help but wonder if we should use the word RECOMMENDED instead. While it has the same meaning according to RFC2119, I can’t help but believe recommended puts a stronger point to it. I’ll gladly help out on a proposed textual change to bring this forward if need be. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Thanks, <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Martijn<o:p></o:p></span></p><p class=MsoNormal><span lang=en-SE style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-ligatures:none'>From:</span></b><span lang=EN-US style='mso-ligatures:none'> Cscwg-public <cscwg-public-bounces@cabforum.org> <b>On Behalf Of </b>Ian McMillan via Cscwg-public<br><b>Sent:</b> Wednesday, 7 September 2022 18:04<br><b>To:</b> Tim Hollebeek <tim.hollebeek@digicert.com>; cscwg-public@cabforum.org<br><b>Subject:</b> Re: [Cscwg-public] Subscriber Private Key Protection Deadline Update<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div style='border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><p class=MsoNormal style='line-height:12.0pt;background:#FAFA03'><span lang=EN-US style='font-size:10.0pt;color:black;mso-ligatures:none'>CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='mso-ligatures:none'><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US>Thanks Tim! In general, I agree with your perspective on the “SHOULD”, and I am trying to find something that would help alleviate the last-minute rush to meet the deadline. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>On the October date reasoning, I look at the typical release timelines for new tooling (e.g. SDKs) and significant platform updates coming in the fall season, so I’d like to try and align closely with when releases are coming out that are precluded by many folks making changes to address new tools or features coming in those releases cycles. October is also a time focused on getting right before the deployment/change freezes for services and pipelines that are commonly seen in the November and December time periods. This was the similar reasoning we had for the November date when we initially started discussing the changes for subscriber private key protections, but with the landing of v2.8 later than initially expected and the feedback, October 2023 seems like the best time to help alleviate the stress for those that run up to the deadline.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Ian <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-ligatures:none'>From:</span></b><span lang=EN-US style='mso-ligatures:none'> Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>> <br><b>Sent:</b> Wednesday, September 7, 2022 11:05 AM<br><b>To:</b> Ian McMillan <<a href="mailto:ianmcm@microsoft.com">ianmcm@microsoft.com</a>>; <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br><b>Subject:</b> [EXTERNAL] RE: Subscriber Private Key Protection Deadline Update<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I’m normally very supportive of SHOULD requirements, but for a deadline like this, I can unfortunately guarantee that including a June SHOULD date will have absolutely no practical effect. Instead, I would support any and all proposals people can think of for disincentivizing people from waiting until the last minute. It’s an important problem and one I wish we had better ways of dealing with.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>-Tim<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-ligatures:none'>From:</span></b><span lang=EN-US style='mso-ligatures:none'> Cscwg-public <<a href="mailto:cscwg-public-bounces@cabforum.org">cscwg-public-bounces@cabforum.org</a>> <b>On Behalf Of </b>Ian McMillan via Cscwg-public<br><b>Sent:</b> Wednesday, September 7, 2022 10:57 AM<br><b>To:</b> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br><b>Subject:</b> [Cscwg-public] Subscriber Private Key Protection Deadline Update<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Hi Folks,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Since the announcement of the new subscriber private key protection requirements in CSBR v2.8 (Ballot CSC-13), I’ve fielded a number of questions and feedback on the November 15, 2022 deadline. I feel it is in the best interest of subscribers and CAs to delay this deadline to be October 1, 2023 for a number of reasons.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoListParagraph style='margin-left:0cm;mso-list:l1 level1 lfo3'><span lang=EN-US>Subscriber & CA readiness time window from v2.8 to the November 15, 2022 deadline is too tight.<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0cm;mso-list:l1 level1 lfo3'><span lang=EN-US>The November 15, 2022 deadline lands too close to typical end of calendar year deployment or change “freeze” periods.<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0cm;mso-list:l1 level1 lfo3'><span lang=EN-US>The current global economic state makes investments a challenge and added operational budget pressure for all parties (subscribers, CAs, certificate consumers).<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0cm;mso-list:l1 level1 lfo3'><span lang=EN-US>Supply chain challenges make obtaining the proper key protection solution by November 15, 2022 increasingly difficult.<o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The accumulation of challenges for both subscribers and CAs, I feel we need to delay the deadline to be delayed. That said, I’d like to propose we have a “SHOULD” date of June 1, 2023, and a “MUST” date of October 1, 2023. I believe this will allow CAs and subscribers to begin adoption of the new private key protection requirements ahead of the enforcement deadline of October 1, 2023. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I’d like to discuss this as an immediate ballot in the next WG meeting scheduled for September 8, 2022. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Cheers,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Ian McMillan<o:p></o:p></span></p></div></div></div></body></html>