<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Black";
panose-1:2 11 10 4 2 1 2 2 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Gotham-MediumItalic;
panose-1:2 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:GOTHAM-LIGHTITALIC;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Gotham Book";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">There is work being done to draft an RFC for key attestation. There are some questions below which are for the CSCWG to address.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Bruce.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Mike Ounsworth <Mike.Ounsworth@entrust.com> <br>
<b>Sent:</b> Thursday, April 13, 2023 11:51 AM<br>
<b>To:</b> Corey Bonnell <corey.bonnell@digicert.com>; Bruce Morton <Bruce.Morton@entrust.com>; Tomas Gustavsson <Tomas.Gustavsson@keyfactor.com><br>
<b>Subject:</b> Clarification on CA/B CSC-13 and TPMs<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Corey, Bruce, Tomas,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This morning we had a fantastic meeting of almost two dozen representatives from HSM and CA vendors talking about key attestation formats to automate validation of compliance with CSBRs ballot CSC-13.
<a href="https://github.com/EntrustCorporation/draft-ounsworth-pkix-key-attestation/blob/master/meetingNotes/2023-04-13.md">
Full meeting notes are here</a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">One action item from this meeting was to request CA/B to clarify its position on TPMs with respect to CSC-13. From the discussion, it sounds like the intent of CSC-13 is to stop the practice of using software keys (p12 files or similar)
for publicly-trusted code signing subscriber keys. The question was raised “What if the code signing server’s motherboard has a TPM which is certified to FIPS 140-2 level 2+, or CC EAL 4+ and the subscriber key is resident to the TPM, does that count?”. Another
question that came up is whether the CSBRs should be future-proofed to include FIPS 140-3 since 140-2 is already deprecated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the call we operated under the assumption that FIPS / CC TPMs probably are within the intent of the new CSBRs, and CAs will need to implement two key attestation parsers: one for TPMs as per the TPM 2.0 specification, and one for HSMs
– whatever results from this group. However we would like official confirmation from CA/B before we get too deep into this.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal">- - -<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="265" valign="top" style="width:198.8pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="margin-bottom:2.7pt;text-align:center;text-autospace:none">
<span style="font-size:14.0pt;font-family:"Arial Black",sans-serif;color:#6F2176">Mike Ounsworth</span><span style="font-size:14.0pt;font-family:"Gotham Book";color:#6F2176"><o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="margin-bottom:3.25pt;text-align:center;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black">Software Security Architect<o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="margin-bottom:3.25pt;text-align:center;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black">(pronouns: he/him)</span><span style="font-size:12.0pt;font-family:GOTHAM-LIGHTITALIC;color:#4D4F53"><o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="margin-bottom:2.15pt;text-align:center;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#6F2176">O:</span><span style="font-size:12.0pt;font-family:Gotham-MediumItalic;color:#6F2176">
</span><span style="font-size:12.0pt;font-family:Gotham-MediumItalic;color:black">+1-613-270-2873</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black">
<o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="text-align:center;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Arial",sans-serif"><img border="0" width="251" height="9" style="width:2.6145in;height:.0937in" id="Picture_x0020_11" src="cid:image001.png@01D96DF4.93D9E9C0"></span><span style="font-size:12.0pt;line-height:150%;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="text-align:center;line-height:150%"><span style="font-size:6.0pt;line-height:150%;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt"><img border="0" width="159" height="97" style="width:1.6562in;height:1.0104in" id="Picture_x0020_12" src="cid:image002.png@01D96DF4.93D9E9C0"></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</body>
</html>