<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:646056888;
mso-list-template-ids:-1456464086;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:915629842;
mso-list-type:hybrid;
mso-list-template-ids:-1540330960 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><b><span style='font-size:12.0pt'>Final minutes of CSCWG Aug 24, 2023<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Attendees: Abhishek Bhat - (eMudhra), Andrea Holland - (VikingCloud), Bruce Morton - (Entrust), Corey Bonnell - (DigiCert), Dean Coclin - (DigiCert), Dimitris Zacharopoulos - (HARICA), Ian McMillan - (Microsoft), Inaba Atsushi - (GlobalSign), Inigo Barreira - (Sectigo), Martijn Katerbarg - (Sectigo), Mohit Kumar - (GlobalSign), Scott Rea - (eMudhra), Tim Crawford - (CPA Canada/WebTrust), Tim Hollebeek - (DigiCert)<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>The Anti-trust reminder was read<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>The minutes of August 10<sup>th</sup> were approved. <o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Adobe Interested party application – no update<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Ballot status<o:p></o:p></span></li><ol style='margin-top:0in' start=1 type=a><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level2 lfo3'><span style='font-size:12.0pt'>SSL BR references – in IPR review until September 1<sup>st</sup><o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level2 lfo3'><span style='font-size:12.0pt'>Signing Services – Bruce had sent out drafts for this and the other 2 below. He received 1 comment back. Bruce asked for help in moving this to github and start working on the official ballot. Corey agreed to help. Ian commented that the draft should mention FIPS Level 3. Did we want to clarify the FIPS 140-3? Bruce said he can add a comma to include both. Ian asked about an effective date and said we should set one to avoid chaos. Tim said there’s no confirmed evidence of anyone having a problem with this ballot and we should pick a date and see if anyone complains. <o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level2 lfo3'><span style='font-size:12.0pt'>High Risk applications – Bruce suggested we do one of these 3 ballots at a time, starting with the signing service, followed by the high risk. Ian wants to spend more time scrutinizing the high risk ballot. <o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level2 lfo3'><span style='font-size:12.0pt'>Time stamping: Ian said that Martijns comments (via email) addressed his concerns. Martijn had some other concerns regarding the key destruction part and auditor criteria. Having an auditor witness it every 18 months could be costly. Could we just make sure that they are no longer online? Bruce agreed that they don’t need to be audited. Dimitris said it can be an internal ceremony without an auditor. The auditor can review that. Inigo asked why they have to be destroyed. Tim said there is no reason for the private keys to exist. Dimitris was concerned about key backups and having to find and delete those. Tim said as long as they are no longer usable, it should be fine. Final agreement: no auditor necessary. Martijn will draft some language in github to make it clear. <o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level2 lfo3'><span style='font-size:12.0pt'>Dimitris asked if there was interest in doing the same work that was done with the TLS BRs and the Netsec guidelines for the EV guidelines (pulling the EV guidelines into the CSBRs). Ian said it could be wasted work if we decide to do away with EV and just have one standard. Dimitris said it would be helpful to bring them in and review what should stay and what should go. Tim said we should go thru and see what the actual EV references are and look at each one. Corey had a concern about the changes to the numbering and references. Dimitris said the CSBRs are already in the 3647 format. Tim said that we still need to go through each item. Dimitris suggested we should have this discussion at the next F2F meeting. He will pull together all the references to the EV guidelines from the CSBRs. <o:p></o:p></span></li></ol><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Lessons learned from June 1 change: Suggestion made to push this to F2F. One item Bruce heard was that their validation team was more technical than they were used to.<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Next meeting September 7<sup>th</sup> <o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-size:12.0pt'>Adjourned<o:p></o:p></span></li></ol><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='font-family:"Arial",sans-serif;color:#0174C3;mso-ligatures:none'>Dean Coclin <o:p></o:p></span></b></p><p class=MsoNormal><span style='font-family:"Arial",sans-serif;color:#48565E;mso-ligatures:none'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Arial",sans-serif;color:#48565E;mso-ligatures:none'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-ligatures:none'><o:p> </o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>