<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hello all, <div><br></div><div>This thread was unintentionally started on the NetSec Management list, but is more suited to the public list. With permission, I’m forwarding the thread so far.</div><div><br></div><div>Cheers,</div><div>-Clint<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">Tim Hollebeek <tim.hollebeek@digicert.com><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;"><b>RE: [Netsec-management] Update to restructure draft</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">February 2, 2024 at 8:18:39 AM PST<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">Clint Wilson <clintw@apple.com><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Cc: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">NetSec Management <netsec-management@cabforum.org><br></span></div><br><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Yes, I agree with your analysis. Key points:<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><ol start="1" type="1" style="margin-bottom: 0in; margin-top: 0in;"><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I agree that most if not all of this mess exists or is even worse in the current NCSSRs, so the work so far is already an improvement.<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Exactly how much of that we need to fix before we can pass an update is a very tough question. Even having the same requirements expressed in a different format will be quite a bit of churn for auditors to get their heads around, so I think we do need to get it to a point where it will solve enough problems to justify the churn.<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I agree that there is always a balance between expressing the security goal/requirements, and detailed procedural requirements (“You MUST do it This Way, by following these steps …”). There are advantages and disadvantages to each approach. There’s a third one (example below) where you write requirements about the maturity of the process and transparency, to allow better oversight. Over time, I’m increasingly fond of the “you can do what you want (within hard boundaries), but you have to tell us what you’re doing” model.<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">The reason I’m balking on the use of ‘appropriate’ in 1.1.1.1 is because there isn’t enough meat there that provides any guidance about the security goal, the target security level, and so on, so “appropriate” will just be CAs, auditors, and root programs arguing about opinions. And “whose opinion is better?” is almost always guaranteed to be an unproductive discussion. There are plenty of useful uses for ‘appropriate’, but sometimes it’s just a dodge to avoid tackling the hard problems that need to be tackled.<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On 1.1.1.2, I think a SHOULD would be quite appropriate. There are other approaches available that are stronger, for example: “The design MUST be based on a documented security analysis, which MUST take into account and mention the following principles …” Sometimes just requiring people to have a rational and documented security posture is already an improvement …<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">And yes, I do think 1.3 looks quite good. I’m sure we might have some quibbles with the details, but I like that section.<o:p></o:p></li></ol><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Bindi will probably also have a lot more comments and feedback once she gets up to speed … she actually has real operational security experience in this area, and I’ve asked her to assist with the NCSSR development process in the hopes that having an additional security resource available will help accelerate the development process.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Also we should probably move off the management list.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-Tim<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor blue; border-image: none; padding: 0in 0in 0in 4pt;"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="Apple-converted-space"> </span>Clint Wilson <clintw@apple.com><span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, February 1, 2024 9:52 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Tim Hollebeek <tim.hollebeek@digicert.com><br><b>Cc:</b><span class="Apple-converted-space"> </span>NetSec Management <netsec-management@cabforum.org><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Netsec-management] Update to restructure draft<o:p></o:p></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Hi Tim,<o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks very much for the input here. I think you’re spot on with regards to where we need to get the NCSSRs, but I also don’t know that I believe this ballot to be the best place to address some of these issues — both from my personal opinion and from what I’ve heard expressed in NSWG meetings.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">The primary goal of the draft is to restructure the NCSSRs in a way that makes them more maintainable and easier to expand upon in the future. In the course of restructuring the document, it became clear that there was a need to make some changes to content and wording in order to have an end product that made sense (for example, moving some requirements into more applicable sections and deduplicating requirements). This was pursued based on feedback from the NSWG last year indicating a rough consensus that it was a direction the group supported (of course, I’m certainly not ruling out that I may have misunderstood something in the 3-4 meetings where such a discussion took place). That said, it has also remained my intent to try to minimize the number and depth of changes between the functional expectations represented by a) the current and b) these draft requirements.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Unfortunately, I think a number of your concerns are present in the current NCSSRs and very much highlight why, at least in my opinion, it’s necessary to update the document’s structure so that 1) these issues are easier to identify and 2) these issues are easier to fix.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">FWIW, I’m increasingly confident that this draft does accomplish these 2 things based on my personal experience so far in writing the draft; it’s hard to describe how much easier it is to work with the text now compared to when I started this process.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">(More below in-line)<o:p></o:p></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Feb 1, 2024, at 12:59 PM, Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" style="color: blue; text-decoration: underline;">tim.hollebeek@digicert.com</a>> wrote:<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">It would be useful to know when people feel portions of this document are stable enough for a deep review, as such reviews are pretty time consuming given the scope and nature of the issues.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">As a data point, I took a quick read through, and my opinion is we’re not there yet, and that’s because I have serious concerns about the auditability of these requirements.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div style="margin-left: 0.5in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.5in;">1.1.1.1<span style="font-size: 7pt; font-family: "Times New Roman", serif;"> <span class="apple-converted-space"> </span></span>“appropriate and applicable” is code for “CAs, auditors, and browsers will have lots of unproductive discussions about what this means in practice”<o:p></o:p></div></div></div></blockquote><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I think there’s a balance necessary here (and more generally in our requirements documents) between a) prescribing/proscribing specific behaviors or implementation requirements and b) describing reasonable expectations which can be met multiple ways. I believe it’s necessary, at least presently, for some aspects of documents like the NCSSRs to provide clear guidance regarding the outcome of adherence, while still allowing for differences in exactly how a CA meets the requirement. <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Perhaps surprisingly(?), I think it’s healthy for CAs, auditors, browsers, and other industry participants to have discussions about what this requirement would mean in practice (I hope they’re productive and I’m not sure why they couldn’t be, though I definitely get that they’re<span class="Apple-converted-space"> </span><b>far</b> from<span class="Apple-converted-space"> </span><i>guaranteed</i> to be). Those discussions could result in identifying patterns in different implementations which map to improved security that can in turn be incorporated into the NCSSRs as (more) specific criteria. That would be fantastic!<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">As of right now, however, I think the reality of what is “appropriate and applicable”<span class="Apple-converted-space"> </span><b>is</b> different for quite literally every single Certificate Issuer in the CA/B Forum. <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">FWIW and as I understand it, “appropriate” is a relatively common component of controls and requirements the NSWG reviewed when comparing the NCSSRs to other documents of varying levels of similarity (and, in particular, it’s peppered throughout the Cloud Controls Matrix).<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">All that said, if there are any wording changes or specific actions you (or anyone) would recommend, including if you feel like the above simply doesn’t address your concerns meaningfully and 1.1.1.1 should just be dropped, I would appreciate hearing your thoughts.<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin-left: 0.5in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.5in;">1.1.1.2<span style="font-size: 7pt; font-family: "Times New Roman", serif;"> <span class="apple-converted-space"> </span></span>I don’t think it’s auditable whether network segmentation meets what are essentially just design principles, no matter how thoughtfully they are articulated<o:p></o:p></div></div></div></blockquote><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">The above applies here as well, but I also wanted to add that this section was specifically added based on sentiments shared in the NSWG that we should convey these kinds of expectations in the NCSSRs more frequently. I do believe this to be an auditable requirement, but am certainly open to being corrected on that understanding. At one point I was pondering whether this requirement should be a SHOULD instead of a MUST and the (limited) feedback I received at the time was to keep it a MUST, but I’m curious if you think changing this to a SHOULD would address your concern at all? (I’m guessing not by much, but I don’t want to assume.)<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">1.2.1. Much better.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">1.2.2. Again, I don’t think “unnecessary” and “Principle of Least Privilege” are auditable.<o:p></o:p></div></div></div></blockquote><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">This is currently part of the NCSSRs (a combination of parts of 1.f, 1.g, and 2.e); while the wording is different (e.g. “identified as necessary” instead of “minimizes unnecessary”), I believe the actual requirement is the same. So… I hope it’s auditable :)<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">BUT(!) I would absolutely<span class="Apple-converted-space"> </span><i>love</i><span class="Apple-converted-space"> </span>to improve these requirements. I tried to do so to a small extent by defining “Principle of Least Privilege”, which was previously undefined in its usage within 2.e, but I felt more/larger changes here would be going against the primary goal/intent of this draft.<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">1.2.3. What is “equivalent security”? How is it measured?<o:p></o:p></div></div></div></blockquote><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">This is intended to be only a slight re-wording and clarification of the current NCSSR requirement 1.b. Would it be preferable to keep the current wording instead? (I think the same issue would still exist, but perhaps there’s nuance I’m failing to see.)<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">1.3. This section is a good example of how much specificity and detail is desirable and needed.<o:p></o:p></div></div></div></blockquote><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">This section took a lot of time, trying to pull in the explicit and implicit requirements of 1.h, 2.a, and 3.a into a comprehensible set of expectations around change management. I’m genuinely very glad that you approve (I think you do, at least; I don’t mean to put words in your mouth). Especially 3.a is quite overloaded; quite the interesting challenge to figure out an appropriate balance of specificity here that would provide enough detail of 1) what’s<span class="Apple-converted-space"> </span><i>actually </i>expected and 2) the scope those expectations apply to without unnecessarily constraining a CA’s ability to meet the requirements in a way that makes sense for their organization, team structure, resource allocation, etc.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">This is also a good example of what I mean when I say I think that restructuring the NCSSRs, as this draft attempts to do, will help enable and hasten fixes to the myriad of (mostly) small and (some) big issues latent in the current NCSSRs — I don’t believe I could have drafted such a set of requirements while fitting them into the current style and format of the NCSSRs.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thank you again for your feedback and I hope to hear more!<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Cheers,<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-Clint<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Those are the sorts of things I would like to see addressed before I run this by our networks and operations folks for a deep review.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-Tim<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; padding: 0in 0in 0in 4pt; border-color: currentcolor currentcolor currentcolor blue; border-image: none;"><div><div style="border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-color: currentcolor; border-image: none;"><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="apple-converted-space"> </span>Netsec-management <<a href="mailto:netsec-management-bounces@cabforum.org" style="color: blue; text-decoration: underline;">netsec-management-bounces@cabforum.org</a>><span class="apple-converted-space"> </span><b>On Behalf Of<span class="apple-converted-space"> </span></b>Clint Wilson via Netsec-management<br><b>Sent:</b><span class="apple-converted-space"> </span>Thursday, February 1, 2024 10:35 AM<br><b>To:</b><span class="apple-converted-space"> </span>NetSec Management <<a href="mailto:netsec-management@cabforum.org" style="color: blue; text-decoration: underline;">netsec-management@cabforum.org</a>><br><b>Subject:</b><span class="apple-converted-space"> </span>[Netsec-management] Update to restructure draft<o:p></o:p></div></div></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Hi all,<o:p></o:p></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks for the fantastic discussion on Tuesday :)<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I’ve updated my branch based on what I understood, but please let me know if I missed anything. I’m reasonably happy with the outcome, though there’s always room for improvement.<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">The branch remains available at <a href="https://github.com/cabforum/netsec/tree/offline-hsms" style="color: blue; text-decoration: underline;"><span style="color: rgb(5, 99, 193);">https://github.com/cabforum/netsec/tree/offline-hsms</span></a>. <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Further a couple (hopefully useful) diffs are:<o:p></o:p></div></div></div><div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;"><li class="MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Comparison between main and commit:<span class="apple-converted-space"> </span><a href="https://github.com/cabforum/netsec/compare/c62a2f88e252de5c79b101fa3c9e9c536388639a...8706d87d049baee0faa668b03e7c5b8e330339d7" style="color: blue; text-decoration: underline;"><span style="color: rgb(5, 99, 193);">https://github.com/cabforum/netsec/compare/c62a2f88e252de5c79b101fa3c9e9c536388639a...8706d87d049baee0faa668b03e7c5b8e330339d7</span></a><o:p></o:p></li><li class="MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Comparison between prior major commit (Oct 2023) and latest commit:<span class="apple-converted-space"> </span><a href="https://github.com/cabforum/netsec/compare/0d34f4ab148439130e28d4fa8128af7385fc21d3...8706d87d049baee0faa668b03e7c5b8e330339d7" style="color: blue; text-decoration: underline;"><span style="color: rgb(5, 99, 193);">https://github.com/cabforum/netsec/compare/0d34f4ab148439130e28d4fa8128af7385fc21d3...8706d87d049baee0faa668b03e7c5b8e330339d7</span></a><o:p></o:p></li></ul><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I haven’t fully updated <a href="https://docs.google.com/document/d/1mOEiNZ-R_D4l_8OgScqx8mhcUwBPoXkNjlBpY5g29Dg" style="color: blue; text-decoration: underline;"><span style="color: rgb(5, 99, 193);">https://docs.google.com/document/d/1mOEiNZ-R_D4l_8OgScqx8mhcUwBPoXkNjlBpY5g29Dg</span></a><span class="apple-converted-space"> </span>with descriptions of these changes, but will try to do so soon.<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">My sense is that sections 1-3 of this draft are stabilizing, so I would appreciate any feedback on whether that’s the case (and identification of latent issues would be most welcome). <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Next on my list is to make an attempt at addressing our historical discussions surrounding Physically Secure Environment/Root CA System separation within this document structure.<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Please let me know of any thoughts or input you may have. Cheers!<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-Clint</div></div></div></div></div></blockquote></div></div></div></div></div></blockquote></div><br></div></body></html>