<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Texto de globo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EstiloCorreo17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.TextodegloboCar
{mso-style-name:"Texto de globo Car";
mso-style-priority:99;
mso-style-link:"Texto de globo";
font-family:"Tahoma","sans-serif";
mso-fareast-language:ES;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ryan,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">411-2 says that “all the requirements defined for EVCP in ETSI EN 319 411-1 shall apply for issuing QCP-w”, so, if you feel more comfortable admitting
only 411-1, I see no issue but I still don´t understand why because if a TSP only wants to issue qualified certificates, and get his audit in 411-2 for QCPw (which means that all the requirements for EVCP defined in 411-1 applies), what are you going to do
with these qualified certificates? Are you going to accept it or not? If not, why?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Anyway, I can change the ballot to include only the 411-1 but would like to hear from others what´s their opinion.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:9.75pt"><b><span style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black">Iñigo Barreira</span></b><span style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black"><br>
Responsable del Área técnica<br>
</span><span lang="ES-TRAD" style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black"><a href="mailto:i-barreira@izenpe.eus">i-barreira@izenpe.eus</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black">945067705</span><span lang="ES-TRAD" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:navy"><img border="0" width="589" height="99" id="Imagen_x0020_1" src="cid:image001.jpg@01D1C7B4.95A256E0" alt="Descripción: firma_email_Izenpe_eus"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:9.75pt"><span style="font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD">ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea.
Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#888888;mso-fareast-language:ES-TRAD"><br>
</span><span style="font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD">ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe
por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.</span><span style="font-family:"Calibri","sans-serif";color:navy;mso-fareast-language:ES-TRAD"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">De:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Enviado el:</b> martes, 14 de junio de 2016 18:15<br>
<b>Para:</b> Barreira Iglesias, Iñigo<br>
<b>CC:</b> public@cabforum.org<br>
<b>Asunto:</b> Re: [cabfpub] RV: [cabfman] Ballot 171? for updating the ETSI standards in the CABF documents<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Jun 14, 2016 at 12:42 AM, Barreira Iglesias, Iñigo <<a href="mailto:i-barreira@izenpe.eus" target="_blank">i-barreira@izenpe.eus</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ryan,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">A CA that wants to issue EV certs need to be audited against 411-1 for the EVCP policy
and that implies that also have to “pass” the 401, which is the generic for all type of TSPs and include for example all the network security requirements specified by the CAB Forum.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If a CA wants to issue QWACs, have to be audited against 411-2 for the QCPw policy,
which takes by reference the 411-1 and also the 401. This is something similar of what Webtrust does if you feel more confortable.</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It isn't, which is my point. These are fundamentally different approaches.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm much more inlined to suggest only 411-1 should be recognized. Having 411-2 incorporate 411-1 by reference makes it difficult to ascertain when 411-1 applies or when 411-2 has imposed restrictions counter with or superior to 411-1, whereas
it's much easier to objectively state compliance with 411-1, and (from a root store perspective) to evaluate the stipulations of 411-1 in the context of the EV Guidelines, as well as any future updates.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That is, I'm uncomfortable with fully delegating out the task of verifying that 411-2 doesn't do anything in conflict with 411-1, especially when CAs are involved in drafting and developing 411-2 (which is also different than how the WebTrust
work is developed)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">For example, Izenpe, is going to get audited against 411-1 for the DV, OV and EV policies
and also against 411-2 for the QCPw policy. If we had the intention of only issue QCs because as EU CA can make it, then, we´ll have only the 411-2 and that does not mean that, even 411-2 for QCPw uses mostly of the requirements of the EVCP in 411-1, I can
issue EV certs. So, a CA that want to issue EV certs has to be audited against 411-1, a CA that want to issue EV and QCPW has to be audited against 411-1 and 411-2, and if only wants to issue QCPw, then only 411-2 which in any case will have to follow what
everything that is stated in 401 and 411-1.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I suppose put differently, since we're still talking past eachother, I questioning whether QCPw under 411-2 would result in Izenpe being able to apply for EV status with the QCPw OID. I am suggesting no, it would not be sufficient - that
in order to have QCPw (audited under 411-2) recognized as EV, Izenpe would also need to undergo a 411-1 audit, for the EVCP, and then assert that the QCPw certs were also EVCP certs. Then, the EV recognition would be based on the EVCP OID, and not the QCPw
OID.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In effect, I'm suggesting no special treatment or recognition for QCPw / 411-2, and that the only thing that matter to root programs is 411-1 with EVCP with respect to EV. Similarly, if a CA presented a 411-2 audit only, with no 411-1 audit,
it wouldn't intrinsically be included. The CA would also have to undergo a 411-1 audit, for DVCP/PTC-BR (at a minimum)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm expressly uncomfortable with the notion on additional audit schemes that partially incorporate by reference the baselines as being considered equivalent; it places additional burden during the evaluation of audits to examine the audit
criteria to see if the supplementary scheme (e.g. QCPw) fully complies with the base scheme (PTC-BR/DVCP/EVCP), and that's not a cost that seems to provide benefits to the ecosystem at large.<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">OTOH, I´d like to clarify that Webtrust is one thing and ETSI is another one, and you
all can´t compare all the time or try to “understand” what ETSI does on the way Webtrust does. But in any case, at the end, both schemes check/assess the same things.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don't think that's been in question. However, I was trying to illustrate the principles at play here, since regardless of the approach - WebTrust or ETSI - they serve a valuable role.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So if a non EU CA wants to issue QCPw it has to follow what the 411-2 says, which by
default, will look at 411-1 and 401. </span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And this is what I have issue with.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">And finally, the intention of this ballot is just to replace an obsolete ETSI standard
for the newest one which includes all CABF requirements and provides a better clarification on the audit stuff which was the major concern during the past 2 years for the browsers. If there´s a specific point that needs to clarify just let me know and we can
rephrase it to make it clear.</span><o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Again, let me repeat: I'm not supportive of adding 411-2 to the list of documentation. And Erwann has also pointed out specific concerns to resolve. <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>