<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Calibri-Bold;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.Strike
{mso-style-name:Strike;
mso-style-priority:1;
color:red;
text-decoration:line-through;}
span.Insert
{mso-style-name:Insert;
mso-style-priority:1;
color:#0066FF;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Because Adam can’t post his responses to the Public@ list, I’m doing it for him at his request.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Adam.Goldberg@sony.com [mailto:Adam.Goldberg@sony.com]
<br>
<b>Sent:</b> Wednesday, June 27, 2018 5:46 PM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com>; public@cabforum.org<br>
<b>Subject:</b> [EXTERNAL]RE: Membership Application of Sony<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">All:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">First, a bit of background. The ATSC 3.0 television broadcast standard (see
<a href="http://www.atsc.org">www.atsc.org</a>, or search the web for “ATSC 3.0”), which is generally speaking a modification of the over-the-air digital broadcast system, which is based on a UDP multicast over-the-air (with an optional online aspect, for a
hybrid system) – and an attempt to use internet/web/W3C tools when possible. <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">This includes a number of security features (and I chair the security group in ATSC). Among those features are support for content protection mechanisms using
EME and CENC … as well as cryptographic signing mechanisms. Deployments plan to use public root(s) for code signing (and signaling signing, more detail below).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">To answer the questions:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Ryan Sleevi:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">It sounds like the question is "Can we join the Forum without joining a CWG" - but that may not be a correct understanding.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">That’s not our ask. I’m happy to participate in a (the) CWG, but see below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Kirk Hall:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:1.0in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(a) All Forum members must *** meet at least one of the following criteria: ***<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:1.0in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:1.5in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(<u>3)
<b>Certificate Consumer</b>: The member organization produces a software product, such as a browser, intended for use by the general public for relying upon certificates</u> and is a member of a CWG [Chartered Working Group, such as the new Server Certificate
Working Group]<u>.</u><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Today we only have one Chartered Working Group (CWG). Its charter has the following additional requirement for participation as a browser (Certificate
Consumer):<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:1.0in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(3) A Certificate Consumer can participate in this Working Group if it produces a software product intended for use by the general
public for browsing the Web securely.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">So to participate in this CWG (the only one we have), Sony must “produce[] a software product intended for use by the general public for browsing the
Web securely”. Can you tell us if Sony meets that requirement?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">An ATSC 3.0 TV is a dual-homed device with both a one-way over-the-air interface which receives UDP multicasts, and a traditional IP interface (802.3, 802.11)
for an internet connection. This sort of TV includes a HTML5 browser, and our security requirements include mandatory use of DNSSEC and TLS 1.2, 1.3. So, these devices are products with software intended for use by the general public for browsing the web
securely … but “browsing the web” is a little bit more constrained than a PC with a browser, more like “browsing [some content on] the web”.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As a threshold matter, I think such a TV is hardware bundled with software which is capable of fetching content (including HTML and other content, like audio/video)
from the internet and rendering it, which relies upon certificates for security (TLS, DNSSEC).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">However, of significant interest is the use of cryptographic signing to yield a tamper-evident transmission mechanism for both executable code (like HTML5 apps)
and related information (signaling, which includes things like what-content-is-where, and electronic program guide data). It’s our hope that we can participate in the processes for maintaining requirements for public roots for signing certificates.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">We realize that this is perhaps slightly different from the traditional CA/B Forum area, but at the same time, all or nearly all of the requirements and details
for the issuance and management of code signing certificates (and where the CA Security Council refers to the Baseline Requirements, etc.) are directly usable and useful for the embedded systems that are TVs (& related broadcast systems).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hopefully the above is clear, but I’d be happy to elaborate/explain more if that’d be helpful.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">Adam Goldberg<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">Director, Technical Standards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">Technology Standards Office<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">Sony Electronics, Inc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">202-601-4130 (tel)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#44546A">571-363-9778 (mobile)<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Kirk Hall [<a href="mailto:Kirk.Hall@entrustdatacard.com">mailto:Kirk.Hall@entrustdatacard.com</a>]
<br>
<b>Sent:</b> Wednesday, June 27, 2018 3:36 PM<br>
<b>To:</b> Goldberg, Adam <<a href="mailto:Adam.Goldberg@sony.com">Adam.Goldberg@sony.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<b>Subject:</b> Re: Membership Application of Sony<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Adam – I just realized that there is a double test for anyone new applying to be a Forum member – one requirement to be a Forum Member, and a second requirement to be a member
of a CWG. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">In the browser (Certificate Consumer) category, the Forum membership requirement is as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(a) All Forum members must *** meet at least one of the following criteria: ***<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:1.0in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(<u>3)
<b>Certificate Consumer</b>: The member organization produces a software product, such as a browser, intended for use by the general public for relying upon certificates</u> and is a member of a CWG [Chartered Working Group, such as the new Server Certificate
Working Group]<u>.</u><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Today we only have one Chartered Working Group (CWG). Its charter has the following additional requirement for participation as a browser (Certificate Consumer):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(3) A Certificate Consumer can participate in this Working Group if it produces a software product intended for use by the general
public for browsing the Web securely.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">So to participate in this CWG (the only one we have), Sony must “produce[] a software product intended for use by the general public for browsing the Web securely”. Can you
tell us if Sony meets that requirement?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Sorry for any confusion – we are just rolling out this new governance structure now.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Kirk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Kirk Hall via Public<br>
<b>Sent:</b> Wednesday, June 27, 2018 12:15 PM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<b>Subject:</b> Re: [cabfpub] [EXTERNAL]Re: Membership Application of Sony<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Good question. The SCWG Charter is shown below. Ben and I are the initial SCWG Chair and Vice Chair until the SCWG elects its own officers. The SCWG was approved in Ballot
206 and already exists, but the changes to the Bylaws don’t become effective until July 3.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">After that date, I plan to issue an invitation to CABF Members and Associate Members to participate in the SCWG, and ask them to indicate their interest by “registering” on
a page on the wiki. Interested Parties can also indicate their interest in the WG, probably by email.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We should probably amend Bylaw 5.3.1 - Formation of Chartered Working Groups to include specific procedures for how Forum Members, etc. join new WGs once they are established.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:14.0pt;font-family:Calibri-Bold">Server Certificate Working Group Charter<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Upon approval of the CAB Forum by ballot, the Server Certificate Working Group (“Working Group”) is created<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">to perform the activities as specified in this Charter, subject to the terms and conditions of the CA/Browser<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Forum Bylaws and Intellectual Property Rights (IPR) Policy, as such documents may change from time to<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">time. The definitions found in the Forum’s Bylaws shall apply to capitalized terms in this Charter.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">SCOPE:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The authorized scope of the Server Certificate Working Group shall be as follows:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">1. To specify Baseline Requirements, Extended Validation Guidelines, Network and Certificate System<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Security Requirements, and other acceptable practices for the issuance and management of SSL/TLS<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">server certificates used for authenticating servers accessible through the Internet.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">2. To update such requirements and guidelines from time to time, in order to address both existing and<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">emerging threats to online security, including responsibility for the maintenance of and future<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">amendments to the current CA/Browser Forum Baseline Requirements, Extended Validation<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Requirements, and Network and Certificate System Security Requirements.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">3. To perform such other activities that are ancillary to the primary activities listed above.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">OUT OF SCOPE:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The Server Certificate Working Group will not address certificates intended to be used primarily<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">for code signing, S/MIME, time-stamping, VoIP, IM, or Web services. The Server Certificate Working Group will<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">not address the issuance, or management of certificates by enterprises that operate their own Public Key<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Infrastructure for internal purposes only, and for which the Root Certificate is not distributed by any Application<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Software Supplier.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Anticipated End Date</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: None.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Initial chairs and contacts</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: Chair, Kirk Hall,
<a href="mailto:kirk.hall@entrustdatacard.com">kirk.hall@entrustdatacard.com</a>; Vice Chair, Ben Wilson,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="mailto:ben.wilson@digicert.com">ben.wilson@digicert.com</a>; terms to run concurrently with their terms as Chair and Vice Chair of the
Forum,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">respectively, unless otherwise voted upon by the Working Group.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Members eligible to participate</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: The Working Group shall consist of two classes
of voting members, the<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Certificate Issuers and the Certificate Consumers. The CA Class shall consist of eligible Certificate Issuers and<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Root Certificate Issuers meeting the following criteria:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(1) Certificate Issuer: The member organization operates a certification authority that has a current and<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">successful WebTrust for CAs audit, or ETSI TS 102042, ETSI 101456, or ETSI EN 319 411-1 audit report prepared<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">by a properly-qualified auditor, and that actively issues certificates to Web servers that are openly accessible<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">from the Internet, such certificates being treated as valid when using a browser created by a Certificate<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Consumer Member. Applicants that are not actively issuing certificates but otherwise meet membership criteria<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">may be granted Associate Member status under Bylaw Sec. 3.1 for a period of time to be designated by the<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Forum.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(2) Root Certificate Issuer: The member organization operates a certification authority that has a current<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">and successful WebTrust for CAs, or ETSI TS 102042, ETSI TS 101456, ETSI EN 319 411-1 audit report prepared by<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">a properly-qualified auditor, and that actively issues certificates to subordinate CAs that, in turn, actively issue<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">certificates to Web servers that are openly accessible from the Internet, such certificates being treated as valid<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">when using a browser created by a Certificate Consumer Member. Applicants that are not actively issuing<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">certificates but otherwise meet membership criteria may be granted Associate Member status under Bylaw Sec.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">3.1 for a period of time to be designated by the Forum.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(3) A Certificate Consumer can participate in this Working Group if it produces a software product intended<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">for use by the general public for browsing the Web securely.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The Working Group shall include Interested Parties and Associate Members as defined in the Bylaws.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Voting structure</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: In order for a ballot to be adopted by the Working Group,
two-thirds or more of the votes cast<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">by the Certificate Issuers must be in favor of the ballot and more than 50% of the votes cast by the Certificate<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Consumers must be in favor of the ballot. At least one member of each class must vote in favor of a ballot for it<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">to be adopted. Quorum is the average number of Member organizations (cumulative, regardless of Class) that<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">have participated in the previous three Server Certificate Working Group Meetings or Teleconferences (not<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">counting subcommittee meetings thereof). For transition purposes, if three meetings have not yet occurred,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">quorum is ten (10).<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Summary of the work that the WG plans to accomplish</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: As specified in Scope
section above.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Summary of major WG deliverables and guidelines</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: As specified in Scope section
above.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">Primary means of communication:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">listserv-based email, periodic calls, and face-to-face meetings.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:Calibri-Bold">IPR Policy</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: The CA/Browser Forum Intellectual Rights Policy, v. 1.3 or later,
SHALL apply to all Working Group<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">activity.<span style="color:#1F497D"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Wayne Thayer [<a href="mailto:wthayer@mozilla.com">mailto:wthayer@mozilla.com</a>]
<br>
<b>Sent:</b> Wednesday, June 27, 2018 10:32 AM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com">Kirk.Hall@entrustdatacard.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Membership Application of Sony<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">The part that I find unclear is how one becomes a member of the Server Certificate WG. The charter defines membership criteria but there doesn't appear to be a process for adding members at the WG level.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jun 27, 2018 at 10:21 AM Kirk Hall via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Summary based on quotes from my original email to the list:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Original Sony question</span></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: “Can you please
describe the bylaw requirement of “produces a software product, such as a browser, intended for use by the general public for relying upon certificates and is a member of a CWG”? If we produce a hardware product which includes software which relies upon (public
root) certificates, does that meet the definition of “produces a software product”?”</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Dean Coclin response</span></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: “Perhaps you
can help clarify by stating whether or not Sony makes the underlying software that runs in the hardware device made by Sony?”</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Sony response</span></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">: “Limiting the discussion
to televisions (the question at-hand), they’re based on Android TV then with Sony software on top. So, “does Sony make the software” is yes and no. But we *<b>do</b>* write the software that does the cryptographic signature validation.”</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Bylaws provide as follows:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(a) All Forum members must *** meet at least one of the following criteria: ***</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(<u>3) <b>Certificate Consumer</b>: The member organization produces a software product, such as a browser, intended for use by the general public for relying upon certificates</u> and is a member
of a CWG [Chartered Working Group, such as the new Server Certificate Working Group]<u>.</u></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Wednesday, June 27, 2018 10:13 AM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>>; CABFPub <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Subject:</b> Re: [cabfpub] [EXTERNAL]Re: Membership Application of Sony</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I'm having trouble finding a clear summary of the question from the message forwarded.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Could you helpfully re-state it?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It sounds like the question is "Can we join the Forum without joining a CWG" - but that may not be a correct understanding.
<o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>