<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 29, 2019 at 2:18 AM Dimitris Zacharopoulos <<a href="mailto:jimmy@it.auth.gr">jimmy@it.auth.gr</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<br>
<br>
<div class="gmail-m_-3729503571974744775moz-cite-prefix">On 28/1/2019 8:48 μ.μ., Ryan Sleevi via
Public wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail-m_-3729503571974744775gmail_attr">On Thu, Jan 24, 2019 at 2:30
PM Dimitris Zacharopoulos (HARICA) via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF"> <br>
<br>
<div class="gmail-m_-3729503571974744775gmail-m_7363109640286725785moz-cite-prefix">On
24/1/2019 8:16 μ.μ., Wayne Thayer via Public wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div>On today's call we discussed a number of
changes to the bylaws aimed at clarifying the
rules for membership. The proposal for section
2.1(a)(1) resulting from today's discussion is:</div>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Certificate
Issuer: The member organization operates a
certification authority that has a
publicly-available audit report or attestation
statement that meets the following requirements:<br>
* Is based on the full, current version of the
WebTrust for CAs, ETSI EN 319 411-1 , or ETSI EN
319 411-2 audit criteria<br>
</blockquote>
</div>
</div>
</blockquote>
</div>
</blockquote>
<div>Using the example reports for discussion ( <a href="http://www.webtrust.org/practitioner-qualifications/docs/item85808.pdf" target="_blank">http://www.webtrust.org/practitioner-qualifications/docs/item85808.pdf</a> )</div>
<div><br>
</div>
<div>If a CA does not escrow CA keys, does not provide
subscriber key generation services, or suspension services,
does that count as being based on the "full, current
version"? (Page 11, paragraph 2)</div>
</div>
</div>
</blockquote>
<br>
I think so, yes. Based on the exact CA operations, the exact audit
scope is determined. The Forum has set the WebTrust for CAs and ETSI
EN 319 411-1 as an absolute minimum that includes attestation of the
existence of reasonable organizational and technical controls. If
you recall, I had proposed that for the SCWG we should also require
WebTrust for CAs Baseline and NetSec because they are already
included in ETSI EN 319 411-1 and are more suitable for SSL/TLS
Certificates. If a CA obtains a WebTrust for CAs or ETSI EN 319
411-1 audit report, it means that the core CA services are there and
are operational.<br></div></blockquote><div><br></div><div>I don't believe this is a correct understanding. By highlighting that it's acceptable to carve out the scope, you're seemingly acknowledging that it's acceptable to take subsets of the audit criteria. For example, if I provided an audit for the physical security controls of my data center against the WebTrust for CAs criteria, is that sufficient for membership as a CA?</div><div><br></div><div>This isn't theoretical; at least one CA member provides such audits, as they use such a third-party datacenter. If the datacenter provided just their report, would they qualify? If they don't, then what is the property that we're trying to achieve, and why, so that we can do it?</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF">
Root programs have audit requirements exceptions and this applies
equally to Microsoft and Mozilla. I don't disagree to being more
inclusive but I believe the Forum must have objective and specific
requirements based on some international standards and not just
government regulations. <br></div></blockquote><div><br></div><div>Then by this goal, I don't believe our current membership criteria meet this. For example, a qualified auditor is determined by... government regulations in the case of ETSI. Does that mean we should exclude ETSI audits from the scope? Or should we allow CABs that are not accredited by the NABs?</div><div><br></div><div>I realize it may seem like I'm being difficult, but I think there's a core piece missing, which is trying to understand why it's important for some members to exclude some other CAs that have had long-standing operations. This is particularly relevant for the discussion of the S/MIME charter, in which there is significant and extant set of 'trusted' certificates, in a variety of software, that does not meet the criteria for participation. They would be excluded from participating in engaging or drafting the new criteria, by virtue of the Forum membership criteria, and I think that's something we should be thinking very carefully about and articulating what properties we expect of CAs and why.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF">
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> * Covers a
period of at least 60 days<br>
</blockquote>
</div>
</div>
</blockquote>
</div>
</blockquote>
<div>I'm curious for feedback from the ETSI folks, but perhaps
a more inclusive definition would be</div>
<div>- "Reports on the operational effectiveness of controls
for a historic period of at least 60 days"</div>
<div><br>
</div>
<div>The context being that ETSI is a certification scheme,
but as part of that certification, the CAB "may" ("should")
examine the historic evidence for some period of time. 7.9
of 319 403 only requires "since the previous audit"</div>
</div>
</div>
</blockquote>
<br>
I am not representing ETSI or ACAB'c but if there are concerns with
this requirement we can solve this issue using the language proposed
by Wayne "Covers a period of at least 60 days". I would use "Covers
a period of operations of at least 60 days".<br></div></blockquote><div><br></div><div>I'm not sure what this is a response to. I was pointing out the issues with the language proposed by Wayne and why it's insufficient, so it's not clear to me how you've resolved that.</div><div><br></div></div></div>