<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Georgia",serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:423839432;
mso-list-type:hybrid;
mso-list-template-ids:951613656 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Georgia",serif">Published!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia",serif"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:black">-- <br>
Jos Purvis (</span><a href="mailto:jopurvis@cisco.com"><span style="font-size:9.0pt;font-family:Consolas;color:#954F72">jopurvis@cisco.com</span></a><span style="font-size:9.0pt;font-family:Consolas;color:black">)<br>
.:|:.:|:. cisco systems | Cryptographic Services<br>
PGP: 0xFD802FEE07D19105 | Controls and Trust Verification</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-family:"Georgia",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia",serif"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Public <public-bounces@cabforum.org> on behalf of CA/B Forum Public List <public@cabforum.org><br>
<b>Reply-To: </b>Dean Coclin <dean.coclin@digicert.com>, CA/B Forum Public List <public@cabforum.org><br>
<b>Date: </b>Thursday, February 18, 2021 at 4:27 PM<br>
<b>To: </b>CA/B Forum Public List <public@cabforum.org><br>
<b>Subject: </b>[cabfpub] Final minutes of CA/B Forum call February 4, 2021<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><b>Here are the final minutes of the subject call:</b><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Roll Call: Ali Gholami (Telia), Andrea Holland (SecureTrust), Arno Fiedler (D-TRUST), Ben Wilson (Digicert), Bruce Morton (Entrust), Chris Kemmerer (SSL.com), Chris McMillan (Visa),
Clint Wilson (Apple), Corey Bonnell (DigiCert), Daniela Hood (GoDaddy), David Kluge (Google), Dean Coclin (Digicert), Dimitris Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback (Microsoft), Enrico Entschew (D-TRUST), Eusebio Herrera (AC
Camerfirma), Hazhar Ismail (MSC Trustgate), Inaba Atsushi (GlobalSign), Jeff Ward (CPA Canada/WebTrust), Jim Gorz (GoDaddy), Johnny Reading (GoDaddy), Jos Purvis (Cisco Systems), Juan-Angel Martin (AC Camerfirma SA), Karina Sirota (Microsoft), Mads Henriksveen
(Buypass AS), Michelle Coon (OATI), Mike Reilly (Microsoft), Neil Dunbar (TrustCor Systems), Niko Carpenter (SecureTrust), Noorul Halimin Mansol (PoS Digicert), Patrick Nohe (GlobalSign), Paul van Brouwershaven (Entrust), Pedro Fuentes (OISTE Foundation),
Peter Miskovic (Disig), Rebecca Kelley (Apple), Ryan Sleevi (Google), Sebastian Schulz (GlobalSign), Shelley Brewer (Digicert), Stephen Davidson (Digicert), Tadahiko Ito (SECOM Trust Systems), Tim Callan (Sectigo), Tobias Josefowitz (Opera Software AS), Wendy
Brown (US Federal PKI Management Authority)<o:p></o:p></li></ol>
<p class="MsoListParagraph"> <o:p></o:p></p>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Antitrust Statement read by Dean<o:p></o:p></li></ol>
<p class="MsoListParagraph"> <o:p></o:p></p>
<ol style="margin-top:0in" start="3" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Agenda: The agenda was reviewed<o:p></o:p></li></ol>
<p class="MsoListParagraph"> <o:p></o:p></p>
<ol style="margin-top:0in" start="4" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Approval of prior minutes: The minutes of January 21<sup>st</sup> were approved.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="5" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Forum Infrastructure Update: Jos Purvis gave the update from the last subcommittee meeting. (1) There was a discussion of updates under github. If someone wants experience using github,
they can create their own repository and everything will be copied to their account so they can experiment. (2) There was discussion of a bot account which would send periodic summaries of discussions on github, since members are not seeing these discussions
on the list now. The bot would collect the discussions and send to the SCWG email list. (3) Sending updates from tools: Github could send out red lines and updates saving the Chair from doing so, automatically. (4) Creation of redlines are difficult with tables.
This will get easier with passage of SC40. (5) The wiki SCWG page will have links to master versions of artifacts. If someone needs a copy of the word version, they can get it there. (6) A mind map of the website will be generated for folks to review. (7)
Table formatting for BRs. Suggestion to release versions in separate sections for better rendering or balloting. (8) Future things to look at: how to push items to the public website.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="6" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Code Signing Update: Dean gave the update. Ballot CSCWG-7 was approved and is in IPR review. A suggestion to put high risk requests in the same category for all requests was made by
Ian of Microsoft. CAs should check their internal database for prior requests from the customer. If there was a denial before, refer to section 11.7 for how to deal with it. If a key compromise had occurred, step them up to an HSM. Further discussion on using
a 3<sup>rd</sup> party service to host data related to breaches. Another topic was using CAA to potentially check to see if CA is authorized to issue for the company. There was also a discussion on private key protection and the standards related to this.
Further discussion on the next call. Ryan asked if the CSCWG planned to use markdowns in the future. Dean said he will bring this up on the next call.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="7" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">S/MIME Working group update: Stephen Davidson gave the update. A new member has joined the working group from Austria: RundQuadrat, which manufactures email software for mobile devices.
The group is focusing on two types of S/MIME certs: (1) multipurpose for legacy purposes and (2) Strict S/MIME only. They are looking at specific cert profiles under these categories.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="8" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">2021 F2F meeting schedule: Looking for guest speakers for March meeting. Suggestions for topics, speakers sought. June will also be virtual. Beyond that is TBD.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="9" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Other Business - Membership Applications: Discussion about the application received from AT&T for Interested Party membership. Concern among members that someone with the authority
to bind AT&T to the IPR did not sign the agreement nor have the proper authority to do so. Members wanted to be sure the IP obligations are binding. Dean will draft a response for member review before sending to AT&T.<o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="10" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Next call February 18<sup>th</sup><o:p></o:p></li></ol>
<p class="MsoNormal"> <o:p></o:p></p>
<ol style="margin-top:0in" start="11" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Adjourn<o:p></o:p></li></ol>
<p class="MsoListParagraph"> <o:p></o:p></p>
<p class="MsoListParagraph"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif;color:#0174C3">Dean Coclin</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif;color:#0174C3">CA/B Forum Chair</span></b><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>