<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> I don’t think the creation of another WG would be justified or useful</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Practically, that may well be the case, but I think it's right to arrive at that conclusion by going through this thought process rather than circumventing it.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> I don’t see an issue with the CS WG defining requirements for timestamping as long as it’s very clear that this is ONLY for timestamping used with CodeSigning certificates so that is no violation of the scope of the WG.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Policing "ONLY for timestamping used with CodeSigning certificates" seems like it would be hard. <span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">A timestamping server has no idea whether it's being asked
to timestamp signed code or some other "datum" (to quote RFC3161).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Sectigo's publicly-trusted RFC3161 timestamping service (and the timestamping certificates that it uses) is expected to be used in conjunction with both Code Signing and Document Signing.</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Public <public-bounces@cabforum.org> on behalf of Sebastian Schulz via Public <public@cabforum.org><br>
<b>Sent:</b> 29 April 2021 11:03<br>
<b>To:</b> public@cabforum.org <public@cabforum.org><br>
<b>Subject:</b> Re: [cabfpub] [Cscwg-public] [EXTERNAL] Re: Code signing and Time stamping</font>
<div> </div>
</div>
<div lang="EN-GB" style="word-wrap:break-word">
<p></p>
<div style="background-color:#FAFA03; width:100%; border-style:solid; border-color:#000000; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:000000">CAUTION:</span> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<p></p>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="">I can’t think of anything else except proprietary systems that use timestamping in for example Supply Chain Management and rely on CA issued timestamps due to the complexity of Enterprises building on-premise TSAs.<br>
<br>
When it comes to Adobe, they also trust other, non-qualified timestamps:</span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style=""> </span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<i><span style="">“</span>When a Time Stamping Authority is imposed or recommended to the signers by the Member, it must follow state of the art security policies and provide proper timestamps. The time-stamping practices and policies must be provided to Adobe
and Adobe reserve the right to not accept the Time Stamping Authority.”</i><i><span style="">
</span></i><span style="">From AATL TR v2.0 EE3</span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style=""> </span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="">I’m not generally opposed, but all in all I don’t think the creation of another WG would be justified or useful, other major use cases of timestamping have their major stakeholders outside the CA/B Forum. I don’t see an issue with the CS WG
defining requirements for timestamping as long as it’s very clear that this is ONLY for timestamping used with CodeSigning certificates so that is no violation of the scope of the WG. But I can see how opinions differ. Maybe an item to discuss on the next
F2F?</span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style=""> </span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="">Best,</span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="">Seb</span></p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style=""> </span></p>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span lang="EN-US" style="font-family:"Arial",sans-serif; color:#666666">Sebastian Schulz</span></b><span lang="EN-US" style="color:#1F497D"><br>
</span><i><span style="font-family:"Arial",sans-serif; color:#666666">Product Manager Client Certificates</span></i><span lang="EN-US" style=""></span></p>
</div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style=""> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span lang="EN-US">From:</span></b><span lang="EN-US"> Public <public-bounces@cabforum.org>
<b>On Behalf Of </b>Adriano Santoni via Public<br>
<b>Sent:</b> 29 April 2021 11:42<br>
<b>To:</b> public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] [Cscwg-public] [EXTERNAL] Re: Code signing and Time stamping</span></p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Well, considering that Adobe is not currently a CABF member, I see no context wherein time stamping plays a role, other than code signing.<br>
<br>
Adobe already trusts qualified time stamping providers (according to EU regulations) based on the EU trust lists, in the context of Document Signing, and I am not aware that they may want to also trust time stamps based on different criteria.</p>
<p> </p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
In theory, time stamping could be used to extend the validity of an S/MIME signature beyond the signing certificate's expiration, but there is no S/MIME client supporting this, and no plans to support it in the future, so this is just theory. After all, S/MIME
signatures are not meant for the long-term.</p>
<p> </p>
<p>Is there any other context that I am overlooking?</p>
<p> </p>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:12.0pt">
Adriano</p>
<p> </p>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Il 29/04/2021 11:07, Rob Stradling via Public ha scritto:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">Could it be argued, at least conceptually, that there should be a separate CABForum working group dedicated entirely to Time Stamping? After all, the Code Signing ecosystem doesn't have a monopoly on Time Stamping.
For example, Adobe software uses Time Stamping in the context of Document Signing. If Adobe wanted to collaborate with CABForum members on Time Stamping certificate profiles, what (assuming Adobe had no interest in Code Signing) would be the best venue for
that?</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">(Please note: I'm not advocating any position here; I'm just thinking aloud).</span></p>
</div>
<div>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div class="x_MsoNormal" align="center" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span style="color:black">From:</span></b><span style="color:black"> Cscwg-public
<a href="mailto:cscwg-public-bounces@cabforum.org"><cscwg-public-bounces@cabforum.org></a> on behalf of Bruce Morton via Cscwg-public
<a href="mailto:cscwg-public@cabforum.org"><cscwg-public@cabforum.org></a><br>
<b>Sent:</b> 26 April 2021 14:18<br>
<b>To:</b> Ben Wilson <a href="mailto:bwilson@mozilla.com"><bwilson@mozilla.com></a>;
<a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a> <a href="mailto:cscwg-public@cabforum.org">
<cscwg-public@cabforum.org></a>; Dean Coclin <a href="mailto:dean.coclin@digicert.com">
<dean.coclin@digicert.com></a>; CA/Browser Forum Public Discussion List <a href="mailto:public@cabforum.org">
<public@cabforum.org></a><br>
<b>Subject:</b> Re: [Cscwg-public] [EXTERNAL] Re: [cabfpub] Code signing and Time stamping</span>
</p>
<div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
</div>
<div>
<div style="border:solid black 1.0pt; padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;line-height:12.0pt; background:#FAFA03">
<span lang="EN-US" style="font-size:10.0pt; color:black">CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</span></p>
</div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">To follow up, the CSCWG charter includes the following documents:</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">a. EV Code Signing Guidelines, v. 1.4 and subsequent versions</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">b. Version 1.0 Draft of November 19, 2015, Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates (subject to the CSCWG making a written finding that the provenance of such document is sufficiently
covered by the Forum’s IPR Policy)</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">The documents define requirements or reference: timestamp authority (TSA), timestamps, timestamp implementation method, timestamp certificate, timestamp signed objects, TSA logging, and timestamp key protection. The documents also define
the certificate profiles for timestamp root, timestamp subordinate CA and timestamp authority. As such, the CSCWG has considered it is in scope to manage these documents and the requirements associated to allow timestamp signatures with code signed using certificates
conforming to the CSBRs.</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">The CSBRs also state, “CAs complying with these Requirements MAY also assert the reserved policy OIDs in such Certificates.” The reserved policy OIDs reference those required for Non-EV and EV code signing certificates. The CSBRs do not reference
an OID for a timestamp certificate, since the OID has not been reserved. It is also considered appropriate to use all applicable reserved certificate policy OIDs as we consider deploying dedicated PKI hierarchies to support code signing.</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">As such, the CSCWG plans to add the following reserved certificate policy OID to the CSBRs, which may be included in a timestamp certificate, which meets the requirements of the CSBRs:</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">{joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) certificate-policies(1) code-signing-requirements(4) timestamping(2)} (2.23.140.1.4.2)</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Bruce.</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span lang="EN-US">From:</span></b><span lang="EN-US"> Cscwg-public <a href="mailto:cscwg-public-bounces@cabforum.org">
<cscwg-public-bounces@cabforum.org></a> <b>On Behalf Of </b>Ben Wilson via Cscwg-public<br>
<b>Sent:</b> Tuesday, April 20, 2021 12:09 PM<br>
<b>To:</b> Dean Coclin <a href="mailto:dean.coclin@digicert.com"><dean.coclin@digicert.com></a>; CA/Browser Forum Public Discussion List
<a href="mailto:public@cabforum.org"><public@cabforum.org></a><br>
<b>Cc:</b> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br>
<b>Subject:</b> [EXTERNAL] Re: [Cscwg-public] [cabfpub] Code signing and Time stamping</span></p>
</div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.</span></p>
<div class="x_MsoNormal" align="center" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;text-align:center">
<span lang="EN-US">
<hr size="1" width="100%" align="center">
</span></div>
<div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Just a few thoughts to move this conversation forward, and speaking as a CSCWG interested party and not to advocate any position of Mozilla, I think the answer depends on how strict or flexible the CABF wants to be as an organization when
it comes to interpreting the scope of a working group charter.</span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">It seems that the mention of time stamping in a code signing work product would be allowed even under a strict interpretation. While creating standards for issuing and managing time stamping certificates would certainly be out of scope with
a flexible interpretation. </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">The Scope in the Charter does not expressly include or exclude the assignment of a time stamping OID for time stamping certificates.</span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fcabforum.org%2F2019%2F03%2F26%2Fcode-signing-certificate-wg-charter%2F*1-Scope__%3BIw!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-Y764wXA%24&data=04%7C01%7C%7Ca7396462b9ad4cd10f7208d90af6103c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637552874949904702%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=PeQ3RYZXt1hNa2Fr9Bq%2BwIVsHyBF4sxhod45HyacgHs%3D&reserved=0" originalsrc="https://urldefense.com/v3/__https:/cabforum.org/2019/03/26/code-signing-certificate-wg-charter/*1-Scope__;Iw!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-Y764wXA$" shash="ihb0b+QoUcSgYgSSdMOHRLrKyt9JDLIsSBo2F1Ak+TFrlTX49sOjmr5Dsmz9K2x8STPq078Kbmrv6M7C8sV9bqU67NkVkivGAip6nYHI4CFiJJpEpt6Zbu/yDduT1S+iO4f9BFiyUvVDyH1wXjQci14pZjuLW4Fq+j7QwzlJJRE=" target="_blank">https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/#1-Scope</a></span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Included in the scope is "Version 1.0 Draft of November 19, 2015, Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates (subject to the CSCWG making a written finding that the provenance of such
document is sufficiently covered by the Forum’s IPR Policy)." Time stamping was discussed in that draft, and I recall that the CSCWG did make the required written finding of provenance. Is the assignment of a timestamping OID a logical outcome of the continued
work on that earlier document?</span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Ben</span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
</div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">On Mon, Apr 19, 2021 at 2:31 PM Dean Coclin via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:</span></p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-top:5.0pt; margin-right:0cm; margin-bottom:5.0pt">
<div>
<div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">A discussion on last week’s CA/B call about code signing and time stamping brought up a question as to whether the latter was in scope of the CSCWG charter (<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fcabforum.org%2F2019%2F03%2F26%2Fcode-signing-certificate-wg-charter%2F__%3B!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-wNVdJJQ%24&data=04%7C01%7C%7Ca7396462b9ad4cd10f7208d90af6103c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637552874949904702%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=D5G3OLO8w84JNAaLISyc%2BdbI8GRmTSLLkcVXiqJ7Dlo%3D&reserved=0" originalsrc="https://urldefense.com/v3/__https:/cabforum.org/2019/03/26/code-signing-certificate-wg-charter/__;!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-wNVdJJQ$" shash="lBD8sVV/0TaHBj8D9QXXn1/vvIiJVtfw+6gAXIMp8QsKJtrngnq8L5wzXl/7q44nuvDkauzkvI+4c3u18Xgitmd20SSLLvkNaZ69+hlpUjavqo1CQo2Fy5LcWsbPxG+M6L5JnzS4N76HYfxfHsaXUtn4CyiiVpQNy8GwApI1B0Q=" target="_blank">https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/</a>).
</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Bruce said there was no CP OID for time stamping and that the group wanted to create one IAW with the CA/B Forum registry. Ryan was concerned that this was outside the CSCWG charter as it was not specifically mentioned therein. Dimitris commented
that it was included in charter scope 1a which pulls in the EV CS guidelines where time stamping is specified. Ryan did not seem convinced and asked that the discussion continue on the list.
</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">The working group has not had a chance to discuss this since the Forum meeting but plans to do so on the next call.
</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">I’ve included the CS Public list on this thread since the topic is of interest to members/observers there. If a respondent does not have posting rights, I can re-post for them.</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">Dean</span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US"> </span></p>
</div>
</div>
<p class="x_xmsonormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fpublic__%3B!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-PBR_9ZU%24&data=04%7C01%7C%7Ca7396462b9ad4cd10f7208d90af6103c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637552874949914659%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=WllIo1JymCLi5P%2FRpbnKITAcsGiiaYUuS4S%2BohhH4Dw%3D&reserved=0" originalsrc="https://urldefense.com/v3/__https:/lists.cabforum.org/mailman/listinfo/public__;!!FJ-Y8qCqXTj2!KO_2DRjCLlG3XphTaFOKt3DIbyewuzdXb3w04DZftMjNQ74YZEHuLmO13bB-PBR_9ZU$" shash="qzAc+HnQQJyZxa5AxiY7sm+I+uXxcUaNGaQXCEBBnNo21YT8OY9+I+syyMsK8xE28R6v8jDvdQxUGbbrqey0xYodgxE9wQliyakwYrY9CpJLfifT8Ea0KEuRw9je0DhQWRCCh2n7cTqL8kGJFED8uNzdeIFNzwpR3JrMW+GYZ9g=" target="_blank">https://lists.cabforum.org/mailman/listinfo/public</a></span></p>
</blockquote>
</div>
</div>
</div>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
<br>
</p>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";">_______________________________________________</pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";">Public mailing list</pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";"><a href="mailto:Public@cabforum.org">Public@cabforum.org</a></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";"><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fpublic&data=04%7C01%7C%7Ca7396462b9ad4cd10f7208d90af6103c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637552874949914659%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=iGPrVmi56%2BLDj2lcVpxIx3198EfxV66PuQeujATQBAs%3D&reserved=0" originalsrc="https://lists.cabforum.org/mailman/listinfo/public" shash="xSSAVeHwK+nin41nCeFztz1Vs1fbVyXwUAFglUXzp1eNjI6CzQcVhEpMrO0Jep9ym5z6zgnpV8qYHtb1dVpBft2560bOT+vibnA+SxhmcLegipyVfC07iAi/HSJiSUwTaItZL/rPg2Z3Upd1U2CJdlO8gXIbdQ6T7N6UnltLUmA=">https://lists.cabforum.org/mailman/listinfo/public</a></pre>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>