<div dir="ltr">no - I am suggesting in both cases these configurations are for offline CAs but seem to contradict the first clause of the proposed definition: <span style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:16px;white-space:pre-wrap">A system that is (a) physically and logically separated from all other CA systems</span><div>1) an OFFLINE & Air-gapped CA that uses a network HSM - BOTH the CA server & the HSM are only connected to each other and both powered off, except when needed to be powered on to do some function like sign or revoke a cert or issue a CRL</div><div>or </div><div>2) again hardware dedicated only to the operation of OFFLINE & Air-gapped CAs, but potentially hosting multiple offline/Air-gapped CAs on the same hardware, operated by the same trusted roles - not co-mingling with anything considered online or connected to any supporting systems that have to be online<br clear="all"><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p><span style="font-family:"Segoe Script",sans-serif">Wendy</span></p>
<p><span style="font-size:12.8px">Wendy Brown<br></span><span style="font-size:12.8px">Supporting GSA FPKI<br></span><span style="font-size:12.8px">Protiviti Government
Services</span></p>
<p> 703-965-2990 (cell)</p>
<p><a href="mailto:wendy.brown@gsa.gov" style="font-size:12.8px" target="_blank">wendy.brown@gsa.gov</a><br><a href="mailto:wendy.brown@protiviti.com" style="font-family:Calibri,sans-serif" target="_blank">wendy.brown@protiviti.com</a></p></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 8, 2021 at 12:19 PM Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 8, 2021 at 9:07 AM Wendy Brown - QT3LB-C via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I'm not sure I agree with the first clause of the definition: <span style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:16px;white-space:pre-wrap">A system that is (a) physically and logically separated from all other CA systems</span></div><div><font face="Times New Roman" color="#000000"><span style="font-size:16px;white-space:pre-wrap">f</span></font>or 2 reasons: </div><div>1) if the CA uses an HSM server, it should be able to be connected to the HSM when turned on as long as the HSM is powered off when the CA is and not connected to any other systems</div></div></blockquote><div><br></div><div>When would this scenario be used? It seems somewhat dangerous - for example, if the CA system is considered online, but the HSM considered offline (even though physically connected, simply powered off), it seems like there's new threat models to consider (e.g. if the CA system can send a WoL packet to wake up the HSM system). So I'm trying to understand a bit more about what scenario this would be useful for, since it sounds like there's concern that the proposed language would prevent that scenario, to figure out how to resolve that.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>2) Why would it not be reasonable to have the same hardware host VMs for multiple offline CAs all operated by the same trusted roles? Or some CA software can support multiple CAs (such as Red Hat, Unicert, and PrimeKey/EJBCA). Multiple CAs running on the same platform, that is offline, should be considered offline, even though they are not physically separate from each other.</div></div></blockquote><div><br></div><div>I'm not sure I understand this second point. Are you suggesting that a CA running on such a system could have one CA configuration offline, and another CA configuration online? Or one CA configuration that is considered airgapped running on the same machine/software as another CA configuration that is not?</div><div><br></div><div>Neither of those sound like good things to me, and I don't think it'd be what you'd be suggesting. I *think* in such scenarios we want the same outcome: namely, if you bring such a system online (whether a device with multiple VMs or a server instance with multiple CAs), the point at which <b>one</b> is online should be considered the point in which <b>all</b> are online, and the same obligations occur regarding configuration state expectations. Is that a correct understanding?</div></div></div>
</blockquote></div>