<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Ryan, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Let me see if I can describe the change a different way to see if that helps. This change is intended to clarify by adding more specific language about the requirements and remove words that have inconsistent definitions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ll start with the definitions for “Secure Zone” and “High Security Zone”.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Secure Zone: An area (physical or logical) protected by physical and logical controls that appropriately protect the confidentiality, integrity, and availability of Certificate Systems.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">High Security Zone: A physical location where a CA’s or Delegated Third Party’s Private Key or cryptographic hardware is located.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I say “inconsistent” I’m referring to the fact that “secure zone” describes a requirement that certificate systems need to be physically and logically protected. Whereas, “High Security Zone” is the location of cryptographic hardware
and doesn’t include requirements about protecting it. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">One path would be to change the definitions. However, instead we’ve elected to go the route of eliminating those terms and defining inline the expectations with more specific language everywhere those terms are used. So the intent with
this change is not to change requirements, but to make it clear what each statement is trying to accomplish.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ll use 1.c as a different example. “Maintain Root CA Systems in a High Security Zone and in an offline state or air‐gapped from all other networks;”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Given that a “High Security Zone” is actually just a location where the cryptographic hardware is located this requirement could be rewritten without modifying the requirements to say “Maintain Root CA Systems in a physical location where
a CA’s or Delegated Third Party’s Private Key or cryptographic hardware is located and in an offline state or air‐gapped from all other networks;”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I don’t think that’s the intent of 1.c. I think the intent of 1.c is to say that Root CA systems should be in a physically secured environment and in an offline state or air‐gapped from all other networks.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So for Ben’s question regarding 1.e we are trying to determine if the language changes the requirements and if it does what is missing.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The consensus in the NetSec meeting was that the intent of 1.e is to specify that there should be a boundary between. Certificate Systems and non‐Certificate Systems that prohibits or limits communications as applicable per system type.
That offline certificate systems, online certificate systems, and non-certificate systems shouldn’t be able transmit data between the boundaries in an unauthorized/unintended manner. However, we wanted to verify if this is the generally accepted interpretation
or if there is something we are missing.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think if you read that language as changing the requirements that’s a good sign something is missing. The question is what is missing that was in there when the zones were included that isn’t now?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Trev<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Servercert-wg <servercert-wg-bounces@cabforum.org>
<b>On Behalf Of </b>Ryan Sleevi via Servercert-wg<br>
<b>Sent:</b> Tuesday, September 14, 2021 14:07<br>
<b>To:</b> Ben Wilson <bwilson@mozilla.com>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Subject:</b> RE: [EXTERNAL] [Servercert-wg] "Zones" Language in the NetSec Requirements<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr style="height:15.25pt">
<td width="1123" valign="top" style="width:842.35pt;border:solid #ED7D31 1.5pt;padding:0in 5.4pt 0in 5.4pt;height:15.25pt">
<p><strong><span style="font-family:"Calibri",sans-serif;background:#FFFF99">CAUTION</span></strong><span style="background:#FFFF99">: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the
sender and know the content is safe.</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Ben, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you share the risk analysis the NetSec Subcommitee is using to inform this suggestion? I feel like we've gone in circles on this point, and run the risk of continuing to do so, but it seems that we can best make progress here by having
a better understanding, and seeing if there is consensus in, "these are the things that we're worried about preventing, and these are the things prevented that we think should be allowed"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The change of definition in such a core concept obviously has profound security impact - potentially hugely positively, or potentially hugely negative. I'm assuming that such an analysis has already been done, and was hoping you could share
that result.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Sep 14, 2021 at 4:55 PM Ben Wilson via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">All,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Today in the NetSec subgroup we discussed use of the term "zone" in the NCSSRs. Previous efforts on this topic have included an abandoned Ballot SC32 (see e.g.
<a href="https://lists.cabforum.org/pipermail/servercert-wg/2020-June/002033.html" target="_blank">
https://lists.cabforum.org/pipermail/servercert-wg/2020-June/002033.html</a>), and other drafts in which we have explored the differentiation between logical security and physical security.
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">The NetSec subgroup is again working on the "zones" language and efforts to delineate the two concepts (logical and physical), but first we want to see where we might have disagreement,
gaps in understanding, or lack of clarity on the issues and concerns. Thus, the NetSec subgroup is considering proposing the following as a replacement to section 1.e of the NCSSRs -
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">"Implement and configure Security Support Systems that protect communications between Certificate Systems and non</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Certificate
Systems (i.e. public<span style="letter-spacing:-.25pt"> </span>networks and organizational business units that do not provide PKI</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">related
services);"</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:8.0pt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">For additional reference, the definition of “Security Support System” would be slightly amended to read, “A system used to provide physical or logical
security support functions, which MAY include authentication, network boundary control, audit logging, audit log reduction and analysis, vulnerability scanning, and intrusion detection (physical intrusion detection, Host</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">based
intrusion detection, or Network</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">based intrusion detection).”
</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">And, for comparison, the current language in section 1.e is, "Implement and configure Security Support Systems that protect systems and communications between systems inside
Secure Zones and High Security Zones, and communications with non</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Certificate Systems outside those zones (including
those with organizational business units that do not provide PKI</span><span style="font-size:10.0pt;font-family:"Cambria Math",serif">‐</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">related services) and those on public networks;".</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">With your input, we can move forward with looking at other places in the NCSSRs where logical and physical security are not distinguished and where the term "zone" is used.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Thanks in advance.
</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Ben</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:11.5pt;margin-bottom:8.0pt;margin-left:0in">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:11.5pt;margin-bottom:8.0pt;margin-left:0in">
<o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>