<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
color:black;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><h2>Minutes of SMCWG<o:p></o:p></h2><p class=MsoNormal><span style='color:windowtext'>November 25, 2020<o:p></o:p></span></p><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:windowtext'>These are the Approved Minutes of the Teleconference described in the subject of this message. <o:p></o:p></span></p><h3>Attendees <o:p></o:p></h3><p class=MsoNormal><span style='color:windowtext'>Adrian Mueller (SwissSign), Ahmad Syafiq Md Zaini (MSC Trustgate.com), Ali Gholami (Telia Company), Andreas Henschel (D-TRUST), Atsushi Inaba (GlobalSign), Ben Wilson (Mozilla), Burkhard Wiegel (Zertificon), Chris Kemmerer (SSL.com), Corey Bonnell (DigiCert), David Kluge (Google), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Don Sheehy (WebTrust), Doug Beattie (GlobalSign), Enrico Entschew (D-TRUST), Hazhar Ismail (MSC Trustgate.com), Hongquan Yin (Microsoft), India Donald (Federal PKI), James Knapp (Federal PKI), Janet Hines (SecureTrust), Li-Chun Chen (Chunghwa Telecom), Mads Henriksveen (BuyPass), Matthias Wiedenhorst (ACAB'c), Nazmi Abd Hadi (MSC Trustgate.com), Neil Dunbar (TrustCor), Patrycja Tulinska (PSW), Pedro Fuentes (OISTE), Russ Housley (Vigil Security), Stephen Davidson (DigiCert), Tadahiko Ito (SECOM Trust Systems), Thomas Connelly (Federal PKI), Tim Crawford (WebTrust), Tim Hollebeek (DigiCert), Tsung-Min Kuo (Chunghwa Telecom), Wendy Brown (Federal PKI)<o:p></o:p></span></p><h3>1. Roll Call<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The Roll Call was taken.<o:p></o:p></p><h3>2. Read Antitrust Statement<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The Antitrust/Compliance Statement was read.<o:p></o:p></p><h3>3. Review Agenda<o:p></o:p></h3><p class=MsoNormal>The Chair proposed deferring the discussion of new membership, and adding a new agenda item relating to certificate policy OIDs.<o:p></o:p></p><h3>4. Approval of minutes from last teleconference<o:p></o:p></h3><p class=MsoNormal>The minutes of the November 11 teleconference were approved. <o:p></o:p></p><h3>5. Discussion of certificate profile<o:p></o:p></h3><p class=MsoNormal>Stephen shared a preview of the S/MIME Baseline Requirements section 7 in markdown format, currently in a private GitHub Repository. The draft uses the table format agreed upon in earlier meetings. With the help of the Infrastructure WG, the plan is to move towards using the cabf-smcwg-br repository in early 2021 including for commenting and tracking of issues.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In part based upon Doug<span style='color:windowtext'> Beattie</span>’s comment on the public list, a discussion was held on certificate-policy OIDs. The OID arc 2.23.140.1.5 has been reserved for the S/MIME Baseline Requirements (SBR). The proposal is to adopt familiar validation levels (DV, OV, IV) as found in TLS – with an additional level for personal certs that include organizational details. Dimitris <span style='color:windowtext'>Zacharopoulos </span>suggested this should be linked to OV; Corey <span style='color:windowtext'>Bonnell </span>subsequently suggested the term “Sponsored Validation” (SV) to describe this level.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>{joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) certificate-policies(1) smime-baseline(5) domain-validation (1)} (2.23.140.1.5.1)<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>{joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) certificate-policies(1) smime-baseline(5) organization-validation (<span style='color:windowtext'>2</span>)} (2.23.140.1.5.2)<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>{joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) certificate-policies(1) smime-baseline(5) sponsored-validation (<span style='color:windowtext'>3</span>)} (2.23.140.1.5.3)<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>{joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) certificate-policies(1) smime-baseline(5) individual-validation (<span style='color:windowtext'>4</span>)} (2.23.140.1.5.4)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If required, extensions may be defined under the CABF certificate-extensions arc 2.23.140.2. Examples might include identifiers for keys generated or stored on cryptotokens etc.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Stephen <span style='color:windowtext'>Davidson </span>proposed that certain Subject attributes be restricted, mandatory or optional depending on the certificate policy. Tim <span style='color:windowtext'>Hollebeek </span>suggested that initial versions of the standard should be inclusive of common Issuer practice. Wendy<span style='color:windowtext'> Brown</span> indicated that the L and S fields might be considered optional except if required to disambiguate the Subject. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>A discussion was held regarding the Subject attributes described in RFC 3739 Section 3.1.2:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>domainComponent<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>countryName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>commonName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>surname<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>givenName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>pseudonym<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>serialNumber<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>title<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>organizationName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>organizationalUnitName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>stateOrProvinceName<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>localityName<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>A particular focus involved attributes such as title and in particular pseudonym, which may be beyond the ability of the CA to verify. It was agreed that some might make sense in a “Sponsored Validation” context. It was indicated that pseudonym may reasonably be used for profile names or English adopted names for international names.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It was agreed that at this stage we will focus on which fields might be allowed for the various certificate-policy levels – knowing that we must return to the required verification steps later in the process.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Certificate Issuers were requested to identify if they used Subject attributes not identified here. Wendy <span style='color:windowtext'>Brown </span>mentioned the use of dnQualifier to disambiguate Subjects, and indicated the range of uses of the CommonName field, such as “Stephen Davidson (contractor)”. Dimitris <span style='color:windowtext'>Zacharopoulos </span>raised the use of the organizationIdentifier attribute in OV certificates.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It was pointed out that the Subject email field was deprecated albeit still in common use. A discussion began regarding rfc822name and the extent to which the SBR should seek to define an email address. Lacking time, the remaining agenda items were deferred to a future meeting.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><h3 style='mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in'>6. Any Other Business<o:p></o:p></h3><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It was agreed that the December 23, 2020 meeting would be cancelled.<o:p></o:p></p><h3>7. Next call<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The next call will take place on December 9, 2020 at 11:00am Eastern Time. <o:p></o:p></p><h3><span lang=DE>Adjourned</span><o:p></o:p></h3><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p></div></body></html>