<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I agree with Doug’s direction. We currently require the Enterprise RA to provide the CN and associated email address (based on a verified domain name) for each “enterprise” S/MIME certificate subject.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Bruce.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Doug Beattie via Smcwg-public<br>
<b>Sent:</b> Monday, February 28, 2022 11:41 AM<br>
<b>To:</b> SMIME Certificate Working Group <smcwg-public@cabforum.org>; Stephen Davidson <Stephen.Davidson@digicert.com><br>
<b>Subject:</b> [EXTERNAL] [Smcwg-public] Individual's names in S/MIME certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">Hi Stephen,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been out of the loop a bit on the lates status and some staffing changes have happened in the meantime so I didn’t release the level of auditing needed for individual names for the Sponsor validated method.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Reading the current spec, there is no way that the enterprise RA can provide an individual’s name without it being validated as their full legal name and audited by the CA.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 7.1.4.2.2 which says the CN must contain:<o:p></o:p></p>
<p class="MsoNormal"><code><span style="font-size:10.0pt">(subject:givenName</span></code> and/or
<code><span style="font-size:10.0pt">subject:surname) or </span></code> <code><span style="font-size:10.0pt">subject:pseudonym</span></code>, or
<code><span style="font-size:10.0pt">subject:email</span></code><span style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">By the way, I think you need to add the parentheses like above because this is not clear:<o:p></o:p></p>
<p class="MsoNormal"><code><span style="font-size:10.0pt"> subject:givenName</span></code> and/or
<code><span style="font-size:10.0pt">subject:surname</span></code>, <code><span style="font-size:10.0pt">subject:pseudonym</span></code>, or
<code><span style="font-size:10.0pt">subject:email<o:p></o:p></span></code></p>
<p class="MsoNormal"><code><span style="font-size:10.0pt"><o:p> </o:p></span></code></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It goes on to say that you must validate these in accordance with section 3.2.3 (Authentication of organization identity). That section does not define the validation of any of those fields so I assume that this should reference 3.2.4
Authentication of individual identity. I’m assuming yes.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This will drive usage to Mailbox or Organization because nobody will want to do audits (CAs or Customers), so there will no longer be readable names in S/MIME certificates. That’s very unfortunate. Maybe nobody looks at that field and
rely on the “From: and “reply to” fields, so not using sponsor validated certificates isn’t an issue and we could look to remove this from the spec as something that won’t be adopted.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there no way we can come up with a way to permit the enterprise RA to optionally supply the name details (in some field) with less validation rigor/auditing? As it stands, we cannot issue certs to
<a href="mailto:helpdesk@example.com">helpdesk@example.com</a> with something like “Help Desk” in the subject DN.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Could we permit the Enterprise RA to supply Sponsor verified name details into the CN and omit givenName and surname and not require formal recordkeeping and audits? Since these certificates will contain the Sponsor validated OID, relying
parties will (could) know the level of validation applied to the CN is “Supplied by Organization and not validated by the CA” vs. the current level of assurance. I totally understand the high level of validation needed for the Individual Validated certs,
but the Sponsor validated certificates could/should(?) be different.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thoughts from anyone?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doug<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ps, the <code><span style="font-size:10.0pt">organizationIdentifier</span></code> field also threw me for a loop, but that’s another thread I’ll need to catch up on.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</body>
</html>