<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<h2>Minutes of SMCWG<o:p></o:p></h2>
<p class="MsoNormal">April 27, 2022<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">These are the <span style="color:windowtext">Approved</span> Minutes of the Teleconference described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.<o:p></o:p></p>
<h3>Attendees <o:p></o:p></h3>
<h3><span style="font-size:11.0pt;font-weight:normal">Adrian Mueller (SwissSign), Andreas Henschel (D-TRUST), Ashish Dhiman (GlobalSign), Ben Wilson (Mozilla), Bruce Morton (Entrust), Cade Cairns (Google), Chris Kemmerer (SSL.com), Christophe Bonjean (GlobalSign),
Clint Wilson (Apple), Corey Bonnell (Digicert), Daniel Zens (GlobalTrust), Don Sheehy (CPA Canada/WebTrust), Doug Beattie (GlobalSign), Enrico Entschew (D-TRUST), Eusebio Herrera (AC Camerfirma SA), Fotis Loukos (Google), Hazhar Ismail (MSC Trustgate Sdn Bhd),
Inaba Atsushi (GlobalSign), Inigo Barreira (Sectigo), Joanna Fox (TrustCor Systems), Mads Henriksveen (Buypass AS), Martijn Katerbarg (Sectigo), Matthias Wiedenhorst (ACAB Council), Mrugesh Chandarana (IdenTrust), Patrycja Tulinska (PSW), Pekka Lahtiharju
(Telia Company), Rebecca Kelley (Apple), Renne Rodriguez (Apple), Russ Housley (Russ Housley), Stefan Selbitschka (runQuadrat), Stephen Davidson (Digicert), Tadahiko Ito (SECOM Trust Systems), Tim Crawford (CPA Canada/WebTrust), Tsung-Min Kuo (Chunghwa Telecom),
Wendy Brown (US Federal PKI Management Authority)<o:p></o:p></span></h3>
<h3>1. Roll Call<o:p></o:p></h3>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The Roll Call was taken.<o:p></o:p></p>
<h3>2. Read Antitrust Statement<o:p></o:p></h3>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The Antitrust/Compliance Statement was read.<o:p></o:p></p>
<h3>3. Review Agenda<o:p></o:p></h3>
<h3>4. Approval of minutes from last teleconference<o:p></o:p></h3>
<p class="MsoNormal">The minutes of the April 13 teleconference were approved. <o:p>
</o:p></p>
<h3>5. Discussion <o:p></o:p></h3>
<p class="MsoNormal">The draft the S/MIME Baseline Requirements is available at <a href="https://github.com/cabforum/smime/blob/preSBR/SBR.md">
https://github.com/cabforum/smime/blob/preSBR/SBR.md</a> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen Davidson noted that the intent had been to formally launch the 30-day pre-ballot discussion period previously discussed, but that he was pleased to already start receiving feedback from a number of WG members on the draft text.
Some of these issues (such as recognizing eID as a validation option for Individuals, the ability to rely upon Sponsor-validated Individuals by attestation, and recognizing CA key generation) have already been addressed in the text.<o:p></o:p></p>
<p class="MsoNormal">Clint Wilson raised that the S/MIME BR should have clear direction for privacy issues as the S/MIME validations dealt with personal data. Stephen noted that he would seek assistance in drafting such text (subsequently added to the draft
in Section 9.4).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Fotis Loukos suggested that the use of OCSP should be optional for CAs due to privacy concerns, as it could allow CAs to gain information about the readers of emails. It was pointed out that OCSP support is mandatory under the Microsoft
root store requirements. Russ Housely noted that privacy concerns could be mitigated using OCSP stapling which is defined in RFC 5940, Additional Cryptographic Message Syntax (CMS) Revocation Information Choices
<a href="https://datatracker.ietf.org/doc/rfc5940/">https://datatracker.ietf.org/doc/rfc5940/</a>.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen raised that there had been concern raised by some WG members on the appropriateness of the EV Guidelines for the org vetting. He described that previous WG discussions in 2021 focused upon whether the S/MIME BR needed to establish
the O is ANY company called ExampleCo or that it's THAT PARTICULAR company called ExampleCo registered in New York.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Based on feedback from Cert Consumers, WG discussion gravitated towards EV-based vetting and the inclusion of a unique identifier in the certificates (using the subject:organizationalIdentifer from ETSI and the EVG rather than the layered
EV JOI attributes).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It was questioned whether the detailed procedures in EV (some of which seemed designed to counter issues of social engineering in retail TLS purchases) where required for the S/MIME use case in which “recurring” enterprise RA relationships
were the norm.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen laid out a range of options from full EV as described in the EVG, to modernized EV (for example dropping the remove physical and operational presence), to OV but tightened using the organizationalIdentifier, to full OV as described
in the TLS BR.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doug Beattie spoke in favor of full OV which is the dominant vetting method used in TLS and code signing, and the S/MIME BR are intended to provide “reasonable assurance, a baseline for vetting.”
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Wendy Brown noted that address should really only vetted if it appears in the certificate. Wendy stated that the organizationalIdentifier might not be meaningful to an average relying party.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen noted that the draft had expanded on the organizationalIdentifier idea to make it more expansive allowing a wider array of tax numbers, support for state level registries, and the use of corroborated LEI.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen asked Cert Consumer members for their input. Ben Wilson, noting that he was not speaking for the Mozilla community, said that he supported the use of OV extended with the organizationalIdentifier (which implies reference to government
data sources rather than only a Reliable Data Source). <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Clint Wilson, noting that he was not speaking for all of Apple, said that information needed to be correct. He said the answer was probably somewhere between full OV and full EV to be able to force correctness. He said that Cert Consumers,
once they know that information is consistently valid or correct, can then make decisions about what information is valuable for relying parties in UI/UX.<o:p></o:p></p>
<p class="MsoNormal"><br>
Doug asked if separate versions could be created for OV vs EV for S/MIME. Stephen noted that would be complicated as we already had 12 profiles – but noted that perhaps flexibility could be created in the Legacy profile. Doug said he worried the Legacy profile
might be phased out eventually. Clint said that is indeed the intent.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Clint said that we were better defining a single appropriate level than trying to accommodate multiple of them. It was noted that the EVG should ultimately be moved to RFC 3647 format.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Stephen agreed to create a new draft removing the EV specific content, and to propose a new version based upon OV using the organizationalIdentifier.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<h3 style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in">
6. Any Other Business<o:p></o:p></h3>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">None<o:p></o:p></p>
<h3>7. Next call<o:p></o:p></h3>
<h3><span style="font-size:11.0pt;font-weight:normal">Next call: Wednesday, May 13, 2022 at 11 a.m. US Eastern.<o:p></o:p></span></h3>
<h3><span lang="DE">Adjourned</span><o:p></o:p></h3>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
</div>
</body>
</html>