<div dir="ltr">at least change the definition to<div>Bridge CA – A CA that facilitates interoperability between different enterprises or communities that operate their own PKIs, through the use of Cross Certificates with participating CAs.</div><div><br></div><div>Because your wording perpetuates the misunderstanding that Bridges are used as the Root for their community, which is not the case. Most Bridges do not make their self-signed certificate available to be used as a trust anchor.</div><div><br></div><div>Although Judy may not agree with me, I would even prefer leaving out all mention of Bridge CAs in the document and instead just make it clear that the document is only applicable to PKIs that adopt them by asserting any of the CAB Forum certificate policy OIDs in certificates they issue and are included in one or more of the public trust programs managed by the member certificate consumers.</div><div><br></div><div>I agree with the first sentence of your closing paragraph:</div><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Bridge CAs fall outside of mandatory adoption of the SBR unless the Bridge CA itself is Publicly-Trusted. </div></blockquote>However, the last sentence is again misleading<br><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>If a CA that is crossed with the Bridge CA is itself Publicly-Trusted then it must adopt but it does not drag other nonPublicly-Trusted CAs in the Bridge ecosystem into scope.<br></div></blockquote>That is exactly the issue that was created that resulted in the Symantec issue a number of years ago. Because there was a Symantec Root in the public trust stores that had issued a cross-certificate to the FBCA, people felt that Symantec was therefore responsible for all of the PKIs in the FPKI following all the BRs when in fact many of them did not even issue TLS certificates and would not have created valid paths to that root if the browsers had correctly done certificate policy processing during path validation according to RFC 5280.</div><div><br></div><div>Bridges are NOT the root of trust for their community, instead they operate more as a hub, allowing peer PKIs to only have to issue 1 cross-certificate to the Bridge, while the Bridge issues cross-certificates to all the member peer PKIs. This allows each member PKI to use their own Root as a Trust Anchor while enabling them to trust all the other member PKIs. Essentially the Bridge is an intermediate CA between each pair of peer PKIs in the community.</div><div><br></div><div>Thanks, (and sorry to be providing what may seem to be too many details for the current discussion)</div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><p class="MsoNormal"><span style="font-family:"Segoe Script",sans-serif">Wendy</span></p><p class="MsoNormal"><br></p><p class="MsoNormal">Wendy Brown</p>
<p class="MsoNormal">Supporting GSA</p><p class="MsoNormal">FPKIMA Technical Liaison</p>
<p class="MsoNormal">Protiviti Government
Services</p>
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif">703-965-2990 (cell)</span><br></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 3, 2022 at 6:10 PM Stephen Davidson <<a href="mailto:Stephen.Davidson@digicert.com">Stephen.Davidson@digicert.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US" style="overflow-wrap: break-word;"><div class="gmail-m_-3422804202460683887WordSection1"><p class="MsoNormal">Hi Wendy – thank you for the suggestion.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I’d like to stick with the original simpler text because the SBR doesn’t address “how a Bridge CA operates” apart from adopting some CABF-wide standards covering Cross Certificate profiles.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Bridge CAs fall outside of mandatory adoption of the SBR unless the Bridge CA itself is Publicly-Trusted. If a CA that is crossed with the Bridge CA is itself Publicly-Trusted then it must adopt but it does not drag other nonPublicly-Trusted CAs in the Bridge ecosystem into scope.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Best, Stephen<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in"><p class="MsoNormal"><b>From:</b> Wendy Brown - QT3LB-C <<a href="mailto:wendy.brown@gsa.gov" target="_blank">wendy.brown@gsa.gov</a>> <br><b>Sent:</b> Wednesday, August 3, 2022 3:00 PM<br><b>To:</b> Stephen Davidson <<a href="mailto:Stephen.Davidson@digicert.com" target="_blank">Stephen.Davidson@digicert.com</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>><br><b>Subject:</b> Re: [Smcwg-public] Bridge CA<u></u><u></u></p></div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">Stephen - suggested rewording of the Bridge CA definition<u></u><u></u></p><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Bridge CA – A CA that facilitates interoperability between different enterprises or communities that operate their own PKIs, by issuing and receiving Cross Certificates which map the peer PKI certificate policies to the certificate policies of the Bridge CP.<u></u><u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal"><br clear="all"><u></u><u></u></p><div><div><div><p class="MsoNormal"><span style="font-family:"Segoe Script"">Wendy</span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Wendy Brown<u></u><u></u></p><p class="MsoNormal">Supporting GSA<u></u><u></u></p><p class="MsoNormal">FPKIMA Technical Liaison<u></u><u></u></p><p class="MsoNormal">Protiviti Government Services<u></u><u></u></p><p class="MsoNormal">703-965-2990 (cell)<u></u><u></u></p></div></div></div><p class="MsoNormal"><u></u> <u></u></p></div></div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal">On Wed, Aug 3, 2022 at 12:39 PM Stephen Davidson via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>> wrote:<u></u><u></u></p></div><blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in"><div><div><p class="MsoNormal">Hello:<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Following our discussion, I have merged the PR relating to Bridge CAs <a href="https://github.com/cabforum/smime/commit/50093055e1a2db9822cc68f90f503b48210f576a" target="_blank">https://github.com/cabforum/smime/commit/50093055e1a2db9822cc68f90f503b48210f576a</a><u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">As discussed we will want to add a definition for a Bridge CA. I propose the following:<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Bridge CA – A CA that facilitates interoperability between different enterprises or communities that operate their own PKIs, by issuing Cross Certificates to participating CAs. <u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Feedback welcomed.<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Regards, Stephen<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p></div></div><p class="MsoNormal">_______________________________________________<br>Smcwg-public mailing list<br><a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><u></u><u></u></p></blockquote></div></div></div></blockquote></div>