<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p>Regarding section 3.2.4.1 Attribute collection of individual
identity, item 4:<br>
<br>
On the subject of reference frameworks for digital signatures, I
believe there is a problem that should be solved. <br>
</p>
<p>The AATL framework also includes digital signatures that are not
associated with a "personal certificate" (as required by §3.2.4.1)
and therefore, in my opinion, should not be accepted. I am
referring in particular to the DocuSign remote signature service
in which the signatures are (commonly) always made with the same
key and relative certificate whose Subject is the DocuSign company
itself (and not the person signing the document). I have not spent
a lot of time investigating the matter, but my understanding is
that the link of the DocuSign signature with the signer is just
based on a previous email exchange. An "ID Verification" step is a
Premium Feature that the average DocuSign user is not obliged to
buy.<br>
</p>
<p>To plug this security hole, I recommend clarifying in the BR that
DocuSign signatures are only accepted (if ever) only when made
with a /personal certificate/ (i.e., not one issued to DocuSign,
but rather to Johh Smith, Arianna Garcia, François Bertrand,
Hiroshi Nakamura, ecc.)</p>
<p>Regards</p>
<p>Adriano</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">Il 05/08/2022 00:06, Stephen Davidson
via Smcwg-public ha scritto:<br>
</div>
<blockquote type="cite"
cite="mid:010001826ae5b527-8ca45c40-e692-4c53-84fa-5296ec0f43f1-000000@email.amazonses.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<title></title>
<div align="center">
<table width="30%" cellspacing="2" cellpadding="2" border="1">
<tbody>
<tr>
<td valign="top" bgcolor="#ffff00"> <span style="color:
red;">NOTICE:</span> Pay attention - external email -
Sender is
<a class="moz-txt-link-abbreviated" href="mailto:010001826ae5b527-8ca45c40-e692-4c53-84fa-5296ec0f43f1-000000@amazonses.com">010001826ae5b527-8ca45c40-e692-4c53-84fa-5296ec0f43f1-000000@amazonses.com</a>
</td>
</tr>
</tbody>
</table>
<br>
</div>
<br>
<div class="WordSection1">
<p class="MsoNormal">Hello:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Certificate Issuer members of the SMCWG had
noted a desire to expand the list of regimes of digital
certificates that may be relied upon in personal validation.
It was also suggested by a Certificate Consumer that criteria
for
evaluating these regimes be described.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Based on our discussions, I have proposed
some
text in the draft as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a
href="https://github.com/cabforum/smime/commit/33ce560204eaed4162cb70c919bf9f86ffac90cc"
moz-do-not-send="true" class="moz-txt-link-freetext">
https://github.com/cabforum/smime/commit/33ce560204eaed4162cb70c919bf9f86ffac90cc</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks to Ashish Dhiman and to Eva Van
Steenberge for the help!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards, Stephen<o:p></o:p></p>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Smcwg-public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Smcwg-public@cabforum.org">Smcwg-public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/smcwg-public">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a>
</pre>
</blockquote>
</body>
</html>