<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Judith,<div><br></div><div>As I understand it, the proposed change is purely additive. That is, currently there are no approved frameworks in the SBRs meaning that there is no way for a compliant CA to rely upon a digital signature as evidence for the collection of Individual identity attributes (or any other purpose, I believe, but haven’t checked outside of Section 3.2.4.1 as closely). From my reading, this change doesn’t eliminate the ability for those not in the EU to trust existing digital signatures as evidence as no such ability exists today. Rather, this change would only add the ability to rely on digital signatures created by a subset of eIDAS Electronic Qualified Signature Certificates. While that is still limited in scope, as you indicate, it also doesn’t remove anything already allowed by the SBRs.</div><div><br></div><div>Can you help me understand better where you see the current SBRs as allowing CAs to rely upon digital signatures in the context of 3.2.4.1 today?</div><div><br></div><div>Thank you!</div><div>-Clint<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Apr 25, 2024, at 7:20 AM, Judith Spencer via Smcwg-public <smcwg-public@cabforum.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;">Stephen<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;">My primary concern with the proposed change is that once it finds it’s way into the BR, anyone not in the EU will be eliminated from trusting existing digital signatures as evidence. For example, here in the U.S., the U.S. Government has an extremely robust digital credential based on a full background check that is independently assessed and accompanied by reams of documentation, regulation and policy. Over 7 million individuals hold these credentials. But by this policy, signatures from this community would not be sufficient as evidence. The CertiPath community, comprised of major Aerospace Corporations, would likewise be eliminated. While we don’t employ the same level of background checks in our identity proofing, it is certainly based on sound practice and audited annually under WebTrust for CA, which may not be a “national scheme” but is certainly a robust review process widely recognized in the U.S. and Canada. <span class="Apple-converted-space"> </span><o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;">Unless you are prepared to identify schemes that cover all other regions of the world, I believe it is too early to make this change. As a compromise, I suggest you could identify eIDAS as the qualifying scheme for Europe and remain silent on the rest of the world. I recommend you revise the opening as follows:<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-family: "Segoe UI", sans-serif; color: rgb(31, 35, 40); background: white;">“If a digital signature is to be used as evidence<span class="Apple-converted-space"> </span><u>in the European Union</u>, the CA or RA SHALL only rely upon the following certificate type:”<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;">Once sufficient assessment has taken place to include all participating regions, the language could be further modified as you suggest. <span class="Apple-converted-space"> </span><o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;">Judy<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;"><o:p> </o:p></span></div><div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><b><span style="font-family: Calibri, sans-serif;">Judith Spencer | PMA Chair | CertiPath, Inc.<o:p></o:p></span></b></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span lang="IT" style="font-family: Calibri, sans-serif;">1900 Reston Metro Plaza, Suite 303, Reston, VA 20190<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><b><span lang="IT" style="font-family: Calibri, sans-serif;">PH</span></b><span lang="IT" style="font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span>+1.301.974.4227<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><b><span style="font-family: Calibri, sans-serif;">Email</span></b><span style="font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:Judith.Spencer@CertiPath.com" style="color: rgb(70, 120, 134); text-decoration: underline;"><span style="color: rgb(5, 99, 193);">Judith.Spencer@CertiPath.com</span></a><o:p></o:p></span></div></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><span style="font-size: 12pt;"><o:p> </o:p></span></div><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><b><span style="font-family: Calibri, sans-serif;">From:</span></b><span style="font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span>Smcwg-public <smcwg-public-bounces@cabforum.org><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Stephen Davidson via Smcwg-public<br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, April 24, 2024 8:06 PM<br><b>To:</b><span class="Apple-converted-space"> </span>smcwg-public@cabforum.org<br><b>Subject:</b><span class="Apple-converted-space"> </span>[External] [Smcwg-public] Draft proposal to add eIDAS QES as vetting evidence for individual<o:p></o:p></span></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;">Hello all:<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Aptos, sans-serif;">As discussed today, here is draft language for consideration to allow CAs to rely upon signatures created with eIDAS Qualified certificates as evidence supporting validation of individual identity.<o:p></o:p></p><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><a href="https://github.com/srdavidson/QES-SMIME-BR/blob/master/QES-proposal.md" style="color: rgb(70, 120, 134); text-decoration: underline;">https://github.com/srdavidson/QES-SMIME-BR/blob/master/QES-proposal.md</a><o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;">I’d be grateful for feedback on this language.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;">Best, Stephen<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Smcwg-public mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Smcwg-public@cabforum.org</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</span></div></blockquote></div><br></div></body></html>