<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:115%;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0in">## Minutes of SMCWG<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">April 24, 2024<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">These are the Approved Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## Attendees<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">Abhishek Bhat - (eMudhra), Adriano Santoni - (Actalis S.p.A.), Aggie Wang - (TrustAsia), Andrea Holland - (VikingCloud), Ashish Dhiman - (GlobalSign), Clint Wilson - (Apple), Inaba Atsushi - (GlobalSign), Inigo
Barreira - (Sectigo), Janet Hines - (VikingCloud), Jozef Nigut - (Disig), Judith Spencer - (CertiPath), Keshava Nagaraju - (eMudhra), Marco Schambach - (IdenTrust), Martijn Katerbarg - (Sectigo), Morad Abou Nasser - (TeleTrust), Naveen Kumar - (eMudhra), Nome
Huang - (TrustAsia), Pedro Fuentes - (OISTE Foundation), Rollin Yu - (TrustAsia), Russ Housley - (Vigil Security LLC), Scott Rea - (eMudhra), Stephen Davidson - (DigiCert), Tadahiko Ito - (SECOM Trust Systems), Thomas Zermeno - (SSL.com), Tsung-Min Kuo - (Chunghwa
Telecom), Wendy Brown - (US Federal PKI Management Authority)<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 1. Roll Call<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">The Roll Call was taken.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 2. Read Antitrust Statement<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">The statement was read concerning the antitrust policy, code of conduct, and intellectual property rights agreement.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 3. Review Agenda<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">Minutes were prepared by Stephen Davidson.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 4. Approval of minutes from last teleconference<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">The minutes for the teleconference of April 10 were approved.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 5. Discussion<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal">Stephen Davidson noted that Ballot SMC06 was in IPR until May 11. See
<a href="https://url.avanan.click/v2/___https:/lists.cabforum.org/pipermail/smcwg-public/2024-April/000957.html___.YXAzOmRpZ2ljZXJ0OmE6bzoyOTE5NjE4NzI2MTVmNDEzMzhjMzVlZDUxMzc2ZjgzNDo2OjM2MzM6NDY0YzhlYmU1Y2NkZGI3N2MzMjVmMDliYTVhNjE3MTg2NDVkMjAxMmI4NWE0MzdmODJlNDk1OTVmMjVlNDBhMDpoOkY" title="Protected by Avanan: https://lists.cabforum.org/pipermail/smcwg-public/2024-April/000957.html">
https://lists.cabforum.org/pipermail/smcwg-public/2024-April/000957.html</a>.<o:p></o:p></p>
<p class="MsoNormal">Stephen reviewed a proposed clarification from Tim Hollebeek, where section 1.1 defines applicability to leaf certificates only. A proposed change makes clear the applicability to subCAs as well. There were no objections. See
<a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues/243___.YXAzOmRpZ2ljZXJ0OmE6bzoyOTE5NjE4NzI2MTVmNDEzMzhjMzVlZDUxMzc2ZjgzNDo2OjdjYjI6Y2NmMGNmY2VkNDQ3NWRmNDlmMzllNmRlNzljYTUxM2U1MzcyMjlkMTZiMzE2YzM0ZGIzNDZiOGQ2OWI2ZTdkNDpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues/243">
https://github.com/cabforum/smime/issues/243</a>.<o:p></o:p></p>
<p class="MsoNormal">Among the allowed methods for individual vetting is the ability for the CA or RA to accept a certificate request that has been digitally signed using a certificate from approved frameworks, and to rely on validated certificate details.
<o:p></o:p></p>
<p class="MsoNormal">Stephen noted that when the BR was published it laid out acceptance criteria in 3.2.4.1 (4) (b) – but purposefully did not name any approved frameworks in 3.2.4.1 (4) (a) following a decision by the working group that each such framework
should be the subject of a separate ballot. The working group discussed a draft proposed by Stephen to introduce reliance of eIDAS Qualified certificates. He clarified that this was to rely upon attributes in the certificate as evidence of vetting. It did
not affect the ability to rely upon electronically signed documents overall.<o:p></o:p></p>
<p class="MsoNormal">Clint Wilson said the existing acceptance criteria could also be improved, for example, by requiring confirmation that this type of reliance was intended in the use case for the certificate. He said it was important to be clear on the allowed
reliance period. For more see <a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues/244___.YXAzOmRpZ2ljZXJ0OmE6bzoyOTE5NjE4NzI2MTVmNDEzMzhjMzVlZDUxMzc2ZjgzNDo2OjRlYjE6ZTQxMDViMDRmNjg1MTU1MjYwMjg4OGJiMTY5MTdmOGNhNDYyOTNhMDIwOTZmNzAzNzkxMjJjZDdiNmVjYzRlODpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues/244">
https://github.com/cabforum/smime/issues/244</a>.<o:p></o:p></p>
<p class="MsoNormal">Stephen noted that with the advent of eIDAS2 the text relating to eID would also need review (subsequently added as
<a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues/245___.YXAzOmRpZ2ljZXJ0OmE6bzoyOTE5NjE4NzI2MTVmNDEzMzhjMzVlZDUxMzc2ZjgzNDo2Ojk2NTY6YTg4MDc2OGQxYzA5OTYxYzgzOWJjMWY4MjBmNDIwNjEzZjJkNWRjYTE2Yzg4OTNkZmMwZjczYmU3MzA3Zjc5NjpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues/245">
https://github.com/cabforum/smime/issues/245</a>) <o:p></o:p></p>
<p class="MsoNormal">Stephen noted that feedback was still welcomed from Certificate Issuers on improvements that would facilitate the transition to the Multipurpose and Strict profiles. He proposed a two stage approach to deprecating the Legacy profile. Stage
one proposed a cease issuance approximately a year following the ballot, for example June 15 2025. The long window is advisable to allow Enterprise RAs with integrations to CAs with adequate time to prepare. Stage two would occur after that time, to remove
the many Legacy references in the S/MIME BR. See more at <a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues/193___.YXAzOmRpZ2ljZXJ0OmE6bzoyOTE5NjE4NzI2MTVmNDEzMzhjMzVlZDUxMzc2ZjgzNDo2OmM5YTI6YWZkYjJkZmNkNzkwOWU4YjQzZTQ4NDBmMTlkMWFkZDUwZGFjYTA3Yjc5YjU2YWIyZmIxNWY4MDM0YmM3ZDY3MzpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues/193">
https://github.com/cabforum/smime/issues/193</a>.<o:p></o:p></p>
<p class="MsoNormal">Wendy Brown raised the negative impact of shorter validity period on implementations that use smartcards. Stephen agreed to add the topic to a future agenda.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 6. Any Other Business<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">The membership of TrustAsia as a Root CA was confirmed. It was confirmed that the teleconference scheduled for May 22 has been cancelled.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## 7. Next call<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">Next call: Wednesday, May 8, 2024 at 11:00 am Eastern Time<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in">## Adjourned<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;line-height:115%"><o:p> </o:p></span></p>
</div>
</body>
</html>