<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1514103679;
mso-list-template-ids:-1134933432;}
@list l1
{mso-list-id:1584492656;
mso-list-template-ids:-2091508732;}
@list l1:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Dear List-Members,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">I was unfortunately not able to participate in the last meeting as the Webex Link in the CA/B wiki was outdated… So please forgive if my questions have been discussed but haven’t made it to the minutes yet.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Multi-point validation: Maybe a stupid question, but aren’t we trying to solve a network-layer problem on the application layer? I remember a project some years ago that tried to run “notary services” on servers all over
the world with a browser plugin that would use these notary servers to check if server certificates were valid… essentially doing the same as this proposal, just from the client instead of from the CA. It never gained traction… maybe because such attacks really
don’t happen often enough to justify the effort or because it’s the wrong approach to the problem… I don’t know.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Also, to use DNS for mailbox ownership validation seems to me like an abuse of DNS (how would I get Gmail to include something in their DNS just so that I can get an S/MIME certificate on my Gmail email address?).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">IMHO, extending CAA to cover S/MIME certificates is however a good and necessary step as the owner of a domain can then decide which CA the email-users of that domain can use.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Kind regards<br>
Roman<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Validation <validation-bounces@cabforum.org>
<b>On Behalf Of </b>Martijn Katerbarg via Validation<br>
<b>Sent:</b> Mittwoch, 21. Juni 2023 22:08<br>
<b>To:</b> Pedro FUENTES <pfuentes@WISEKEY.COM>; CA/Browser Forum Validation SC List <validation@cabforum.org>; Ryan Dickson <ryandickson@google.com><br>
<b>Subject:</b> Re: [cabf_validation] [EXTERNAL]-Re: Question about MPDV and CAA<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Pedro,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Just adding my thoughts here. In my opinion items 1, 2 and 3 all tie together.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Say that Company X wants their domains completely secured. They lock in on 1 CA, thus setting a CAA record allowing issuance only by CA A.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">They’ve chosen CA A, because CA A has disabled DCV through email validation (or, have found a way to make this MPDV compliant) and has implemented MPDV for both CAA record checking,
as well as their DCV options.<br>
<br>
So far so good.<br>
<br>
But now, Attacker wants to try to obtain a certificate for one of Company X their domains. Upon investigation, they notice that Company X only allows issuance by CA A, and due to MPDV, they cannot use BGP hijacking as an attack vector.<br>
<br>
So, Attacker goes instead to CA B. CA B has implemented MPDV for several options, but not for email validation. Since Attacker can perform a BGP hijack on CA B, they’re able to reroute the email to their own servers. Now as Attacker has done BGP Hijacking,
they’re also able to spoof the CAA DNS record, thus, showing CA B a valid CAA record, for CA B to issue the certificate.<br>
<br>
As such, while Company X has taken all precautions, a weak link in this chain, can circumvent the entry of the checks.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">(And as such, in time I expect we will see Email DCV go away, but probably not as the first step of enabling MPDV)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Regards,<br>
<br>
Martijn<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Validation <<a href="mailto:validation-bounces@cabforum.org">validation-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Pedro FUENTES via Validation<br>
<b>Sent:</b> Wednesday, 21 June 2023 19:19<br>
<b>To:</b> Ryan Dickson <<a href="mailto:ryandickson@google.com">ryandickson@google.com</a>><br>
<b>Cc:</b> CA/Browser Forum Validation SC List <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>><br>
<b>Subject:</b> Re: [cabf_validation] [EXTERNAL]-Re: Question about MPDV and CAA<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div style="border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FAFA03"><span lang="EN-US" style="font-size:10.0pt;color:black">CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender
and know the content is safe.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Ryan, <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Thanks for the reply. This make things much clear to me.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">My interpretation of your risk scenarios are:<o:p></o:p></span></p>
</div>
<div>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
<span lang="EN-US">Enabling a CA that allows email validation… this implies that the attacker not only hijacks the network, but also controls the validation email. For me this risk effectively exists, but I’d assume low likelihood (else the email validations
methods should be considered insecure and disallowed in the BR).<o:p></o:p></span></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
<span lang="EN-US">Disabling CAA checks such as account binding… considering that MPDV must still be used to prove domain control, I still fail to see the risk here…For example, the attacker could skip some ACME security features… but I’d say that the issuance
would still be prevented thanks to MPDV.<o:p></o:p></span></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
<span lang="EN-US">“no-issue” CAA record… again, given than MPDV must still be used, I fail to see the risk.<o:p></o:p></span></li></ol>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Can you please elaborate your comments con scenarios #2 and #3… How the issuance could succeed given the fact that MPDV must be still used for domain control validation? <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Any security countermeasure must necessarily exist to mitigate a risk that, not only exists, but it has a level (combination of impact and likelihood) that justifies its mitigation… it’s evident that the impact is very
high (misissuance), but I’d like to fully understand the risk level.<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Just in case… we are fine deploying distributed CAA checks if required, but I’d like to fully understand the rational here… mostly because CA systems that are more complex and with critical components distributed in the
cloud will also increase the attack surface and risks for the CA itself.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Best,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Pedro<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><o:p> </o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">On 21 Jun 2023, at 15:18, Ryan Dickson <</span><a href="mailto:ryandickson@google.com"><span lang="EN-US">ryandickson@google.com</span></a><span lang="EN-US">> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Pedro,<br>
<br>
Thanks for taking the time to review the proposal - and for your question. Also, sorry for the delayed response - I’ve been out of the office for a few days.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><br>
The researchers at Princeton initially advised us to evaluate both domain validation challenges and CAA records to add resilience to the issuance process. Specifically, the goal was to make it more difficult for an adversary to launch what they described as
a “downgrade attack.”<br>
<br>
For example, let’s consider a domain owner who used CAA to restrict issuance to a set of CAs that do not support email-based domain control validation because they do not want to allow validation of their domain to occur via email. Also, suppose we aren’t checking
CAA from multiple Network Perspectives. In this case, it’d be easier for an adversary to downgrade the issuance process because they would only need to launch one successful attack (the perspective used by the CA to establish the primary determination) to
subvert CAA and allow a CA not included in the set of CAs permitted to issue a certificate to the domain to do so. In contrast, if CAA was checked across multiple Network Perspectives, the adversary would need to launch a global BGP attack to obtain a certificate
for the target domain (harder to accomplish and not always viable by the adversary, for example, they might only have the means to accomplish a local or regional attack).<br>
<br>
We also see layers of security built on top of CAA, for example, Account Binding and Validation Method Binding as specified by RFC 8657. These extensions allow organizations to restrict issuance to specific 1) account IDs or 2) ACME domain validation methods.
Not checking CAA records from multiple perspectives allows an adversary to more easily downgrade these additional security measures (based on the same approach described above) and then target the added attack surface these records were intended to eliminate.<br>
<br>
The “no-issue” CAA record (i.e., CAA 0 issue “;”) is another example where the CAA record has a significant impact on issuance behavior. If CAA is not being checked from multiple perspectives, this is another security control that can be more easily downgraded
than if CAA is being checked from multiple perspectives. <br>
<br>
As always, other considerations and perspectives are welcome! <br>
<br>
Thanks,<br>
Ryan<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, Jun 16, 2023 at 6:43 AM Pedro FUENTES via Validation <</span><a href="mailto:validation@cabforum.org" target="_blank"><span lang="EN-US">validation@cabforum.org</span></a><span lang="EN-US">> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">Hello, <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Sorry as most likely this has been already discussed, but as I came “late to the party”, there are things that I surely missed.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">About the need to consider CAA also in the MPDV… I’m thinking about this and I fail to see the risk we’re managing by doing it. My rational is that MPDV, once verifies the domain ownership/control, would also imply that
records in the DNS (i.e. CAA) are legit.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">The only situation I see where this could apply, is when someone could trick a CAA record during the reuse period of a previously validated domain, so MPDV could verify proper domain control, but the CAA check that must
be done for each issuance is faked, but I’d say that faking the CAA could have as only logic purpose to enable another CA to issue the certificate, and that CA would also need to check the domain control using MPDV.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">When you decided to include CAA in the game… what was the logic behind?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Most likely there’s a good reason that clever people has discussed already, so I’d appreciate if you can help me understand better.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Thanks!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Pedro<o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.5pt;color:#F62400"><br>
WISeKey SA</span></b><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.5pt">Pedro Fuentes<br>
</span></b><span lang="EN-US" style="font-size:8.5pt">CSO - Trust Services Manager</span><span lang="EN-US" style="font-size:9.0pt"><br>
</span><span lang="EN-US" style="font-size:7.5pt">Office: </span><span style="font-size:7.5pt"><a href="tel:+41%2022%20594%2030%2000" target="_blank"><span lang="EN-US">+ 41 (0) 22 594 30 00</span></a></span><span lang="EN-US" style="font-size:7.5pt"><br>
Mobile: + 41 (0) </span><span lang="EN-US" style="font-size:10.0pt">791 274 790</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:7.5pt">Address: Avenue Louis-Casaï 58 | </span><span lang="EN-US" style="font-size:10.0pt">1216 Cointrin | Switzerland</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-US" style="font-size:9.0pt">Stay connected with </span></b><b><span style="font-size:9.0pt"><a href="http://www.wisekey.com/" target="_blank"><span lang="EN-US" style="color:#F62400">WISeKey</span></a></span></b><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.5pt;color:#78A600">THIS IS A TRUSTED MAIL</span></b><span lang="EN-US" style="font-size:7.5pt;color:#78A600">: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey
please check the signature to avoid security risks</span><span lang="EN-US" style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">CONFIDENTIALITY: </span></b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">This email and any files transmitted with it can be confidential and it’s intended solely
for the use of the individual or entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender</span><span lang="EN-US" style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">DISCLAIMER: </span></b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability
for any errors or omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail
are checked for viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.</span><span lang="EN-US" style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
Validation mailing list<br>
</span><a href="mailto:Validation@cabforum.org" target="_blank"><span lang="EN-US">Validation@cabforum.org</span></a><span lang="EN-US"><br>
</span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_validation&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=AFTYu1HAQdkStwzgxyDbKOLyDwTHEezL5yeqoxeZ0fc&m=DsWs3jyPLw-2N-fE3sPErWvVPxoF-LYnrcdR9WhZMYA&s=GNSe8xPelzQlUicnJyZ8iRap81lwJpyA2HYpTw9jJsI&e=" target="_blank"><span lang="EN-US">https://lists.cabforum.org/mailman/listinfo/validation</span></a><span lang="EN-US"><o:p></o:p></span></p>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.5pt;color:#F62400"><br>
WISeKey SA</span></b><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.5pt;color:black">Pedro Fuentes<br>
</span></b><span lang="EN-US" style="font-size:8.5pt;color:black">CSO - Trust Services Manager</span><span lang="EN-US" style="font-size:9.0pt;color:black"><br>
</span><span lang="EN-US" style="font-size:7.5pt;color:black">Office: + 41 (0) 22 594 30 00<br>
Mobile: + 41 (0) </span><span lang="EN-US" style="font-size:10.0pt;color:black">791 274 790</span><span lang="EN-US" style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:7.5pt;color:black">Address: </span><span lang="EN-US" style="font-size:7.5pt">Avenue Louis-Casaï 58 | </span><span lang="EN-US" style="font-size:10.0pt">1216 Cointrin | Switzerland</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-US" style="font-size:9.0pt;color:black">Stay connected with </span></b><b><span style="font-size:9.0pt;color:black"><a href="http://www.wisekey.com/"><span lang="EN-US" style="color:#F62400">WISeKey</span></a></span></b><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.5pt;color:#78A600">THIS IS A TRUSTED MAIL</span></b><span lang="EN-US" style="font-size:7.5pt;color:#78A600">: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey
please check the signature to avoid security risks</span><span lang="EN-US" style="font-size:9.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US" style="font-size:9.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">CONFIDENTIALITY: </span></b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">This email and any files transmitted with it can be confidential and it’s intended solely
for the use of the individual or entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender</span><span lang="EN-US" style="font-size:9.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">DISCLAIMER: </span></b><span lang="EN-US" style="font-size:7.0pt;color:darkgray">WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability
for any errors or omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail
are checked for viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.</span><span lang="EN-US" style="font-size:9.0pt;color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>