[Cscwg-public] New companies and EV Code Signing

[Tim Hollebeek]

I think what Corey is trying to point out is that EVG 11.6 is weaker than the OV CSBR requirement, so it in itself does not cover the EVCS gap we identified.

 

-Tim

 

From: Dimitris Zacharopoulos (HARICA) <dzacharo at harica.gr> 
Sent: Tuesday, July 27, 2021 12:35 AM
To: Corey Bonnell <Corey.Bonnell at digicert.com>; cscwg-public at cabforum.org; Tim Hollebeek <tim.hollebeek at digicert.com>
Subject: Re: [Cscwg-public] New companies and EV Code Signing

 

 

On 27/7/2021 1:13 π.μ., Corey Bonnell wrote:

Hi Dimitris,

Perhaps I’m missing some context, but any of the four verification options set forth in EVG 11.6.2 will satisfy 11.6 (and in turn, CSBR 11.2.7). Several of the verification options listed in that section do not provide the level of assurance that the CSBRs prescribe for individuals in section 11.1.2.

 

With this in mind, I believe that harmonizing the individual vetting for new organizations requirement for OVCS with EVCS is a useful improvement.


Certainly, but that's not the topic we were discussing with Tim, which was around the "3 years of existence" requirement for an organization to be validated.

Dimitris.




 

Thanks,

Corey

 

From: Cscwg-public  <mailto:cscwg-public-bounces at cabforum.org> <cscwg-public-bounces at cabforum.org> On Behalf Of Dimitris Zacharopoulos (HARICA) via Cscwg-public
Sent: Saturday, July 24, 2021 4:13 AM
To: Tim Hollebeek  <mailto:tim.hollebeek at digicert.com> <tim.hollebeek at digicert.com>; cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> 
Subject: Re: [Cscwg-public] New companies and EV Code Signing

 

 

On 22/7/2021 7:11 μ.μ., Tim Hollebeek via Cscwg-public wrote:

 

I’m hearing from our code signing validation people that 11.1.1, which refers to non-EV CS certificates, has a requirement for additional validation for companies less than three years old (we’ve discussed this recently), but this requirement is missing for EV code signing certificates.

 

Is that what we want?  It seems very odd that a higher level of validation has fewer requirements.


Hi Tim,

For EV CS certificates there is a direct reference to the EV Guidelines. Specifically, 11.2.7 of the CSBRs point to EVG 11.6.

EVG 11.6.2 includes language for companies less than three years old. I recall bringing this up in one of the previous calls where it was pointed out that it's not necessary for a company to be less than 3 years old if the other verification methods described in 11.6.2 are used.

Hope this helps.

Dimitris.







 

-Tim






_______________________________________________
Cscwg-public mailing list
Cscwg-public at cabforum.org <mailto:Cscwg-public at cabforum.org> 
https://lists.cabforum.org/mailman/listinfo/cscwg-public

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20210727/4528c402/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4940 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20210727/4528c402/attachment.p7s>