[Cscwg-public] Update to Subscriber Private Key Protection Requirements (CSC-6 to CSC-13)

Thu Mar 10 19:20:02 UTC 2022

Hi Ian,

Thanks for taking the time to address my questions. Nothing further!

From: Ian McMillan <ianmcm at microsoft.com> 
Sent: Tuesday, March 8, 2022 4:06 PM
To: Bruce Morton <Bruce.Morton at entrust.com>; Doug Beattie
<doug.beattie at globalsign.com>; Tim Hollebeek <tim.hollebeek at digicert.com>;
cscwg-public at cabforum.org
Subject: RE: Update to Subscriber Private Key Protection Requirements (CSC-6
to CSC-13)

Thanks Bruce for clarifying the 16.2 change for Doug. 

Doug, the 11.7 section needs a larger overhaul that we have in our parking
lot list and we had decided that any further updates to 11.7 would be
included in the larger overhaul. That said, I see you point on there are
multiple 16.3.1(1) and 16.3.1(2), etc., so I've updated the section
numbering to continue, and we now have section 16.3.1(1-9). Please see the
attached updated redline document. 

Thanks,

Ian 

From: Bruce Morton <Bruce.Morton at entrust.com> 
Sent: Thursday, March 3, 2022 9:08 AM
To: Doug Beattie <doug.beattie at globalsign.com>; Ian McMillan
<ianmcm at microsoft.com>; Tim Hollebeek <tim.hollebeek at digicert.com>;
cscwg-public at cabforum.org
Subject: [EXTERNAL] RE: Update to Subscriber Private Key Protection
Requirements (CSC-6 to CSC-13)

Doug,

Regarding the 16.2 section, this statement was also struck-out, "After
2021-06-01, the same protection requirements SHALL apply to Non EV Code
Signing Certificates." So I believe that the requirement already applied to
normal code signing certificates. The edits are just a cleanup.

Bruce.

From: Doug Beattie <doug.beattie at globalsign.com
<mailto:doug.beattie at globalsign.com> > 
Sent: Thursday, March 3, 2022 6:56 AM
To: Ian McMillan <ianmcm at microsoft.com <mailto:ianmcm at microsoft.com> >; Tim
Hollebeek <tim.hollebeek at digicert.com <mailto:tim.hollebeek at digicert.com> >;
cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> ; Bruce Morton
<Bruce.Morton at entrust.com <mailto:Bruce.Morton at entrust.com> >
Subject: [EXTERNAL] RE: Update to Subscriber Private Key Protection
Requirements (CSC-6 to CSC-13)

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the
content is safe.

  _____  

Hi Ian,

Good work on section 16.3, that is much more clear now.  I have 2 more
comments for your consideration.

Comment #1:

In Section 11.7 we say:

If the CA is aware that the Applicant was the victim of a Takeover Attack,
the CA MUST verify that the Applicant is protecting its Code Signing Private
Keys under Section 16.3.1(1) or Section 16.3.1(2). The CA MUST verify the
Applicant's compliance with Section 16.3.1(1) or Section 16.3.1(2) (i)
through technical means that confirm the Private Keys are protected using
the method described in 16.3.1(1) or 16.3.1(2) or (ii) by relying on a
report provided by the Applicant that is signed by an auditor who is
approved by the CA and who has IT and security training or is a CISA.

But now there are actually 2 lists in sections 16.3.1(1) or Section
16.3.1(2) with those list numbers.  Do we need to be more specific, or
renumber the second list a-c?  

After 15 November, what is the right remediation for Take Over attack, do we
need to reference one or more of the items in the new list (the list we
might renumber a-c), or is there no remediation now?

There are multiple references to 16.3.1(1) so we'd want to apply the same
logic to all instances.

Comment #2:

Section 16.2 removed the reference to EV in the scope so this applies to
normal Code signing certificates.  Since this does not have a date
associated with it, do we assume that this requirement change for normal
code signing certs is effective immediately?

From: Ian McMillan <ianmcm at microsoft.com <mailto:ianmcm at microsoft.com> > 
Sent: Wednesday, March 2, 2022 5:56 PM
To: Tim Hollebeek <tim.hollebeek at digicert.com
<mailto:tim.hollebeek at digicert.com> >; cscwg-public at cabforum.org
<mailto:cscwg-public at cabforum.org> ; Doug Beattie
<doug.beattie at globalsign.com <mailto:doug.beattie at globalsign.com> >; Bruce
Morton <bruce.morton at entrust.com <mailto:bruce.morton at entrust.com> >
Subject: RE: Update to Subscriber Private Key Protection Requirements (CSC-6
to CSC-13)

Thank you, Tim, I really like the structure suggestions here. I've made
those updates per your suggestion in the attached copy of the redline
document. 

I'll note your endorsement.

Cheers,

Ian

From: Tim Hollebeek <tim.hollebeek at digicert.com
<mailto:tim.hollebeek at digicert.com> > 
Sent: Wednesday, March 2, 2022 4:57 PM
To: Ian McMillan <ianmcm at microsoft.com <mailto:ianmcm at microsoft.com> >;
cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> ; Doug Beattie
<doug.beattie at globalsign.com <mailto:doug.beattie at globalsign.com> >; Bruce
Morton <bruce.morton at entrust.com <mailto:bruce.morton at entrust.com> >
Subject: [EXTERNAL] RE: Update to Subscriber Private Key Protection
Requirements (CSC-6 to CSC-13)

I would recommend against using parentheticals to express the deprecation
dates, as it makes the sentences more complicated than they need to be.  I'd
just modify the first sentence of each part so the structure is as follows:

   For Non-EV Code Signing Certificates issued prior to November 15, 2022, .

   For EV Code Signing Certificates issued prior to November 15, 2022, .

   Effective November 15, 2022, .

But otherwise, the updates look good and we are willing to endorse CSC-13.

-Tim

From: Ian McMillan <ianmcm at microsoft.com <mailto:ianmcm at microsoft.com> > 
Sent: Wednesday, March 2, 2022 11:31 AM
To: cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> ; Doug
Beattie <doug.beattie at globalsign.com <mailto:doug.beattie at globalsign.com> >;
Bruce Morton <bruce.morton at entrust.com <mailto:bruce.morton at entrust.com> >;
Tim Hollebeek <tim.hollebeek at digicert.com
<mailto:tim.hollebeek at digicert.com> >
Subject: Update to Subscriber Private Key Protection Requirements (CSC-6 to
CSC-13)

Hi Folks,

Attached you will find an updated redline doc of v2.7 of the CSBRs with the
updates to the subscriber private key protection requirements as outlined
previously in CSC-6. This updated version also includes edits to address
issues Doug Beattie raised during the voting period of CSC-6, so I am
looking for confirmation from Doug on these edits addressing the concerns he
raised. 

Additionally, I'm looking to get endorsements on this ballot under CSC 13 -
Update to Subscriber Private Key Protection Requirements
<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.cabf
orum.org%2Fcscwg%2Fcsc_13_-_update_to_subscriber_private_key_protection_requ
irements&data=04%7C01%7Cianmcm%40microsoft.com%7Cd4f1031bc20548d5353008d9fc9
78390%7C72f988bf86f141af91ab2d7cd011db47%7C0%7C0%7C637818549960291581%7CUnkn
own%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVC
I6Mn0%3D%7C3000&sdata=K2KcmHbxwQ0sUNuNRmUs709PD16hYnqvPbLB%2BGzExng%3D&reser
ved=0> , and hope that Bruce and Tim, as previous endorsers can review the
edits and endorse the new ballot. Once we have endorsers I'll proceed with
the formal ballot process. 

Cheers,

Ian 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20220310/f251f9c5/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 8404 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20220310/f251f9c5/attachment-0001.p7s>