[Cscwg-public] Subscriber Private Key Protection Deadline Update

[Bruce Morton]

Hi Ian,

Thanks for reaching out on this item.

We have been working to meet the requirement, but the deadline to more aggressive than anticipated. With the Subscriber communication and feedback, we have found that Subscribers have been protecting their keys using many valid methods. We are having a difficult time to implement all methods and verification of the methods by the 15 November 2022 deadline. If we maintain the existing deadline, we would need to support a subset of methods which would impact some Subscribers.

The move of the deadline would provide more time to address all Subscriber's requirements.


Bruce.

From: Cscwg-public <cscwg-public-bounces at cabforum.org> On Behalf Of Ian McMillan via Cscwg-public
Sent: Wednesday, September 7, 2022 12:04 PM
To: Tim Hollebeek <tim.hollebeek at digicert.com>; cscwg-public at cabforum.org
Subject: [EXTERNAL] Re: [Cscwg-public] Subscriber Private Key Protection Deadline Update

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Thanks Tim! In general, I agree with your perspective on the "SHOULD", and I am trying to find something that would help alleviate the last-minute rush to meet the deadline.

On the October date reasoning, I look at the typical release timelines for new tooling (e.g. SDKs) and significant platform updates coming in the fall season, so I'd like to try and align closely with when releases are coming out that are precluded by many folks making changes to address new tools or features coming in those releases cycles. October is also a time focused on getting right before the deployment/change freezes for services and pipelines that are commonly seen in the November and December time periods. This was the similar reasoning we had for the November date when we initially started discussing the changes for subscriber private key protections, but with the landing of v2.8 later than initially expected and the feedback, October 2023 seems like the best time to help alleviate the stress for those that run up to the deadline.

Thanks,
Ian

From: Tim Hollebeek <tim.hollebeek at digicert.com<mailto:tim.hollebeek at digicert.com>>
Sent: Wednesday, September 7, 2022 11:05 AM
To: Ian McMillan <ianmcm at microsoft.com<mailto:ianmcm at microsoft.com>>; cscwg-public at cabforum.org<mailto:cscwg-public at cabforum.org>
Subject: [EXTERNAL] RE: Subscriber Private Key Protection Deadline Update

I'm normally very supportive of SHOULD requirements, but for a deadline like this, I can unfortunately guarantee that including a June SHOULD date will have absolutely no practical effect.  Instead, I would support any and all proposals people can think of for disincentivizing people from waiting until the last minute.  It's an important problem and one I wish we had better ways of dealing with.

-Tim

From: Cscwg-public <cscwg-public-bounces at cabforum.org<mailto:cscwg-public-bounces at cabforum.org>> On Behalf Of Ian McMillan via Cscwg-public
Sent: Wednesday, September 7, 2022 10:57 AM
To: cscwg-public at cabforum.org<mailto:cscwg-public at cabforum.org>
Subject: [Cscwg-public] Subscriber Private Key Protection Deadline Update

Hi Folks,

Since the announcement of the new subscriber private key protection requirements in CSBR v2.8 (Ballot CSC-13), I've fielded a number of questions and feedback on the November 15, 2022 deadline. I feel it is in the best interest of subscribers and CAs to delay this deadline to be October 1, 2023 for a number of reasons.


  1.  Subscriber & CA readiness time window from v2.8 to the November 15, 2022 deadline is too tight.
  2.  The November 15, 2022 deadline lands too close to typical end of calendar year deployment or change "freeze" periods.
  3.  The current global economic state makes investments a challenge and added operational budget pressure for all parties (subscribers, CAs, certificate consumers).
  4.  Supply chain challenges make obtaining the proper key protection solution by November 15, 2022 increasingly difficult.

The accumulation of challenges for both subscribers and CAs, I feel we need to delay the deadline to be delayed. That said, I'd like to propose we have a "SHOULD" date of June 1, 2023, and a "MUST" date of October 1, 2023. I believe this will allow CAs and subscribers to begin adoption of the new private key protection requirements ahead of the enforcement deadline of October 1, 2023.

I'd like to discuss this as an immediate ballot in the next WG meeting scheduled for September 8, 2022.

Cheers,
Ian McMillan
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20220907/a661506c/attachment.html>