[Cscwg-public] Final CSCWG Minutes March 23, 2023

Dean Coclin dean.coclin at digicert.com
Thu Apr 6 16:25:34 UTC 2023


Final Code Signing Working Group Meeting of 2022-03-23

 

Attendees: Atsushi Inaba (GlobalSign), Bruce Morton (Entrust), Dean Coclin
(DigiCert), Ian McMillan (Microsoft), Inigo Barreira (Sectigo), Brianca
Martin (Amazon), Dimitris Zacharopoulos (HARICA), Tim Hollebeek (DigiCert),
Martijn Katerbarg (Sectigo), Roberto Quinones (Intel)

 

Administration

*	Attendance and requests a minute taker
*	Reads antitrust statement 
*	Waiting on minutes for two meeting prior to face to face
*	Face to face minutes will be approved at next meeting

 

Malware Based Revocation Ballot

*	Ballot summary

*	Taking approach BRs and SBRs are taking on revocation
*	Removing CS specific suspect code reference
*	Discuss 5 day revocation window, consider a 5 day and/or 7 day

*	Bruce noted good to sync with the SSL BRs at 24 hours and 5 days,
but ok with suspect code at 5 days and 7 days
*	Discussion if we should have requirements defining a misused
certificate compared to private key misuse 
*	Additional discussion of misused keys, compared to compromised keys,
and signed code that is suspect 
*	Action point to consider defining misuse 
*	Discussion on proper time limit for known compromise and signing
malware 
*	Discussion of the difference in timing requirements between key
compromise and singing suspect code and back dating revocation 
*	Discussed the consideration that signing suspect code should be
treated as a potential compromise of key and/or the subscriber does not have
practices in place to detect suspect code 
*	Discussion of asking Microsoft as the main certificate consumer to
weigh in on complicated use cases. This is a practice now and not an overly
common practice, this would take place after revocation and there is an open
period to back date revocation 
*	Mentioned the RFC does not allow back dating, but it is an important
tool for code signing
*	Need to cover the loophole for certificate problem reports for
expired or revoked certificates
*	Potential wording is being drafted and will be included in GitHub
and distributed 

 

Other topics

*	It was determined singing service did not have much to discuss at
this time and we should focus on the revocation topic
*	A couple of points on removing the SSL BR reference were mentioned
and would be discussed on future calls

 

 

 

 

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20230406/37f7db39/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4916 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20230406/37f7db39/attachment-0001.p7s>


More information about the Cscwg-public mailing list