[Cscwg-public] Adopted: CSC-26 Timestamping Private Key Protection Ballot

Thu Aug 1 23:58:00 UTC 2024

Ballot CSC 26: Timestamping Private Key Protection Ballot

The Intellectual Property Review (IPR) period for Ballot CSC26: Timestamping Private Key Protection Ballot has completed. No IPR Exclusion Notices were filed, and the ballot is adopted as of Aug 1, 2024.

The new Code Signing BRs will be published to the CABF public website in accordance with the Bylaws.

Dean Coclin 

CSCWG Chair

From: Cscwg-public <cscwg-public-bounces at cabforum.org> On Behalf Of Dean Coclin via Cscwg-public
Sent: Monday, July 1, 2024 9:55 AM
To: cscwg-public at cabforum.org
Subject: [Cscwg-public] Notice of IPR Review Period: CSC-26 Timestamping Private Key Protection Ballot

NOTICE OF IPR REVIEW PERIOD

This Review Notice is sent pursuant to Section 4.1 of the CA/Browser Forum’s Intellectual Property Rights Policy (v1.3). This Review Period of 30 days is for one Final Maintenance Guidelines. The complete Draft Maintenance Guideline that is the subject of this Review Notice is attached to this email, both in red-line and changes-accepted draft format, in PDF version.

Summary of Review

Ballot for Review:  See below email

Start of Review Period: July 1st, 2024 at 3:00 PM UTC

End of Review Period: August 1, 2024 at 3:00 PM UTC

Members with any Essential Claim(s) to exclude must forward a written Notice to Exclude Essential Claims to the Working Group Chair (email to Dean Coclin < <mailto:dean.coclin at digicert.com> dean.coclin at digicert.com>) and also submit a copy to the CA/B Forum CSCWG public mailing list (email to public at cabforum.org <cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> >) before the end of the Review Period.

For details, please see the current version of the  <https://url.avanan.click/v2/___https:/cabforum.org/wp-content/uploads/CABF-IPR-Policy-v.1.3_4APR18.pdf___.YXAzOmRpZ2ljZXJ0OmE6bzo4OWUxMTQ0MzAxY2U1NDNiNWVlN2NmYTgxNmYwN2YzMjo2OmM0YTk6OWVlMTdiOWZlYmI3ZWZkZWU0ZDljOWFhZTljYTY5ZGRhN2I1MzhkZmRjYjJiMGY3MDYyMjA1MTVlN2IyNzhjZTpoOkY6Tg> CA/Browser Forum Intellectual Property Rights Policy.

(An optional template for submitting an Exclusion Notice is available at  <https://url.avanan.click/v2/___https:/cabforum.org/wp-content/uploads/Template-for-Exclusion-Notice.pdf___.YXAzOmRpZ2ljZXJ0OmE6bzo4OWUxMTQ0MzAxY2U1NDNiNWVlN2NmYTgxNmYwN2YzMjo2OmY1NmY6MjdiODVlNDQ1MThmNWIwNjE0ZmVmYTA1ZDEyMmE1YzU4OWQxZWE2Yzk1MmMyY2FjZGVmOTZmYjVkMTBjZTliODpoOkY6Tg> https://cabforum.org/wp-content/uploads/Template-for-Exclusion-Notice.pdf)

Dean Coclin 

CSCWG Chair

From: Cscwg-public <cscwg-public-bounces at cabforum.org <mailto:cscwg-public-bounces at cabforum.org> > On Behalf Of Dean Coclin via Cscwg-public
Sent: Friday, June 28, 2024 4:16 PM
To: cscwg-public at cabforum.org <mailto:cscwg-public at cabforum.org> 
Subject: [Cscwg-public] CSC-26 Timestamping Private Key Protection Ballot results

Voting on CSC-26 Timestamping Private Key Protection has closed and the ballot has passed. Results are below:

Certificate Issuers 

In Favor: Certum, DigiCert, eMudhra, Entrust, GlobalSign, IdenTrust, Sectigo, SSL.com

Opposed: none

Abstain: none

Certificate Consumers:

In Favor: Microsoft

Opposed: none

Abstain: none

Quorum was met at 5, therefore the ballot passes.

Dean Coclin

CSCWG Chair

From: Cscwg-public < <mailto:cscwg-public-bounces at cabforum.org> cscwg-public-bounces at cabforum.org> On Behalf Of Martijn Katerbarg via Cscwg-public
Sent: Thursday, June 20, 2024 12:31 PM
To:  <mailto:cscwg-public at cabforum.org> cscwg-public at cabforum.org
Subject: [Cscwg-public] [Voting Period Begins] CSC-26 Timestamping Private Key Protection

Purpose of the Ballot

This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates“ version 3.7 in order to clarify language regarding Timestamp Authority Private Key Protection. The main goals of this ballot are to:

1.	Require Timestamp Authority Subordinate CA Private Keys to be stored in offline HSMs
2.	Add a requirement to remove Private Keys associated with Timestamp Certificates after a 18 months
3.	Add a requirement to reject SHA-1 timestamp requests

The following motion has been proposed by Martijn Katerbarg of Sectigo and endorsed by Bruce Morton of Entrust and Ian McMillan of Microsoft.

MOTION BEGINS

This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates” ("Code Signing Baseline Requirements") based on version 3.7. MODIFY the Code Signing Baseline Requirements as specified in the following redline:  <https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/compare/d431d9104094f2b89f35ed4bf1d64b9a844e762b...12130ff7c2b41d795d47925c084780ea0f7328cd___.YXAzOmRpZ2ljZXJ0OmE6bzo4NDVjMzVmMjQ0MzI5OGUyZmQ0NzljYjNkZGQ5NmE0Mjo2OmUwMmQ6MDI2ZTdmZmQ4OWQxMDgzZDcxMzA4YjE3NDUyNjk3MzQ0ZDgwM2U1YTdkMWVjZjRkZmFjZTRjNzA1NTUwMTRmOTpoOkY> https://github.com/cabforum/code-signing/compare/d431d9104094f2b89f35ed4bf1d64b9a844e762b...12130ff7c2b41d795d47925c084780ea0f7328cd

MOTION ENDS

The procedure for this ballot is as follows:

Discussion (7 days)

*	Start Time: 2024-06-13 16:30 UTC
*	End Time: 2024-06-20 16:30 UTC

Vote for approval (7 days)

*	Start Time: 2024-06-20 16:30 UTC
*	End Time: 2024-06-27 16:30 UTC

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20240801/f88daf2b/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4542 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20240801/f88daf2b/attachment-0001.p7s>