[cabfpub] Membership Application of Sony

[Kirk Hall]

Adam – I just realized that there is a double test for anyone new applying to be a Forum member – one requirement to be a Forum Member, and a second requirement to be a member of a CWG.

In the browser (Certificate Consumer) category, the Forum membership requirement is as follows:

(a) All Forum members must *** meet at least one of the following criteria: ***

(3) Certificate Consumer: The member organization produces a software product, such as a browser, intended for use by the general public for relying upon certificates and is a member of a CWG [Chartered Working Group, such as the new Server Certificate Working Group].

Today we only have one Chartered Working Group (CWG).  Its charter has the following additional requirement for participation as a browser (Certificate Consumer):

(3) A Certificate Consumer can participate in this Working Group if it produces a software product intended for use by the general public for browsing the Web securely.

So to participate in this CWG (the only one we have), Sony must “produce[] a software product intended for use by the general public for browsing the Web securely”.  Can you tell us if Sony meets that requirement?

Sorry for any confusion – we are just rolling out this new governance structure now.

Kirk

From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Kirk Hall via Public
Sent: Wednesday, June 27, 2018 12:15 PM
To: CA/Browser Forum Public Discussion List <public at cabforum.org>
Subject: Re: [cabfpub] [EXTERNAL]Re: Membership Application of Sony

Good question.  The SCWG Charter is shown below.  Ben and I are the initial SCWG Chair and Vice Chair until the SCWG elects its own officers.  The SCWG was approved in Ballot 206 and already exists, but the changes to the Bylaws don’t become effective until July 3.

After that date, I plan to issue an invitation to CABF Members and Associate Members to participate in the SCWG, and ask them to indicate their interest by “registering” on a page on the wiki.  Interested Parties can also indicate their interest in the WG, probably by email.

We should probably amend Bylaw 5.3.1 - Formation of Chartered Working Groups to include specific procedures for how Forum Members, etc. join new WGs once they are established.


Server Certificate Working Group Charter
Upon approval of the CAB Forum by ballot, the Server Certificate Working Group (“Working Group”) is created
to perform the activities as specified in this Charter, subject to the terms and conditions of the CA/Browser
Forum Bylaws and Intellectual Property Rights (IPR) Policy, as such documents may change from time to
time. The definitions found in the Forum’s Bylaws shall apply to capitalized terms in this Charter.
SCOPE: The authorized scope of the Server Certificate Working Group shall be as follows:
1. To specify Baseline Requirements, Extended Validation Guidelines, Network and Certificate System
Security Requirements, and other acceptable practices for the issuance and management of SSL/TLS
server certificates used for authenticating servers accessible through the Internet.
2. To update such requirements and guidelines from time to time, in order to address both existing and
emerging threats to online security, including responsibility for the maintenance of and future
amendments to the current CA/Browser Forum Baseline Requirements, Extended Validation
Requirements, and Network and Certificate System Security Requirements.
3. To perform such other activities that are ancillary to the primary activities listed above.
OUT OF SCOPE: The Server Certificate Working Group will not address certificates intended to be used primarily
for code signing, S/MIME, time-stamping, VoIP, IM, or Web services. The Server Certificate Working Group will
not address the issuance, or management of certificates by enterprises that operate their own Public Key
Infrastructure for internal purposes only, and for which the Root Certificate is not distributed by any Application
Software Supplier.
Anticipated End Date: None.
Initial chairs and contacts: Chair, Kirk Hall, kirk.hall at entrustdatacard.com<mailto:kirk.hall at entrustdatacard.com>; Vice Chair, Ben Wilson,
ben.wilson at digicert.com<mailto:ben.wilson at digicert.com>; terms to run concurrently with their terms as Chair and Vice Chair of the Forum,
respectively, unless otherwise voted upon by the Working Group.
Members eligible to participate: The Working Group shall consist of two classes of voting members, the
Certificate Issuers and the Certificate Consumers. The CA Class shall consist of eligible Certificate Issuers and
Root Certificate Issuers meeting the following criteria:
(1) Certificate Issuer: The member organization operates a certification authority that has a current and
successful WebTrust for CAs audit, or ETSI TS 102042, ETSI 101456, or ETSI EN 319 411-1 audit report prepared
by a properly-qualified auditor, and that actively issues certificates to Web servers that are openly accessible
from the Internet, such certificates being treated as valid when using a browser created by a Certificate
Consumer Member. Applicants that are not actively issuing certificates but otherwise meet membership criteria
may be granted Associate Member status under Bylaw Sec. 3.1 for a period of time to be designated by the
Forum.
(2) Root Certificate Issuer: The member organization operates a certification authority that has a current
and successful WebTrust for CAs, or ETSI TS 102042, ETSI TS 101456, ETSI EN 319 411-1 audit report prepared by
a properly-qualified auditor, and that actively issues certificates to subordinate CAs that, in turn, actively issue
certificates to Web servers that are openly accessible from the Internet, such certificates being treated as valid
when using a browser created by a Certificate Consumer Member. Applicants that are not actively issuing
certificates but otherwise meet membership criteria may be granted Associate Member status under Bylaw Sec.
3.1 for a period of time to be designated by the Forum.
(3) A Certificate Consumer can participate in this Working Group if it produces a software product intended
for use by the general public for browsing the Web securely.
The Working Group shall include Interested Parties and Associate Members as defined in the Bylaws.
Voting structure: In order for a ballot to be adopted by the Working Group, two-thirds or more of the votes cast
by the Certificate Issuers must be in favor of the ballot and more than 50% of the votes cast by the Certificate
Consumers must be in favor of the ballot. At least one member of each class must vote in favor of a ballot for it
to be adopted. Quorum is the average number of Member organizations (cumulative, regardless of Class) that
have participated in the previous three Server Certificate Working Group Meetings or Teleconferences (not
counting subcommittee meetings thereof). For transition purposes, if three meetings have not yet occurred,
quorum is ten (10).
Summary of the work that the WG plans to accomplish: As specified in Scope section above.
Summary of major WG deliverables and guidelines: As specified in Scope section above.
Primary means of communication: listserv-based email, periodic calls, and face-to-face meetings.
IPR Policy: The CA/Browser Forum Intellectual Rights Policy, v. 1.3 or later, SHALL apply to all Working Group
activity.

From: Wayne Thayer [mailto:wthayer at mozilla.com]
Sent: Wednesday, June 27, 2018 10:32 AM
To: Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>>; CA/Browser Forum Public Discussion List <public at cabforum.org<mailto:public at cabforum.org>>
Subject: [EXTERNAL]Re: [cabfpub] Membership Application of Sony

The part that I find unclear is how one becomes a member of the Server Certificate WG. The charter defines membership criteria but there doesn't appear to be a process for adding members at the WG level.

On Wed, Jun 27, 2018 at 10:21 AM Kirk Hall via Public <public at cabforum.org<mailto:public at cabforum.org>> wrote:
Summary based on quotes from my original email to the list:

Original Sony question: “Can you please describe the bylaw requirement of “produces a software product, such as a browser, intended for use by the general public for relying upon certificates and is a member of a CWG”?  If we produce a hardware product which includes software which relies upon (public root) certificates, does that meet the definition of “produces a software product”?”

Dean Coclin response: “Perhaps you can help clarify by stating whether or not Sony makes the underlying software that runs in the hardware device made by Sony?”

Sony response: “Limiting the discussion to televisions (the question at-hand), they’re based on Android TV then with Sony software on top.  So, “does Sony make the software” is yes and no.  But we *do* write the software that does the cryptographic signature validation.”


Bylaws provide as follows:

(a) All Forum members must *** meet at least one of the following criteria: ***

(3) Certificate Consumer: The member organization produces a software product, such as a browser, intended for use by the general public for relying upon certificates and is a member of a CWG [Chartered Working Group, such as the new Server Certificate Working Group].

From: Ryan Sleevi [mailto:sleevi at google.com<mailto:sleevi at google.com>]
Sent: Wednesday, June 27, 2018 10:13 AM
To: Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>>; CABFPub <public at cabforum.org<mailto:public at cabforum.org>>
Subject: Re: [cabfpub] [EXTERNAL]Re: Membership Application of Sony

I'm having trouble finding a clear summary of the question from the message forwarded.

Could you helpfully re-state it?

It sounds like the question is "Can we join the Forum without joining a CWG" - but that may not be a correct understanding.
_______________________________________________
Public mailing list
Public at cabforum.org<mailto:Public at cabforum.org>
https://cabforum.org/mailman/listinfo/public
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20180627/3622966b/attachment-0003.html>