<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 6, 2017, at 7:44 AM, Neil Dunbar via Netsec <<a href="mailto:netsec@cabforum.org" class="">netsec@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 6 Jul 2017, at 15:23, Bruce Morton <<a href="mailto:Bruce.Morton@entrustdatacard.com" class="">Bruce.Morton@entrustdatacard.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Neil,<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">My search was wrong. I should have stated 1d, 1g, 1h, 2m and 2o<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div></div></div></blockquote><div class=""><br class=""></div>So, 2o is essentially inoperative. Perhaps a change like:</div><div class=""><br class=""></div><div class="">FROM: o. Restrict remote administration or access to an Issuing System, Certificate Management
System, or Security Support System except when:</div><div class=""><br class=""></div><div class="">TO: o. Restrict remote administration or access *to network connected devices* to an Issuing System, Certificate Management
System, or Security Support System except when:</div><div class=""><br class=""></div><div class="">(thus making it explicitly inoperative for non-networked systems).</div><div class=""><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">We had an issue with 2m where we were expected to have multi-factor authentication for an off-line root.</span></div></div></blockquote><br class=""></div><div class="">Is MFA for offline roots such a burden? I mean, password and USB connected fingerprint reader, or password and U2F device configured for HMAC-SHA1 challenge would work in an offline login. Doesn’t the actual HSM activation count as 2-factor (PIN plus key auth device)?</div><div class=""><br class=""></div><div class="">Where I’m going with all of this, since we’re in ‘low hanging fruit’ grabbing, is to ensure that the changes are as tight as possible, to avoid controversy while updating the existing NetSec doc.</div></div></div></blockquote><br class=""></div><div>What about changing 2(m) to “multi-factor or multi-party authentication”? This would allow offline systems to use HSM controls to meet the requirement. The definition of “system” is “one or more pieces of equipment”, so it is reasonable to say that a HSM attached to a computer, even if the HSM is a separate chassis, creates a single “issuing system”.</div><div><br class=""></div><div>Thanks,</div><div>Peter</div><br class=""></body></html>