[cabfpub] Ballot 158: Adopt Code Signing Baseline Requirements
Moudrick M. Dadashov
md at ssc.lt
Tue Dec 15 16:53:03 MST 2015
The activity only partly covers the "security interest for Internet
transactions" and has no impact on "creating a more intuitive method of
displaying secure sites to Internet users".
While quite supportive for such an activity, we believe the Code signing
standardization efforts should be harmonized with the existing
electronic signature standards development.
Thanks,
M.D.
On 16-Dec-15 1:27 AM, Jeremy Rowley wrote:
>
> I fail to see how the Code Signing guidelines fail to fit the purpose
> as defined. Signed code is a heightened security interest for
> Internet transactions as signed code is deployed via the Internet and
> assists in the prevention of malware. Are you objecting because of
> the “and creating a more intuitive method of displaying secure sites
> to Internet users”?
>
> Jeremy
>
> *From:*public-bounces at cabforum.org
> [mailto:public-bounces at cabforum.org] *On Behalf Of *Moudrick M. Dadashov
> *Sent:* Tuesday, December 15, 2015 4:25 PM
> *To:* Dean Coclin; CABFPub
> *Subject:* Re: [cabfpub] Ballot 158: Adopt Code Signing Baseline
> Requirements
>
> SSC votes: "No".
>
> In our opinion Code signing is an electronic signature application/use
> case which has already been regulated by eIDAS and underlying ETSI
> standards.
>
> We also assume that any WG activity should be within the "Purpose of
> the Forum". Just a short reminder from our Bylaws:
>
> 1.1 Purpose of the Forum:
> The Certification Authority Browser Forum (CA/Browser Forum) is a
> voluntary gathering of leading certification authorities (CAs) and
> vendors of Internet browser software and other applications.
>
> Members of the CA/Browser Forum have worked closely together in
> defining the guidelines and means of implementation for best practices
> as a way of providing a heightened security for Internet transactions
> and creating a more intuitive method of displaying secure sites to
> Internet users.
>
>
> Thanks,
> M.D.
>
> On 03-Dec-15 11:04 PM, Dean Coclin wrote:
>
> After a 2 week pre-ballot, the Code Signing Working Group has now
> prepared the formal ballot below:
>
> _Ballot 158: Adopt Code Signing Baseline Requirements_
>
> The following motion is proposed by the Code Signing Working Group
> and is endorsed by Microsoft, Trend Micro and OATI. Further
> information on the ballot is in the email message below.
>
> *- - - - Motion for Ballot 158 - - - -*
>
> Be it resolved that the CA / Browser Forum adopts the
> recommendation of the Code Signing Working Group for Version 1.0
> of the Baseline Requirements for Code Signing. Once adopted, the
> effective date will be October 1, 2016.
>
> *- - - - Motion Ends - - - -*
>
> The review period for this ballot shall commence at 2200 UTC on 3
> Dec 2015, and will close at 2200 UTC on 10 Dec 2015. Unless the
> motion is withdrawn during the review period, the voting period
> will start immediately thereafter and will close at 2200 UTC on 17
> Dec 2015. Votes must be cast by posting an on-list reply to this
> thread.
>
> A vote in favor of the motion must indicate a clear 'yes' in the
> response. A vote against must indicate a clear 'no' in the
> response. A vote to abstain must indicate a clear 'abstain' in the
> response. Unclear responses will not be counted. The latest vote
> received from any representative of a voting member before the
> close of the voting period will be counted. Voting members are
> listed here:
>
> https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the
> votes cast by members in the CA category and greater than 50% of
> the votes cast by members in the browser category must be in
> favor. Quorum is currently nine (9) members– at least nine members
> must participate in the ballot, either by voting in favor, voting
> against, or abstaining.
>
> Dean Coclin and Jeremy Rowley
>
> Code Signing Working Group co-chairs
>
> *From:*public-bounces at cabforum.org
> <mailto:public-bounces at cabforum.org>[mailto:public-bounces at cabforum.org]
> *On Behalf Of *Dean Coclin
> *Sent:* Thursday, November 19, 2015 2:01 PM
> *To:* CABFPub
> *Subject:* [cabfpub] Pre-Ballot: Code Signing Baseline Requirements
>
> The Code Signing Working Group of the CA/Browser Forum has
> completed its work on Version 1 of the Code Signing Baseline
> Requirements. The Working Group has been meeting over the last 2+
> years to develop and bring this topic to the Forum for approval.
>
> This Working Group was chartered by the Forum at the Mozilla face
> to face meeting in February 2013 and has brought together forum
> members and outside participants to craft a document which we
> believe will help improve the security of the ecosystem. Forum
> members in the working group include: Comodo, Digicert, Entrust,
> ETSI, Federal PKI, Firmaprofessional, Globalsign, Izenpe,
> Microsoft, Startcom, SwissSign, Symantec, Trend Micro, WoSign as
> well as non-members: Cacert, Intarsys, OTA, Richter, and
> Travelport. Also, there have been several public commenting
> periods which resulted in changes and revisions to the document.
>
> The stated goal of the group was to: “Create a set of baseline
> requirements for code signing that will reduce the incidence of
> signed malware”. We strived to work on 3 sub goals, which are by
> no means 100% solved. However we feel that the document reflects
> progress towards these goals which were:
>
> 1.Minimize private key theft by moving toward more secure key
> storage (protection of private keys)
>
> 2.Baseline authentication and vetting procedures for all parties
>
> 3.Information sharing (notification/revocation) for fraud
> detection. This piece was moved to the Information Sharing Working
> Group
>
> _The document is now final and no further changes are being
> accepted_. Comments and suggestions will be accumulated for a
> future version of the document.
>
> The group is seeking 2 endorsers for the ballot below:
>
> *- - - - Motion for Ballot XXX - - - -*
>
> Be it resolved that the CA / Browser Forum adopts the
> recommendation of the Code Signing Working Group for Version 1.0
> of the Baseline Requirements for Code Signing. Once adopted the
> effective date will be October 1, 2016.
>
> *- - - - Motion Ends - - - -*
>
> The review period for this ballot shall commence at 2200 UTC on 3
> Dec 2015, and will close at 2200 UTC on 10 Dec 2015. Unless the
> motion is withdrawn during the review period, the voting period
> will start immediately thereafter and will close at 2200 UTC on 17
> Dec 2015. Votes must be cast by posting an on-list reply to this
> thread.
>
> A vote in favor of the motion must indicate a clear 'yes' in the
> response. A vote against must indicate a clear 'no' in the
> response. A vote to abstain must indicate a clear 'abstain' in the
> response. Unclear responses will not be counted. The latest vote
> received from any representative of a voting member before the
> close of the voting period will be counted. Voting members are
> listed here:
>
> https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the
> votes cast by members in the CA category and greater than 50% of
> the votes cast by members in the browser category must be in
> favor. Quorum is currently nine (9) members– at least nine members
> must participate in the ballot, either by voting in favor, voting
> against, or abstaining.
>
>
>
>
> _______________________________________________
>
> Public mailing list
>
> Public at cabforum.org <mailto:Public at cabforum.org>
>
> https://cabforum.org/mailman/listinfo/public
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/public/attachments/20151216/2b1857da/attachment-0001.html
More information about the Public
mailing list