Subject: [sacm] new CA/B Forum Code Signing Baseline Requirements specification

From: Tony Rutkowski <[email-masked]>
Date: Wed, 12 Aug 2015 17:37:53 -0400

Hi Adam,

This new specification developed after considerable
work in the CA/B Forum by a number of parties seems
rather relevant to several SACM work items.  In the
information model, it is arguably rather more important
than a Unique Software Identifier, although as the
spec states, it doesn't attest as to the "software object
identifier" - which seems a better term than that
presently in the information model draft (piece of software).

Would be also great to lose one of the more broken schemes
in this business, the SWID. :-)

--tony

-------- Forwarded Message --------
Subject: 	[cabfpub] Code Signing Baseline Requirements
Date: 	Tue, 11 Aug 2015 13:31:21 -0700
From: 	Dean Coclin <[email-masked]>
To: 	CABFPub <[email-masked]>
CC: 	[email-masked] <[email-masked]>

The Code Signing Working Group of the CA/Browser Forum is pleased to 
announce the release of the final version of the Code Signing Baseline 
Requirements. The Working Group has been meeting over the last 2 years 
to develop and bring this topic to the Forum for approval.

The Working Group would like to have the Forum approve these Baseline 
Requirements by ballot which will be put forth at the next 
teleconference. Discussion will start at that time, followed by a formal 
vote.

This Working Group was chartered by the Forum at the Mozilla face to 
face meeting in February 2013 and has brought together forum members and 
outside participants to craft a document which we believe will help 
improve the security of the ecosystem. Forum members in the working 
group include: Comodo, Digicert, Entrust, ETSI, Federal PKI, 
Firmaprofessional,  Globalsign, Izenpe, Microsoft, Starcom, SwissSign, 
Symantec, Trend Micro, WoSign as well as non-members: Cacert, Intarsys, 
OTA, Richter, and Travelport.

The stated goal of the group was to: “Create a set of baseline 
requirements for code signing that will reduce the incidence of signed 
malware”. We strived to work on 3 sub goals, which are by no means 100% 
solved. However we feel that the document reflects progress towards 
these goals which were:

1.Minimize private key theft by moving toward more secure key storage 
(protection of private keys)

2.Baseline authentication and vetting procedures for all parties

3.Information sharing (notification/revocation) for fraud detection. 
This piece was moved to the Information Sharing Working Group

We ask all members to review the document and provide feedback for 
discussion to the forum. The guidelines would go into effect one year 
after forum approval.

Thanks,

Dean Coclin and Jeremy Rowley

on behalf of the

Code Signing Working Group