Code Signing and Time Stamping about policies HOT 5 CLOSED

I would like to recommend that the USPKI not issue code signing certificates and instead focus efforts on centralizing and automating the process of code signing.

The issuance of code signing certificates is sufficiently different, I imagine relatively rare, and places the USPKI in a position to sign kernel mode drivers (as an example) for hosts across the globe. Moreover, these certificates would not be covered by Certificate Transparency (at least in a meaningful way).

Centralizing code signing, ensuring code that is signed is done so utilizing good key management, antivirus checking and by authorized people would be a much better focus for the group to spend its efforts on.

I do think time stamping is something the USPKI should do.

from policies.

Agreements:

• Code signing needs addressed outside of this effort and CP / CPS and PKI hierarchy

from policies.

DoD has NOT agreed to do this at this point - I do not care myself - but NSA I4 has serious concerns.

from policies.

Code signing will require adopting the Code Signing Baseline Requirements and another root if the subordinate CAs are not technically constrained.

from policies.

This was something @rmhrisk kindly discussed with us at the F2F as well, and it was a persuasive argument.

However, we have not had a chance since the F2F to circle back with @twbaldridge and others. Let's queue this up for our weekly call to discuss.

from policies.