Subject: PKIX notice files, and markup

From: "Peter Williams" <[email-masked]>
Date: Sun, 25 Apr 1999 13:39:15 -0500

RFC 2459 is useful for OCSP.

"The application software SHOULD display all   user notices in all
certificates
of the certification path used...]

"The user notice has two optional fields: the noticeRef field and the
explicitText field.   The noticeRef field, if used, names an organization
and
 identifies, by number, a particular textual statement prepared by      that
organization.  For example, it might identify the  organization
CertsRUs and notice number 1.

In a typical  implementation, the
application software will have a notice file  containing the current set of
notices for CertsRUs; the application will extract the notice text from the
file and display  it.  Messages may be multilingual, allowing the software
to select  the particular language message for its own environment."

Is it fair to say, that PKIX does not prescribe any approach for
compliant implementations to handle the selection of texts from, or the
technology for displaying material from, a notice file?

Presumably, in today's consumer-environment, the notice file can be in
markup,
if the extension-using application understands markup, to allow
notice-writing
parties to underline, embolden, etc, use the full range of chars and
symbols,
have accept buttons, follow URLs, have internal links for Table of
Contents, etc., etc.

Do Netscape or Microsoft browsers already support this feature, perhaps,
as markup-oriented or simple text rendering cert-applications?

I'm thinking of reusing this extension for certs in an OCSP response
extension
so that the same policy enforcement and notice-delivery
framework can be applied to value-added OCSP-based
validation and revocation/suspension/hold status services.

The approach can be used also for DCS.

Peter.

---

From: Russ Housley <[email-masked]>
Date: Thu, 25 Mar 1999 19:23:43 -0500

Peter:

The ASN.1 types limit some choices, although DisplayText provides alot of
flexibility.

Russ

   certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation

   PolicyInformation ::= SEQUENCE {
        policyIdentifier   CertPolicyId,
        policyQualifiers   SEQUENCE SIZE (1..MAX) OF
                                PolicyQualifierInfo OPTIONAL }

   CertPolicyId ::= OBJECT IDENTIFIER

   PolicyQualifierInfo ::= SEQUENCE {
        policyQualifierId  PolicyQualifierId,
        qualifier          ANY DEFINED BY policyQualifierId }

   -- policyQualifierIds for Internet policy qualifiers

   id-qt          OBJECT IDENTIFIER ::=  { id-pkix 2 }
   id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
   id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }

   PolicyQualifierId ::=
        OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )

   Qualifier ::= CHOICE {
        cPSuri           CPSuri,
        userNotice       UserNotice }

   CPSuri ::= IA5String

   UserNotice ::= SEQUENCE {
        noticeRef        NoticeReference OPTIONAL,
        explicitText     DisplayText OPTIONAL}

   NoticeReference ::= SEQUENCE {
        organization     DisplayText,
        noticeNumbers    SEQUENCE OF INTEGER }

   DisplayText ::= CHOICE {
        visibleString    VisibleString  (SIZE (1..200)),
        bmpString        BMPString      (SIZE (1..200)),
        utf8String       UTF8String     (SIZE (1..200)) }