Subject: Model PKI Disclosure Statement (PDS)

From: Stefan Santesson <[email-masked]>
Date: Wed, 10 Nov 1999 20:08:45 -0500

All,

A first preliminary draft of the model PKI disclosure statement (PDS), as
presented during the Washington PKIX session, is now available.

The document can be downloaded from: 
http://www.accurata.se/pds/dok/draft-ietf-xxx-pds-00_prel.txt

It should be noted that this document has ben developed in cooperation with
members of the ICC (International Chamber of Commerce) and ABA (American Bar
Association).

The purpose of posting this document to the list is to obtain comments and to
determine if this should be adopted as a PKIX work item.

/Stefan

---

From: Ed Gerck <[email-masked]>
Date: Wed, 10 Nov 1999 20:33:29 -0800

Stefan:

Redundancy in information is usually a source of collision and also
invites different interpretations. So, I am not convinced that the PDS is
as useful as it proposes to be, by its own arguments, and it may make
matters worse -- in case of a collision, what is authoritative? The PDS or the
CPS?  If the CPS (as it should be) then there is no reason to even read the
PDS -- so, I see that confusion and user's workload would *increase* with
the PDS, not decrease.

My second comment is that the draft does not seem neutral. Besides its stated
purpose (to be inserted as a particular initiative by ICC, "ETERMS"),
it declares: "anticipated to often include a reference to the ICC's
arbitration services".  So, this RFC looks like (though it may not be, but
please recall Caesar's comment about his wife) a placeholder for a particular
commercial initiative for selling arbitration services by a particular company
(the ICC).  This may also explain the rather terse format proposed for the
PDS, which seems to conform to a template with standard fields like "refund
policy", for example. And, why would a CA offer a "refund policy"? This is
more an exception than the norm -- I know no relevant case, BTW.

My third comment is a question: What ICC? Nowhere the RFC identifies
what is "International Chamber of Commerce (ICC)", which however it cites
twice.   There  are many  "International Chamber of Commerce" (usually,
one in *each* country and under that country's sovereignity) and there is
also an "Internet Chamber of Commerce" at icc.org.  Which one is meant?
Which one is interested in this RFC and has worked with its drafters?

In summary, I see no reason to have a PDS in potential conflict with
a CPS and introducing further agents and indirections into what was
initially (yes, let us recalll this too) a *binary* dialogue between sender
and receiver.

Here, Marx Brothers fans will recall the scene in "A Day at the Races"
in which Groucho, intending to put his money on Sun-up, is induced
instead to buy a coded tip from Chico and is able to establish the
identity of the horse only, at some cost in terms of time and money, by
successive purchases from Chico of the code book, the master code book,
the breeders' guide and various other works of reference, by the end of
which the race is over, Sun-up having won.

Cheers,

Ed Gerck

---

From: Farrukh Ahmad <[email-masked]>
Date: Fri, 12 Nov 1999 13:18:15 -0000

There definitely is confusion about the whole of the CP/CPS issue and how it
fits with other legal instruments. Will the PDS have any legal bearing - and
will it be a replacement for T&Cs in an open PKI where such things may not
exist?

Farrukh 

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]]
Sent: 11 November 1999 01:09
To: [email-masked]
Subject: Model PKI Disclosure Statement (PDS)

All,

The purpose of posting this document to the list is to obtain comments and
to
determine if this should be adopted as a PKIX work item.

/Stefan