Subject: Re: Re: Certificate Policy vs Certification Practice .. where are the boundaries? ... what belongs where?

From: "Winchel 'Todd' Vincent, III" <[email-masked]>
Date: Tue, 23 Nov 1999 16:08:31 -0500

> A certificate's conditions of use can be bound to the authority public key
> with which it is verified in the mechanism used to distribute that
authority
> public key, perhaps using XML, as Todd suggests.  With a standard Document
> Type Definition and associated style sheet, one can render the conditions
of
> use for the authority's certificates in a way that is readily understood
by
> potential relying parties.  This approach is also consistent with the
> Santesson/Baum notion of a PKI Disclosure Statement.

Wow!!!

I've found a soulmate!!

110% agreement.

Stated a bit differently, stylesheets can hide or extract particular
portions of a larger "smart" document (e.g., CP or CPS coded in XML) and
distribute only relevant portions, in context, to the person who is
interested in the information . . . a smaller subset of information might be
a subscriber agreement, a relying party agreement, a PKI disclosure
statement, a consumer notice, an auditor's checklist . . . just about
anything you want provided the information is continued in the larger
document (or even documents).

XML can also be parsed into databases (if this is the method of choice) so
that like provisions of different CPs or CPSs can be compared . . .which is
*not* a way of using artificial intelligence to map policies (i.e., nobody
get scared, we're not trying to replace lawyers and consultants), but is
merely a way of using an information management tool to avoid having to wade
through a lot of paper and/or "dumb" electronic documents.

Todd