Subject: Standardization of certificate classes

From: Mike Jenkins <[email-masked]>
Date: Thu, 18 May 2000 12:02:52 -0400

Standardizing levels-of-assurance for broad-based certificate
application (i.e., in the Internet-wide context) gives me the
heebie-jeebies. My mantra wrt CPs and CPSs (as editor of the US DOD CP)
has always been that a CP is a statement of the minimum requirements of
the certificate-using community; a CPS is a statement of what a
certificate-issuer (CA, RA, LRA, etc.)  actually does. Some certificate
vendors publish CP/CPSs; in this case, the vendor is suggesting to what
uses you might want to put the certificate, which might be useful to the
masses who don't have a system accreditor to tell them. Standardization
within industries is inevitable; it is just as inevitable that these
standards will be wildly different from industry to industry.

In my model, if the certificate-using community wants all certificate
contents to be checked, it should say so in its CP. Any CA who checks in
the desired manner (other reqts notwithstanding) fits the bill. Note
that this does not require exposure of the CA's CPS (which some CAs seem
to want), since the relying party can find what it wants to know in the
CP (to the extent that any relying party will read anything, an issue
that has been discussed before, etc.)

I really doubt that this is a PKIX issue.

Mike Jenkins