Subject: RE: SubjectAltName verification

From: Peter Williams <[email-masked]>
Date: Tue, 23 May 2000 12:12:39 -0700

Internet CAs are free, and must be free, to operate public-key
certification according to wholly-private practices. This includes 
acting in PKIX-non-conforming or other PKIX opt-out manners, where
(nationally-regulated) CAs and such CA's alone designate such practices 
to be appropriate to meet their interworking communities security needs. 

http://www.ietf.org/rfc/rfc2459.txt Section 2.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Tuesday, May 23, 2000 9:53 AM
To: Denis Pinkas
Cc: [email-masked]
Subject: Re: SubjectAltName verification

Denis,

>Let me extract two of your statements:
>
>(snip)
>
>  > >Also, as both Denis and I pointed out,
>  > >there are wide variations in the meaning of "verify", some of them
being
>  > >arguably very weak. Where does one draw the line between very weak
>  > >verification and no verification?
>
>  > Fair point.
>
>  > I think its important that PKIX continue to express the
>  > notion that a CA is expected to perform verification (directly or
>  > indirectly) for all attributes in a cert, leaving to the policy
>  > and/or CPS to refine the level of verification performed.
>
>(snip)
>
>  > Still, I
>  > do believe PKIX should continue to promote the notion, through our
>  > standards, that the contents of a certificate represent data that the
>  > issuer has verified and thus stands behind. To do otherwise would
>  > endorse behavior that creates confusion, a generally undesirable
>  > security characteristic.
>
>The later statement is different from the former. I like the former.
>Can we build a consensus around it ?
>
>If so, this should be reflected in the "son-of-RFC2459".

The former is more appropriate for inclusion in the revised RFC;  the 
latter statement was more of a rationale for my position.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 23 May 2000 15:29:38 -0400

Peter,

>to be appropriate to meet their interworking communities security needs.

Your message seems to cover the bases, i.e., a CA can always choose 
to be non-conforming with PKIX.

So, 'nuf said, right?

Steve

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 23 May 2000 16:12:07 -0400

ICSA and the PKI Forum is getting ready for the next round of CMP testing.

This is a virtual workshop for Jun 6 - 8.

So far, 8 vendors have indicated that they are ready for more testing then, 
and a few more are expecting to be ready then as well.

Please contact me at [email-masked] if you are developing a CMP 
implementation and wish to participate in this or one of the later workshops.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]