Subject: RE: Logotypes in certificates

From: Stefan Santesson <[email-masked]>
Date: Mon, 02 Apr 2001 23:28:03 +0200

Steve,

I have problem to find the time to compile the input you ask for.

I think though that enough persons, where many of those actually represent 
significant market players in PKI, has spoken in favour of including 
logotypes in certificates in some form.

I would further regard Bob Junemans very relevant input as yet another very 
good reason for this.

So to me the question is more HOW instead of IF or WHY. Everybody doesn't 
have to need or want a feature in order to motivate its support in 
standards. What is important though is that there is a consensus that the 
choosen solution doesn't break the systems for those who doesn't need or 
want to use it.

I agree with those who consider inclusion of logotypes in policy qualifiers 
as a primitive hack, but I also see the good sides of this and right now I 
agree with Russ that this is probably the best way to do it in order to 
avoid the problems you address.

If policy qualifiers would be deprecated, then I'm open for suggestions. I 
don't care that much about HOW as long as this important need gets addressed.

/Stefan

At 10:11 2001-03-23 -0500, Stephen Kent wrote:
>Stefan,
>
>>Steve,
>>
>>There was a suggestion during a dinner yesterday that logotypes actually 
>>could be provided as a policy qualifier. That would actually solve your 
>>problem since you could directly tie acceptance of logotypes in 
>>certificates to a particular policy.
>>
>>This enables you to control the path validation problem with the use of 
>>policy constraints.
>
>I'd be comfortable with that approach, except that we have discouraged use 
>of policy qualifiers, as Russ noted.
>
>Let me suggest again that you send another message that includes a 
>comprehensive rationale for inclusion of logotypes, indicating what types 
>of certs would be allowed to contain them, what reference form you 
>envision, and what controls you think should be employed to prevent the 
>sorts of misuse I warned about.  With a concrete proposal, and well 
>articulated rationale on the table, I think we have a better chance of 
>making progress.
>
>Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 3 Apr 2001 10:43:13 -0400

Stefan,

>I think though that enough persons, where many of those actually 
>represent significant market players in PKI, has spoken in favour of 
>including logotypes in certificates in some form.

In the IETF we make decisions based on technical inputs from 
individuals, not endorsements from company representatives, so the 
motivation you cite here is not persuasive. Also, several folks other 
than I have pointed out potential vulnerabilities of logotype use. I 
think it fair to say that there are pluses and minuses here.

>I would further regard Bob Junemans very relevant input as yet 
>another very good reason for this.

Bob made an argument for the acceptability of the logotype notion 
based on presumed legal redress against a public (TTP) CA. The 
concerns I and others have raised assume a rogue CA  below that 
level. Also, the IETF, in making standards, tends to prefer security 
mechanisms that are proactive and that do not rely on the legal 
system for redress.

>So to me the question is more HOW instead of IF or WHY. Everybody 
>doesn't have to need or want a feature in order to motivate its 
>support in standards. What is important though is that there is a 
>consensus that the choosen solution doesn't break the systems for 
>those who doesn't need or want to use it.

I learned long ago that it's often a bad idea to agree to a concept 
irrespective of a proposed means of achieving it. So, absent a 
concrete proposal for HOW, I don't think we have consensus on WHETHER 
to pursue this work item.  That's why I proposed that you, as the 
prime mover behind the idea, develop a comprehensive proposal for 
what you are trying to achieve and how you propose to achieve it. if 
you can't find the time to do that, then we will not pursue it.

Steve

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 3 Apr 2001 18:00:57 +0200

> logotypes in certificates in some form.

Stefan, welcome to the club!  I.e. the club of mentally disturbed engineers like me
who actually think that market aspects should influence standards!

In the same way as I insist that son-of-2459 should officially support e-mail addresses in the subject
field (which all major CA players use),  you will get nowhere with this issue.  Try PKI-forum.

Anders

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 04 Apr 2001 22:33:35 +0200

Steve,

At 10:43 2001-04-03 -0400, Stephen Kent wrote:
>irrespective of a proposed means of achieving it. So, absent a concrete 
>proposal for HOW, I don't think we have consensus on WHETHER to pursue 
>this work item.  That's why I proposed that you, as the prime mover behind 
>the idea, develop a comprehensive proposal for what you are trying to 
>achieve and how you propose to achieve it. if you can't find the time to 
>do that, then we will not pursue it.

Well I will do my homework, including investigating other ways and foras to 
pursue this. If there is enough interest and consensus and if there is a 
general understanding that PKIX is the right place, then I will make sure 
that the material you ask for will be presented to the list.

/Stefan