Subject: RE: Open issue: DPV additional information

From: Hal Lockhart <[email-masked]>
Date: Wed, 17 Apr 2002 13:22:52 -0400

As entertaining as it is to watch you guys talk past each other, this thread
is getting tiresome. Let me take a crack at why I don't think there is any
real disagreement here.

I think what Denis is saying is that if an entity is a CA, by definition
they are trusted to issue and revoke the certificates they issue, by virture
of being a CA. They can also delegate someone else to do the revocation,
also by virtue of being a CA. If a RP decides to trust their certs, they
must also trust their revocation arrangements.

In contrast, when somebody sets up a DPV server, whether or not they also
run a CA, there is an independant decision to trust the DPV server. It does
not follow as an automatic consequence of the fact thet the same
organization (or key even) may have issued one or more of the certs in the
chain in question.

In other words, a CA may run a DPV server, but the server will be trusted
because RPs choose to do so, not because they have previously chosen to
trust certs issued by the CA.

Everybody agree? ;-)

Hal

> -----Original Message-----
> From: Michael Myers [mailto:[email-masked]]
> Sent: Wednesday, April 17, 2002 11:22 AM
> To: Denis Pinkas; [email-masked]
> Cc: pkix
> Subject: RE: Open issue: DPV additional information
> 
> 
> 
> Denis,
> 
> It is precisely that issue of responsibility, in a broader
> sense.  I'm quite certain that organizational entities who
> create, issue and maintain the reliability of public key
> certificates will will be the first to claim jursidiction
> regarding their validity. Who is going to claim otherwise?
> 
> Mike
> 
> 
> > -----Original Message-----
> > From: Denis Pinkas [mailto:[email-masked]]
> > Sent: Wednesday, April 17, 2002 8:02 AM
> > > Extract from the road map document:
> >
> > Certification Authority (CA) - An authority
> > trusted by one or more users to create and assign
> > public key certificates. Optionally the CA may
> > create the user's keys. It is important to
> > note that the CA is responsible for the public key
>                       ^^^^^^^^^^^^^^^
> > certificates during their whole lifetime, not just
> > for issuing them.
>

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 17 Apr 2002 11:08:44 -0700

Hal,

This works for me.  Thanks for stepping in.

Mike

-----Original Message-----
From: Hal Lockhart [mailto:[email-masked]]
Sent: Wednesday, April 17, 2002 10:23 AM
To: 'Michael Myers'; Denis Pinkas; [email-masked]
Cc: pkix
Subject: RE: Open issue: DPV additional information

As entertaining as it is to watch you guys talk past each other,
this thread is getting tiresome. Let me take a crack at why I
don't think there is any real disagreement here.
I think what Denis is saying is that if an entity is a CA, by
definition they are trusted to issue and revoke the certificates
they issue, by virture of being a CA. They can also delegate
someone else to do the revocation, also by virtue of being a CA.
If a RP decides to trust their certs, they must also trust their
revocation arrangements.
In contrast, when somebody sets up a DPV server, whether or not
they also run a CA, there is an independant decision to trust
the DPV server. It does not follow as an automatic consequence
of the fact thet the same organization (or key even) may have
issued one or more of the certs in the chain in question.
In other words, a CA may run a DPV server, but the server will
be trusted because RPs choose to do so, not because they have
previously chosen to trust certs issued by the CA.
Everybody agree? ;-)
Hal

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 25 Apr 2002 15:11:16 +0200

Hal,

> Hal Lockhart a écrit :
> 
> As entertaining as it is to watch you guys talk past each other, this
> thread is getting tiresome. Let me take a crack at why I don't think there
> is any real disagreement here.
> 
> they are trusted to issue and revoke the certificates they issue, by
> virture of being a CA. They can also delegate someone else to do the
> revocation, also by virtue of being a CA. If a RP decides to trust their
> certs, they must also trust their revocation arrangements.
> 
> run a CA, there is an independant decision to trust the DPV server. It
> does not follow as an automatic consequence of the fact thet the same
 
> Everybody agree? ;-)

In other words, an organisation supporting a CA may also run a DPV server,
but the DPV server will be trusted because RPs choose to do so, not because
RPS have previously chosen to trust certs issued by the CA hosted by the
same organization.

Denis