Subject: Update of RFC 2527 - opposed

From: "Hicks, Mack" <[email-masked]>
Date: Wed, 20 Nov 2002 13:10:12 -0800

I have not posted on this list for some time, lurking has been fun though. I
will say something that some might consider radical.

I thought you might like to know how some of the business world is looking
at RFC 2527 and its impact on the PKI business.

RFC 2527 is being used as a template and checklist by auditors and
associations to perform reviews on certificate authorities. Each entry and
topic of RFC 2527 must be covered by the CA or one gets an "audit exception"
or operations questions. This is done as a rote exercise.  Back when CAs
were new, the checklist made sense - now some of the questions and sections
is RFC 2527 are not as relevant to all CAs.

I know of no use of the certificate policy in a business application; the
policy is only there to tell any relying party that they should have a
contract with someone before trusting this certificate. The meaning, impact,
legality, effectiveness, application, etc. of a certificate is addressed in
contract (and subject to contract law - as I understand it). There is no
detailed policy in the CP anymore.

The practice among most banks I talk to is that the certificate practice
statement (CPS) is an internal document about the operation of the CA and
related software (OCSP, CRL, LDAP); the CPS is not made public. Therefore
the original goal of automated or assisted examination of a CP and CPS by a
relying party is thwarted. (I supported the automation goal, but it is not
achievable.)

It is useful that a certificate has a reference to a policy - but the
construction and content of that policy is no longer relevant in the
businesses that I see.  There is no use to a CPS except as an internal
checklist on CA construction and operation and acts as a mill stone around
the neck of CA operators - a barrier to entry into PKI.  Therefore RFC 2527
is purely informational to constructing a CA; I would prefer that it move
toward elimination as standard.

Mack Hicks, SVP  
Bank of America  760-318-9345

---

From: "Jean Pawluk" <[email-masked]>
Date: Wed, 20 Nov 2002 18:41:49 -0600

I concur - if this information isn't spelled out in a contract then it is
not enforceable.

The checklists are useful however is the mandatory use or automation of the
cps reasonable?

I really don't think so, it would become a burden to other business besides
banking and it doesn't
add to the final usefulness of any PKI enabled applications as a mandatory
requirement

Regards (another lurker in the mist)
Jean

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Hicks, Mack
Sent: Wednesday, November 20, 2002 3:10 PM
To: [email-masked]
Subject: Update of RFC 2527 - opposed

Mack Hicks, SVP

---

From: Andreas Mitrakas <[email-masked]>
Date: Thu, 21 Nov 2002 09:59:51 +0100

Policy format might not  necessarily matter except for automated checks. The
important thing is to be able to convey that information to relying parties.
Some CAs just hire auditors so that they keep their policies secret while they
disclose the auditor's report.

Format does not have to be mandated but a certificate needs a reference to a
policy and that the content requirements of such policy better be agreed upon
beforehand. May be RFC 2527 can focus more on end user certificates and
applications as it is still too abstract for end users.  I guess we are far from
over in this area.

andreas mitrakas
Ubizen