Subject: RE: Request for IESG consideration: CP/CPS Framework

From: Roger Younglove <[email-masked]>
Date: Fri, 22 Nov 2002 08:17:45 -0500

Marc,
You are correct in that the CPS is required for auditing of a CA
installation. It is some times published in a diminished form not ever
fully. The only people that should be concerned with the CP are the relying
parties and any other CA wishing to cross certify.

Roger Younglove, CISSP
Principal Consultant
NetWorks Group
O. 810.225.4800 ex. 2245
M. 810.599.0879
E. [email-masked]
www.networksgroup.com

-----Original Message-----
From: Marc Poulaud [mailto:[email-masked]] 
Sent: Friday, November 22, 2002 4:19 AM
To: [email-masked]
Subject: RE: Request for IESG consideration: CP/CPS Framework

David,

I agree with most of your points here. There has been much confusion over
the purpose and applicability of a CP and CPS. Even in my experience of
the banking sector/scheme space. One additional way of looking at the
difference is the CP specifies the 'what' and the CPS specifies the 'how',
and as such I think having the 2527 framework makes sense from this
perspective (although having had to write these pairs, it's not as easy as
it sounds) and I'm not convinced of the value.

Also, from my banking scheme experience, the CPS is confidential but
includes the subscribing customer, but not the relying customer. A fairly
light and common CP across both parties essentially points to a Customer
Agreement that takes into account a common set of contractual agreement
clauses. This is what binds the parties together from a legal perspective
and hence the level of trust.

In the real world, does anybody really check or care what is in a CP or
the CPS? I think it depends on the circumstances and the scheme around
this.

From my point of view, a CPS is generally a good-practice as it focuses
the CA provider and auditors minds. A CP is good because it can point to a
legal/contractual framework.

Also to consider are signature policies - shirely any framework/changes
should take into account of these too.

Marc.
-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Adrian McCullagh
Sent: 22 November 2002 05:58
To: Fillingham, David W.
Cc: 'Adrian McCullagh'; [email-masked]; [email-masked]; Jeffrey
I. Schiller; [email-masked]; 'Paul Hoffman / IMC';
[email-masked]
Subject: RE: Request for IESG consideration: CP/CPS Framework

Dear David,

If one looks at the raison d'etre for a CPS it is very different to that
of
the CP.

It is my understanding, and I am open to any correction, that a CPS is a
document that details the practices and procedures established by a CA
that
will cover the life-cycle of certificates issued by the CA.  That is it
covers how the certificate will be generated, suspended and revoked.  An
internally focused document covering the internal environment of the CA.
Much like an operations manual for a CA business as they relate to
certificates.

The CP is a very different document which will usually be relied upon by
the relying party and to a certain extent the subscriber.  RFC 2527 states
:

'According to X.509, a certificate policy (CP) is "a named
set of rules that indicates the applicability of a certificate to a
particular community and/or class of applications with common
security requirements."
A CP may be used by a relying party to help
in deciding whether a certificate, and the binding therein, are
sufficiently trustworthy and otherwise appropriate for a particular
application.'

Hence my query as to the applicability of RFC 2527 to the CP.  RFC 2527
concentrates of the internal practices of the CA, which is really the
function of a CPS.  I believe that a separate RFC should be established
that specifically covers the rules that govern the use of a certificate by
a relying party.  This RFC should be much more concise than RFC 2527.
Hence my comment that I believe RFC 2527 to be inappropriate for a CP and
thus overly complex.

It is interesting that the Banking sector has taken the view that a CPS is
an internal document, which I have no problem with, and therefore will not
be published.  A CP on the other hand does need to be published otherwise
the relying party will not be in a position to ascertain/determine any
trust value for the transaction as it relates to the digital signature for
verification.

Dr. Adrian McCullagh Ph. D.
Solicitor/lawyer
Freehills, Australia

Direct 61 7 3258 6603
Telephone 61 7 3258 6666
Facsimile 61 7 3258 6444
http://www.freehills.com

--------------------------------------------------------------------
FREEHILLS
This email is confidential.  If you are not the intended  recipient,
you must not disclose  or  use the  information  contained in it. If
you have received this email in error,  please notify us immediately
by return email and delete the document.
Freehills is not responsible for any changes made to a document other
than those made by Freehills or for the effect of the changes on the
document's meaning.

Liability is limited by the Solicitors' Limitation of Liability Scheme,
approved under the Professional Standards Act 1994 (NSW)
--------------------------------------------------------------------