Subject: RE: Request for IESG consideration: CP/CPS Framework

From: "Fillingham, David W." <[email-masked]>
Date: Tue, 12 Nov 2002 12:39:02 -0500

Hi Paul:

As someone who has worked PKI policy interoperability issues for several
years, I will stand up in defense of RFC 2527 and its successor.  If you
enter "certificate policy" into any Internet search engine, you will find
hundreds of Certificate Policies and Practice Statements from all over the
world, from both government and industry.  Nearly all of them conform to RFC
2527.  Having Certificate Policies presented with a common structure and
format is extremely important to those of us who work in both the PKI
technical and policy interoperability realms.

RFC 2527 has been very successful in meeting its objectives of providing a
way to compare and contrast Certificate Policies and PKI implementations,
and thereby promoting interoperable PKI implementations.  I believe PKIX
should continue to support it.

Best Regards,
Dave Fillingham
US Department of Defense

 -----Original Message-----
From: 	Paul Hoffman / IMC [mailto:[email-masked]] 
Sent:	Tuesday, November 12, 2002 12:11 PM
To:	Jeffrey I. Schiller; [email-masked]
Cc:	[email-masked]
Subject:	Re: Request for IESG consideration: CP/CPS Framework

At 12:10 PM -0500 11/11/02, Jeffrey I. Schiller wrote:
>This document was discussed at the IESG and there were concerns that 
>it was a legal document and not a technical document.

Yup, just like its predecessor.

>  I don't know how to deal with the objection. It appears that the 
>people objecting don't have any solid recommendation to make to 
>change the document, they just don't like it... I will be taking 
>this up with them in person.

You can't change 2527 to not talk about legal/policy issues; that's 
what it is about. The new document is simply a revision to an 
existing RFC. It seems like some revision should be accepted, or the 
old RFC should be removed (which is not possible). That is, you're 
stuck with the previous decision to issue RFC 2527. If you have 
changed your mind about that, is it better to revise it to reflect 
current practice or to not revise it and hope no one uses the old one?

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "Alice Sturgeon" <[email-masked]>
Date: Wed, 13 Nov 2002 06:39:27 -0500

I certainly agree with Dave's comment about the widespread use of RFC 2527,
and the necessity of keeping it, and its successor.  The successor document
was developed to address some issues that have arisen over time and with the
use of 2527, to clarify, to amend slightly, to highlight the more important
provisions of 2527, and particularly to group like issues more conveniently
and more intuitively.
As one example of how the successor document updates 2527, the successor
introduces the PKI Disclosure Statement, which is becoming widely used, but
was not a part of 2527 (because it hadn't yet been conceived when 2527 was
developed).
One major concern about the revision was "backward compatibility", and
that's why one essential element of the revision is a mapping to the
previous (the current 2527).  With this in place, people can gradually move
to the new structure of the revision (successor) document, without being
concerned that their existing CP's/CPS's would suddenly become obsolete with
the approval of the successor.  That scenario would have been unacceptable,
and that's why it has been avoided, with the mapping.
The CP/CPS framework based on 2527 has become an integral and critical
element of implementing PKI and, even more importantly, of efforts towards
the interoperability of PKI implementations (and that reflects the
importance of standards in general). Adrian Pickering's comment really
reinforces this - especially the importance of the context of technical
specifications.  Note, too, that the CP/CPS framework is posited as an
informative RFC.  Whether IETF was the most appropriate body to develop 2527
is kind of an academic consideration at this point (but there wasn't another
standards body specifically in this space at that time).

Alice Sturgeon
Chair
Canadian Advisory Committee - Information Technology Security
ISO/IEC JTC1 SC 27
and
System Policy Architect
SPYRUS
Phone:     613-232-2350
Cell:         613-291-0331

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Fillingham, David W.
Sent: November 12, 2002 12:39 PM
To: 'Paul Hoffman / IMC'; Jeffrey I. Schiller; [email-masked]
Cc: [email-masked]
Subject: RE: Request for IESG consideration: CP/CPS Framework

Hi Paul:

Best Regards,
Dave Fillingham
US Department of Defense

 -----Original Message-----
From:   Paul Hoffman / IMC [mailto:[email-masked]]
Sent:   Tuesday, November 12, 2002 12:11 PM
To:     Jeffrey I. Schiller; [email-masked]
Cc:     [email-masked]
Subject:        Re: Request for IESG consideration: CP/CPS Framework

--Paul Hoffman, Director

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 20 Nov 2002 13:23:46 +0100

David,

> 2527.  

RFC 2527 is not the single document in that category.
There exists other documents like:

ESTI TS 102 042 : Policy requirements for Certification Authorities
                   issuing Public Key Certificates

ESTI TS 101 456 : Policy requirements for Certification Authorities
                   issuing Qualified Certificates.

They have a different structure. There is also work being done by ISO at 
this time by TC 68.

So RFC 2527 is not the single reference anymore.

Having said this, it would be a pity not to update RFC 2527.

Denis

 > Having Certificate Policies presented with a common structure and