Subject: Request for IESG consideration: CP/CPS Framework

From: Tim Polk <[email-masked]>
Date: Fri, 19 Apr 2002 09:54:02 -0400

Jeff & Steve,

The PKIX working group has achieved rough consensus and completed WG Last 
Call 
for 
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ipki-new-rfc2527-01.txt, 
  "Internet X.509 Public Key Infrastructure Certificate Policy and 
ertification Practices Framework".  Please consider this specification for 
submission to the IESG for advancement to RFC status.

This specification is an update to, and obsoletes, the current 
Informational Standard RFC 2527 (which has the same name). As with the 
specification it obsoletes, we believe that informational track would be 
appropriate for this specification.

Thanks,

Tim Polk

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Mon, 11 Nov 2002 12:10:57 -0500

This document was discussed at the IESG and there were concerns that it 
was a legal document and not a technical document. I don't know how to 
deal with the objection. It appears that the people objecting don't have 
any solid recommendation to make to change the document, they just don't 
like it... I will be taking this up with them in person.

			-Jeff

Tim Polk wrote:
> 
> 
> Jeff & Steve,
> 
> The PKIX working group has achieved rough consensus and completed WG 
> Last Call for 
> ertification Practices Framework".  Please consider this specification 
> for submission to the IESG for advancement to RFC status.
>

---

From: J Adrian Pickering <[email-masked]>
Date: Tue, 12 Nov 2002 14:59:52 +0000

>like it... I will be taking this up with them in person.

Having had it explained to me quite forcefully that IETF concentrates on 
*engineering* rather than legal issues, I can see the problem!

I still think that engineering decisions need to be well informed about 
their context and such documents contribute to that. I would suggest that 
IETF still welcome such contributions but refrain from directing them 
towards standards. When reading such documents one should perhaps ask 
oneself regularly, 'Does this affect how the code would be written?' and 
use the answer as a metric.

However, TSA Policies is more legal than technical and this is moving in 
the same circles, I believe?

Adrian Pickering/
University of Southampton UK

>>Call for

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 12 Nov 2002 09:10:53 -0800

At 12:10 PM -0500 11/11/02, Jeffrey I. Schiller wrote:
>This document was discussed at the IESG and there were concerns that 
>it was a legal document and not a technical document.

Yup, just like its predecessor.

>  I don't know how to deal with the objection. It appears that the 
>people objecting don't have any solid recommendation to make to 
>change the document, they just don't like it... I will be taking 
>this up with them in person.

You can't change 2527 to not talk about legal/policy issues; that's 
what it is about. The new document is simply a revision to an 
existing RFC. It seems like some revision should be accepted, or the 
old RFC should be removed (which is not possible). That is, you're 
stuck with the previous decision to issue RFC 2527. If you have 
changed your mind about that, is it better to revise it to reflect 
current practice or to not revise it and hope no one uses the old one?

--Paul Hoffman, Director
--Internet Mail Consortium