Subject: RE: Update of RFC 2527 - opposed

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Fri, 22 Nov 2002 05:20:14 -0500

I strongly agree with Ann and separate comments made by Dave Fillingham.  At
Johnson & Johnson we have both a CP and a CPS to 2527, and intend to use
those not only internally (as we are already doing for our PKI which is
built and run internally) but also, when the time comes, to interoperate
externally.  Trying to negotiate external interoperability without a CP/CPS
to a common standard would be very cumbersome at best and is unlikely to be
satisfying.  I fully agree that any external interoperability will require a
contract; but the trick will be negotiating that contract and deciding what
to include in it.  One might wind up with a contract that looks like a CP -
in which case, why not start with the CP and include it as an addendum to
the contract?  In essence, the CP to 2527 becomes standard boilerplate for a
contract where you wish to have someone else accept your certificates.  Also
note that under a confidentiality agreement, I would expect to have to
expose the CPS as well to the party with whom we wish to contract - to give
them assurance that we are indeed running our PKI as our CP prescribes.

But even if we were never to interoperate (i.e., never ask anyone else to
accept our certificates, or seek to accept others' certificates ourselves),
the CP and CPS provide a comprehensive framework for running a PKI and are
invaluable for that purpose alone.  I do not accept the argument that what
an unknowledgeable auditor may or may not do should dictate what is
appropriate, we should proceed to do what is sensible and then defend that
and, where necessary, educate the auditor to understand and appreciate that.
Relationships with auditors should be at arms length - they do not have to
be adversarial.  My 1 1/2 cents worth.

Richard A. Guida
Director, Information Security (Medical Devices and Diagnostics)

Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933

E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Terwilliger, Ann [mailto:[email-masked]]
Sent: Wednesday, November 20, 2002 6:50 PM
To: [email-masked]
Subject: RE: Update of RFC 2527 - opposed

Another country is heard from......

Like Mack, I do not believe that automated review of a CP or CPS is
practical (even though it might be desirable).  I also agree that in many,
if not most, instances the CPS will not be made public.  However, I have to
disagree with his conclusion that RFC 2527 is not relevant.

RFC 2527 does provide a checklist for what areas need to be covered in
establishing and operating a CA.  The fact that some of the questions are
not as relevant today as they might have been when it was first drafted only
reinforces the fact that it should be updated to reflect current conditions.
There are other standards that address CA operation (e.g., X9.79, WebTrust
Audit for CA, the ABA document) but virtually all reference RFC 2527. 

I would like to believe that all CA operators are knowledgeable about PKI
and adhere to best practices for operating their CA.  However, that is a
fairy tale--something on a par with the tooth fairy--and there needs to be
some process to ensure that the CA has established good security practices
and follows them.  Hence audits become necessary.    

Audits by their very nature are comparing something against a checklist or
standard.  Auditors who are familiar with PKI are capable of adhering to the
spirit of the standard rather than the exact letter if parts of a standard
do not apply.  Unfortunately auditors who are not familiar with PKI may
perform audits more or less by rote.  To me this makes it more important,
not less so, that we continue to update RFC 2527.  

-----Original Message-----
From: Hicks, Mack [mailto:[email-masked]]
Sent: Wednesday, November 20, 2002 1:10 PM
To: [email-masked]
Subject: Update of RFC 2527 - opposed

I have not posted on this list for some time, lurking has been fun though. I
will say something that some might consider radical.

I thought you might like to know how some of the business world is looking
at RFC 2527 and its impact on the PKI business.

RFC 2527 is being used as a template and checklist by auditors and
associations to perform reviews on certificate authorities. Each entry and
topic of RFC 2527 must be covered by the CA or one gets an "audit exception"
or operations questions. This is done as a rote exercise.  Back when CAs
were new, the checklist made sense - now some of the questions and sections
is RFC 2527 are not as relevant to all CAs.

I know of no use of the certificate policy in a business application; the
policy is only there to tell any relying party that they should have a
contract with someone before trusting this certificate. The meaning, impact,
legality, effectiveness, application, etc. of a certificate is addressed in
contract (and subject to contract law - as I understand it). There is no
detailed policy in the CP anymore.

The practice among most banks I talk to is that the certificate practice
statement (CPS) is an internal document about the operation of the CA and
related software (OCSP, CRL, LDAP); the CPS is not made public. Therefore
the original goal of automated or assisted examination of a CP and CPS by a
relying party is thwarted. (I supported the automation goal, but it is not
achievable.)

It is useful that a certificate has a reference to a policy - but the
construction and content of that policy is no longer relevant in the
businesses that I see.  There is no use to a CPS except as an internal
checklist on CA construction and operation and acts as a mill stone around
the neck of CA operators - a barrier to entry into PKI.  Therefore RFC 2527
is purely informational to constructing a CA; I would prefer that it move
toward elimination as standard.

Mack Hicks, SVP  
Bank of America  760-318-9345

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 28 Nov 2002 17:12:16 +0100

Mack,
Some notable bank-originated PKI-schemes requires RPs
to sign contracts before they get a copy of the CA root
certificate and can start to "rely".   I assume that these
contracts are simply declarations that the RP is not
going to held the CA liable for errors.

So what good does CP/CPS extensions do in this case?

I'm actually wondering if the proposed warranty extensions
maybe are not as bad as I originally thought.  You may actually
need a way to in a machine-readable way be able to say: 
"Trust this certificate at your own risk" or
"Total liability is limited to $X for this certificate"

But will lawyers accept this as a *replacement* for an
explicit agreement?  If not, it seems as redundant as the
CP/CPS stuff that BTW hardly any user understands.

cheers,
Anders