Subject: Certificate policy question

From: [email-masked] (Peter Gutmann)
Date: Wed, 11 Dec 2002 18:19:00 +1300

[Warning: This is one of those questions which is probably best answered in
          the Style Guide with a note saying "Don't do that"]

Someone just sent me yet another weird cert [0] which has two different, in
some places mutually exclusive, policies (that is, CPSes) in the
certificatePolicies.  I know the de facto standard handling for this is to
ignore the policy, but what's the official word on this?  Do you pick the one
you like best and ignore the rest?  Use the LSB of the public key as an index
to pick one?  Pop up a copy of Acrobat in a dialog box, ask the user to read
the 100-odd-page CPSes, and pick the one with the flashiest graphic on the
cover?

I'd like to at least do *something* in my code other than just ignoring it.

Peter.

[0] The cool thing about 2459/3280's complexity is that everyone gets their
    own mistake arc without ever having to duplicate anyone else's.  Maybe we
    could formalise this with OIDs or something :-).

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 11 Dec 2002 09:21:25 +0100 (CET)

In message <[email-masked]> on Wed, 11 Dec 2002 18:19:00 +1300, [email-masked] (Peter Gutmann) said:

pgut001> [Warning: This is one of those questions which is probably
pgut001>           best answered in the Style Guide with a note saying
pgut001>           "Don't do that"]
pgut001> 
pgut001> Someone just sent me yet another weird cert [0] which has two
pgut001> different, in some places mutually exclusive, policies (that
pgut001> is, CPSes) in the certificatePolicies.  I know the de facto
pgut001> standard handling for this is to ignore the policy, but
pgut001> what's the official word on this?  Do you pick the one you
pgut001> like best and ignore the rest?  Use the LSB of the public key
pgut001> as an index to pick one?  Pop up a copy of Acrobat in a
pgut001> dialog box, ask the user to read the 100-odd-page CPSes, and
pgut001> pick the one with the flashiest graphic on the cover?

What's the context?  What kind of certificate are we talking about, an
EE certificate or a CA one?  If it's an EE cert, I can understand the
confusion, but if it's a CA one, doesn't that simply describe the
applicability of certificates certified by said CA?  In the CA case,
doesn't the way you handle it have a lot to do with mappings along the
way and what policies you accept at the end (or beginning) of
validation?

If I assume a somewhat bastardous attitude, I'd say such a certificate
invalidates the whole path, IF you end up having those clashing
policies in your state at the end of path construction/validation.

pgut001> I'd like to at least do *something* in my code other than
pgut001> just ignoring it.

I'd agree with that.

pgut001> [0] The cool thing about 2459/3280's complexity is that
pgut001>     everyone gets their own mistake arc without ever having
pgut001>     to duplicate anyone else's.  Maybe we could formalise
pgut001>     this with OIDs or something :-).

A friend of mine expressed something similar: "Standards are a good
thing, everyone should have his own".

-- 
Richard Levitte     | http://richard.levitte.org/ | Spannv. 38, I
Levitte Programming | http://www.lp.se/           | S-168 35 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"