Subject: Re: Certificate Policies

From: [email-masked]
Date: Fri, 14 Mar 2003 10:44:57 +0000

> Now assuming that a single CA key/cert can create N different
> policies applied to M different EE-certificates, you get a potentially
> unmanageable legal/function matrix.

In my experience a single EE cert is created under a single policy.
There is nothing preventing that policy having within it more than
one Policy Identifier, however. It is up to the CA operators to
create manageable policies and it is up to the relying party to
understand the legal limits of the policy that they are relying
upon. I don't believe that this is a technical issue as such

> BTW, why do some people believe that you need a lot of
> different policies?  To keep legal departments busy?  Why do
> you actually need more than one within a given "trust-network"?

Two CA operators are unlikely to operate the same CPs and thus
accept the same liabilities. Even a single CA is unlikely to
issue certs in a single context. A face-to-face registration
carries far more trust than a low-level technology enabling
over-the-web registration a la Thawte secure email certificates.
CAs/UAs must be able to differentiate between the two at the
certificate definition level and the current mechanism in the
accepted design is certificatePolicies, regardless of how
effective it is at the moment in the absence of policy
enforcement at the UA level.

> It would be very interesting to see what purposes all this
> stuff is supposed to fill in application software.

Agreed. It's still at the level of a solution looking for
a problem and requires widespread adoption before it will work.

> I occasionally look on this in a slightly "philosophical" way:
> If one large user like DoD, deploys "something" but the rest of
> the market does not, using my thinking, it was a failure for this
> "something" (and long-term also for the DoD).

Natural selection. If it works (not just technologically) then
it will happen. If it doesn't then it will die and be superseded
by something that does, regardless of how elegant it is (Alas,
poor Ingres, I knew it well)

> it seems that PKI technology is still to be regarded as being
> highly immature

Agreed. TCPA and Palladium might have some benefits in this
direction methinks.

> Unless somebody provides some more facts regarding PE usage
> in application software, I suggest that we halt this thread a while,
> and let the market do the final selection...

It's given the issue a good airing. That can only be a good thing.

Chris