Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data in IE, IIS, Outlook)

From: [email-masked] (Peter Gutmann)
Date: Mon, 9 Feb 2004 12:43:11 +0100 (CET)

"Al Arsenault" <[email-masked]> writes:

>Okay, then how about the Canadian Government?  See
>http://www.cio-dpi.gc.ca/pki-icp/guidedocs/cert-policy/aboutCP_e.asp

The problem is that at the moment we're stuck with having to support an
extremely complex and awkward mechanism to accomodate a vanishingly small
number of users at the expense of a large majority who don't want to know or
care about it, being quite happy with policy=CA.  The "vanishingly small"
number currently stands at two, in theory there'd be at least a third,
Gatekeeper, but since the government department in charge of it has had a
spokesman announce that "I am very grateful for the fact that, at the moment,
none of my colleagues has come up with a good use for it. When they do, I will
have to do something about it" we'll call it two, and maybe even one
eventually depending on whether the Canadian work has reached the Gatekeeper
stage yet or not.

>Or maybe just change 3280 to make cert policies optional vice mandatory, so
>those people who need policy!=CA but aren't subject to SDN.706 can still find
>the information?

Exactly.  So in order to be useful (and applicable) to all users, the RFC
could say something like:

  There's an easy way and a hard way to do this.  The easy way involves
  CA=policy.  The certificatePolicies MUST contain a single policy entry with
  a policy URL or text, MUST NOT contain user notices and notice numbers and
  whatnot, and DEFINITELY MUST NOT involve policy constraints, policy
  mappings, fuzzy dice, and two-tone paint jobs.  The hard way involves multi-
  policy CAs and a lot of Tylenol, for which see the current text.

That way the majority of users can pick the straightforward option that does
what they want without too much bother, and everyone who wants to do it the
complex way can also do that.

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 10 Feb 2004 09:51:16 +0100

Well, to update RFC3280 to explicitly support Policy=CA is not really
my cup of tea as I believe such an effort would be hard to get support for.

Therefore I rather play with the idea of defining a septet RFC that
deals with single policy CAs but is still 100% based on RFC3280. 

To make this concept clearer I believe that the use of this profile
should be indicated by a specific CA-cert-based extension.  This
would eliminate the "guesswork" and providing a path to future
trust store administration facilities.

Such an extension could preferably also be fitted with appropriate
metadata describing various aspects of the [by definition] uniform
issuance, in effect potentially eliminating CP documents.

Anders

----- Original Message ----- 
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Monday, February 09, 2004 12:43
Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data in IE, IIS, Outlook)

Peter.