Subject: Re: Policy User Interfaces (was RE: Setting X.509 Policy Data in IE, IIS, Outlook)

From: [email-masked]
Date: Thu, 12 Feb 2004 00:12:39 +1300

"Anders Rundgren" <[email-masked]> writes:

>Well, to update RFC3280 to explicitly support Policy=CA is not really my cup
>of tea as I believe such an effort would be hard to get support for.

Well, that depends whose support you're talking about.  At the moment the
majority of CAs are doing just that, so I think it's trivial to get support
for - it's the other alternative that you'll have trouble convincing the
masses to use.  OTOH since the market has overwhelmingly voted for this
<cynical>I imagine it'd be hard to get PKIX's support for it, given that
that'd entail going along with what the users seem to want</cynical>.

Peter (our mail is playing up again, apologies if you see this twice, or not
       at all).

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 11 Feb 2004 14:13:15 +0100

Peter,

You are perfectly right!

That is, PKIX (or rather the IETF) is unlikely to support anything
new in this area.  Unless it would be associated with additional
complexity maybe? :-)

But ETSI has already done that for PKIX, by defining not less than
three (3)  additional policy-associated elements  (NOT based on
the policy system) that RP applications are supposed to understand
and "filter" on.

I believe that this must have something to do with matching the
perceived high value of qualified certificactes, with a similarly
high cost for relying party users...

Anders

---

From: Stephen Kent <[email-masked]>
Date: Wed, 11 Feb 2004 13:43:45 -0500

>Peter (our mail is playing up again, apologies if you see this twice, or not

peter,

It's sometimes hard to tell when you're trying to be sarcastic, vs. 
when your comments are merely so silly that the sarcasm is implied. I 
see that you're using XML to help us know the intent. In this case, 
however, the comment is silly on its face, so the explicit label was 
not needed. so I fear we have lost yet another opportunity to justify 
the use of XML :-)

I'm tempted to view this comment as consistent with the vast majority 
of your comments, which seem to be described as "if a vendor screws 
up in implementing a standard, then if the vendor achieves sufficient 
market share, let's change the standard to match the vendor's screwed 
up implementation."

in the case of policy representation, the lack of use of the feature 
may reflect a lack of need for the feature, or it may simply reflect 
the poor management interfaces provides by vendors that make it hard 
for users (as RPs) to take advantage of the feature, and so both 
users and CAs are forced to use the clunky approach you cite as best 
practice.

Steve