Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data inIE, IIS, Outlook)

From: Peter Gutmann <[email-masked]>
Date: Tue, 17 Feb 2004 02:09:36 +1300

"Santosh Chokhani" <[email-masked]> writes:

>You can do that now with any change.  Require explicit policy as path
>processing output (vice pass/fail factor) will make this air tight.

In that case why not document it so users know about it?  As the
message you quoted said:

  The problem isn't "policy processing", the problem is that users look at the
  spec, see a mass of incomprehensible complexity (and I'm referring
  specifically to the incomprehensible policy complexity, not any other
  incomprehensible complexity that may or may not be present), and after a lot
  of head-scratching go with "policy=CA", never quite sure whether they're
  doing the right thing because the spec never comes out and says it's OK, but
  it's the only option that makes sense to them.

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 16 Feb 2004 11:42:34 -0500

Peter:

The annex I provided you tries to show that.  Also, I hope you realize it
does require a change.  We need to convert the failure due to require
explicit policy to an output. Of course, based on your assumptions, the
application and user will never set the require explicit value, and if the
CAs in the certification chain did not, the point will be moot, i.e., we
will not have policy failures even if the specification was not changed.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Gutmann
Sent: Monday, February 16, 2004 8:10 AM
To: [email-masked]
Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy DatainIE,
IIS, Outlook)

>processing output (vice pass/fail factor) will make this air tight.

In that case why not document it so users know about it?  As the message you
quoted said:

  The problem isn't "policy processing", the problem is that users look at
the
  spec, see a mass of incomprehensible complexity (and I'm referring
  specifically to the incomprehensible policy complexity, not any other
  incomprehensible complexity that may or may not be present), and after a
lot
  of head-scratching go with "policy=CA", never quite sure whether they're
  doing the right thing because the spec never comes out and says it's OK,
but
  it's the only option that makes sense to them.

Peter.