Subject: Re: Policy OID => CP mapping (was: Policy User Interfaces)

From: [email-masked]
Date: Thu, 12 Feb 2004 16:30:15 +0000

For me the mechanisms are there but they require the will of the issuer to
comply with them. It all comes down to how seriously the issuer is about
their product. A TTP that issues a high trust value certificate without
exploiting
(eg) AIA just isn't taking the whole thing seriously. Similarly, and
end-user who
is looking to trust a cert carrying (eg) AIA without looking up the level
of liability
acceptance contained therein is similarly negligent and deserves everything
they get.

The problem is, of course, that PKI use is inconsistent in the broader
context
and presently works well only in closed communities (as alluded to by
another
contributor earlier today). This is IMO partly deliberate design, partly
through
ignorance of how PKI works and partly through kludging to avoid known gaps.

Chris

                      Richard Levitte -                                                                                                 
                      VMS Whacker               To:      [email-masked]                                                              
                      <[email-masked]>           cc:                                                                                     
                      Sent by:                  Subject: Policy OID => CP mapping (was: Policy User Interfaces)                         
                      owner-ietf-pkix@m                                                                                                 
                      ail.imc.org                                                                                                       

                      12/02/2004 14:46                                                                                                  

Guys,

as part of this whole certificate policy discussion, there's one point
that I'd like to take up where I haven't really seen a good solution:
distribution of CPs.  Yes, one can have a CPS URI and that can link
further from there to the CP, or (*cough*) one might use a userNotice
to point at the CP.  Still, that's a fairly crude way to handle it,
and some just don't.  It would be a good thing if there was some
formalised way to find a CP given a policy OID.

I do not care what kind of technology would be used, if one would
imagine finding CP pointers in LDAP, or via some contorted DNS RRs, or
some new, entirely separate protocol (and no, I don't think
Alvestrands object database, however nice it is to browse, is the
solution :-)).

Of course, some organizations may choose not to publish their CPs.
Their choice, and maybe their loss, I couldn't care less.  What I care
about is that there seems to be no technical way at all to find the CP
connected to a policy OID.

As usual, if I'm misinformed, I'd love to stand corrected.

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

--
Richard Levitte     | http://richard.levitte.org/ | Tunnlandsv. 3
Levitte Programming | http://www.lp.se/           | S-168 36 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

     **********************************************************************
     This email and any attachments are confidential and intended for the
     addressee only. If you are not the named recipient, you must not use,
     disclose, reproduce, copy or distribute the contents of this
     communication. If you have received this in error, please contact the
     sender and then delete this email from your system.
     **********************************************************************

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Thu, 12 Feb 2004 20:04:44 +0100 (CET)

In message <[email-masked]> on Thu, 12 Feb 2004 16:30:15 +0000, [email-masked] said:

chris.gilbert> For me the mechanisms are there but they require the
chris.gilbert> will of the issuer to comply with them. It all comes
chris.gilbert> down to how seriously the issuer is about their
chris.gilbert> product. A TTP that issues a high trust value
chris.gilbert> certificate without exploiting (eg) AIA just isn't
chris.gilbert> taking the whole thing seriously. Similarly, and
chris.gilbert> end-user who is looking to trust a cert carrying (eg)
chris.gilbert> AIA without looking up the level of liability
chris.gilbert> acceptance contained therein is similarly negligent and
chris.gilbert> deserves everything they get.

I feel like such a fool.  Thanks for the reminder.

-----

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Thu, 12 Feb 2004 22:03:59 +0100 (CET)

In message <[email-masked]> on Thu, 12 Feb 2004 20:04:44 +0100 (CET), Richard Levitte - VMS Whacker <[email-masked]> said:

levitte> In message <[email-masked]> on Thu, 12 Feb 2004 16:30:15 +0000, [email-masked] said:
levitte> 
levitte> chris.gilbert> For me the mechanisms are there but they require the
levitte> chris.gilbert> will of the issuer to comply with them. It all comes
levitte> chris.gilbert> down to how seriously the issuer is about their
levitte> chris.gilbert> product. A TTP that issues a high trust value
levitte> chris.gilbert> certificate without exploiting (eg) AIA just isn't
levitte> chris.gilbert> taking the whole thing seriously. Similarly, and
levitte> chris.gilbert> end-user who is looking to trust a cert carrying (eg)
levitte> chris.gilbert> AIA without looking up the level of liability
levitte> chris.gilbert> acceptance contained therein is similarly negligent and
levitte> chris.gilbert> deserves everything they get.
levitte> 
levitte> I feel like such a fool.  Thanks for the reminder.

And now I've done some more thinking.  AIA (and SIA when applicable)
is a good thing, but not really what I asked for.  The thing I'd like
to see (and Anders too) is a 1-to-1 mapping between policy OID and
document.  I would like if there was a mechanism to fetch a document
given a policy OID.  The best example I can see is that the SIA can
have a URI for a CA repository (if given in a CA cert, for example),
and the page that leads to could contain a list of CP documents.

If there are reasons why a 1-to-1 mapping between OIDs and documents
wouldn't be needed, I'd like to hear them.  The goal here is for
software to be able to show the CP document fairly automagically upon
request when given a policy OID.

Note that this is *not* an argument for policy=CA.  Rather, it's a
request to solve what I see as a problem in policy OID usability,
which I'd rather do than have a kludge.

-----

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 12 Feb 2004 22:07:26 +0100

Well,

If I interpret AIA and SIA correctly I see absolutely nothing that looks like an OID => CP function, only unspecified "repositories".

That is, these extensions are impossible to use as the foundation for a streamlined, integrated policy management facility that would fit a modern operating system like W2K3 or something like that.

Further AIA goes upwards, while a useful object management administration facility works the other way.

In short this suxx, solves no problems, and is not worth CA's support.

Anders
  ----- Original Message ----- 
  From: [email-masked] 
  To: Richard Levitte - VMS Whacker 
  Cc: [email-masked] 
  Sent: Thursday, February 12, 2004 17:30
  Subject: Re: Policy OID => CP mapping (was: Policy User Interfaces)

  For me the mechanisms are there but they require the will of the issuer to 
  comply with them. It all comes down to how seriously the issuer is about 
  their product. A TTP that issues a high trust value certificate without exploiting 
  (eg) AIA just isn't taking the whole thing seriously. Similarly, and end-user who 
  is looking to trust a cert carrying (eg) AIA without looking up the level of liability 
  acceptance contained therein is similarly negligent and deserves everything
  they get.

  The problem is, of course, that PKI use is inconsistent in the broader context
  and presently works well only in closed communities (as alluded to by another
  contributor earlier today). This is IMO partly deliberate design, partly through 
  ignorance of how PKI works and partly through kludging to avoid known gaps.

  Chris

  Richard Levitte - VMS Whacker <[email-masked]>

                Richard Levitte - VMS Whacker <[email-masked]>
                Sent by: [email-masked] 
                12/02/2004 14:46

        To: [email-masked]
        cc: 
        Subject: Policy OID => CP mapping (was: Policy User Interfaces) 

  Guys,

  -----

  --
  Richard Levitte | http://richard.levitte.org/ | Tunnlandsv. 3
  Levitte Programming | http://www.lp.se/ | S-168 36 Bromma
  T: +46-708-26 53 44 | | SWEDEN 
      "Price, performance, quality... choose the two you like" ********************************************************************** This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in error, please contact the sender and then delete this email from your system. **********************************************************************