Subject: Re: Policy OID => CP mapping (was: Policy User Interfaces)

From: [email-masked]
Date: Fri, 13 Feb 2004 09:11:04 +0000

Anders wrote:

> If I interpret AIA and SIA correctly I see absolutely
> nothing that looks like an OID => CP function, only
> unspecified "repositories".

I know you're a fan of total automation, Anders, but if
a certificate is to be used as a strong trust mechanism and
not just a technology enabler then at some point the information
that it contains must link back to a legal mechanism in the
real world. IMO this is not something that can be automated,
as evidenced by the way AIA works. Even more, the evaluation
and acceptance of trust between businesses is something that
happens out-of-band. The people whose job it is to manage
interbusiness trust have to scrutinise the CP of the parties
with whom they are doing business electronically. To be frank,
once the CP has been accepted its incidental inclusion in each
signed transaction is technically irrelevant and only happens
for audit completeness and accountability.

Again my mind comes back to Policy Certificates which were
(are?) an attempt to automate the link between certificate
and liability that you are alluding to.

Chris

**********************************************************************
This email and any attachments are confidential and intended for the
addressee only. If you are not the named recipient, you must not use,
disclose, reproduce, copy or distribute the contents of this communication.
If you have received this in error, please contact the sender and then
delete this email from your system.
**********************************************************************