Subject: RE: Policy User Interfaces

From: "Oshman, Dave" <[email-masked]>
Date: Thu, 12 Feb 2004 09:50:57 -0500

That is an important point, Chris!
 
From my experiences in the financial sector, banks don't want to have a
lot of CAs as there is a cost to install and run and audit each
individual CA. With Identrus, the choice made was to have a single CA
that issues certificates with different policies--in some cases multiple
policies. Having a CA for each policy would be totally cost-prohibitive
in a regulated industry like banking. 

Identrus (as of 14 months ago when I last worked with them) relies
heavily on certificate policies as envisioned by 3280. Legally, they
rely on the fact that since certificate policies is marked critical,
"outside" applications should not accept Identrus certificates since
they shouldn't have access to the documentation required to make the
decision whether or not to rely on a certificate. Changing an aspect of
3280 at this point in time could wreak havoc here.

Dave Oshman
DigitalNet Government Solutions
301/939-2736
410/880-6095
800/999-3732
301/939-2901 (fax)

  _____  

From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, February 12, 2004 9:21 AM
To: Richard Levitte - VMS Whacker
Cc: [email-masked]; [email-masked]
Subject: Re: Policy User Interfaces

 Richard Levitte - VMS Whacker <[email-masked]>

> Not much of a difference, really. Now, suppose Foo Inc adds a
> Kryptonium policy with a $10M credit limit. Of course, our example
> business wants to include people with that kind of credit policy among
> their customers (they would hardly say "you have too high a limit, so
> we can't trust you"). To do that, they would have to perform one of
> the following actions:

> 1. add the "O=Foo Inc, OU=Kryptonium CA" root certificate among the
> already installed ones.

> Not difference at all.

You missed out ...

0. Spend a zillion groats deploying the Kryponium CA

:-)
**********************************************************************
This email and any attachments are confidential and intended for the
addressee only. If you are not the named recipient, you must not use,
disclose, reproduce, copy or distribute the contents of this
communication. If you have received this in error, please contact the
sender and then delete this email from your system.
**********************************************************************

---

From: "Key, Shawn (Contractor)" <[email-masked]>
Date: Thu, 12 Feb 2004 13:49:52 -0500

To all,

I am afraid I no longer have the need to be a "PKI lurker" as I have been
re-assigned to a different project. Although I find your e-mails to be
informative (for the most part ;), how can I unsubscribe from these e-mail
group lists, please? Thank you.

Regards,
Shawn

-----Original Message-----
From: Margus Freudenthal [mailto:[email-masked]]
Sent: Thursday, February 12, 2004 10:45 AM
To: [email-masked]; [email-masked]
Subject: Re: Policy User Interfaces

> 0. Spend a zillion groats deploying the Kryponium CA
Even when using policies, you still have to create business process for
registering users and verifying that they really are worth the
kryptonium-level credit limit.

Adding an extra signing key for them should be minor problem, especially
assuming that you already have the necessary infrastructure (all the
minor level CA-s).

-- 
Margus