Subject: Policy OID => CP mapping (was: Policy User Interfaces)

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Thu, 12 Feb 2004 15:46:19 +0100 (CET)

Guys,

as part of this whole certificate policy discussion, there's one point
that I'd like to take up where I haven't really seen a good solution:
distribution of CPs.  Yes, one can have a CPS URI and that can link
further from there to the CP, or (*cough*) one might use a userNotice
to point at the CP.  Still, that's a fairly crude way to handle it,
and some just don't.  It would be a good thing if there was some
formalised way to find a CP given a policy OID.

I do not care what kind of technology would be used, if one would
imagine finding CP pointers in LDAP, or via some contorted DNS RRs, or
some new, entirely separate protocol (and no, I don't think
Alvestrands object database, however nice it is to browse, is the
solution :-)).

Of course, some organizations may choose not to publish their CPs.
Their choice, and maybe their loss, I couldn't care less.  What I care
about is that there seems to be no technical way at all to find the CP
connected to a policy OID.

As usual, if I'm misinformed, I'd love to stand corrected.

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

-- 
Richard Levitte     | http://richard.levitte.org/ | Tunnlandsv. 3
Levitte Programming | http://www.lp.se/           | S-168 36 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 12 Feb 2004 19:11:06 +0100

Richard,
It is good to see that you have also found that the administration
of PKI suffers from some disconnects.

You have essentially two(2) basic ways of doing this:

1) Define an extension that is put in EE-certificates that
though requires that the administrator already is in possession
of an EE-certificate.

2) Define a CA/trust anchor-based extension that enables the
thought functionality to also be used when only installing trust
anchors, or viewing already installed such.  This is about
going for the source of authority rather than adding yet another
kludge to an already burdened scheme.

Anders

----- Original Message ----- 
From: "Richard Levitte - VMS Whacker" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, February 12, 2004 15:46
Subject: Policy OID => CP mapping (was: Policy User Interfaces)

Guys,

-----

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Thu, 12 Feb 2004 21:40:46 +0100 (CET)

In message <01a101c3f193$9625c4d0$0500a8c0@arport> on Thu, 12 Feb 2004 19:11:06 +0100, "Anders Rundgren" <[email-masked]> said:

anders.rundgren> Richard,
anders.rundgren> It is good to see that you have also found that the
anders.rundgren> administration of PKI suffers from some disconnects.
anders.rundgren> 
anders.rundgren> You have essentially two(2) basic ways of doing this:
anders.rundgren> 
anders.rundgren> 1) Define an extension that is put in EE-certificates
anders.rundgren>    that though requires that the administrator
anders.rundgren>    already is in possession of an EE-certificate.

The extension would probably be authorityInfoAccess.

anders.rundgren> 2) Define a CA/trust anchor-based extension that
anders.rundgren>    enables the thought functionality to also be used
anders.rundgren>    when only installing trust anchors, or viewing
anders.rundgren>    already installed such.  This is about going for
anders.rundgren>    the source of authority rather than adding yet
anders.rundgren>    another kludge to an already burdened scheme.

I believe the CA certificate could have a subjectInfoAccess extension
with such information, like a URI to the repository, where CPs and
CPSs could be stored, among others.

-----