Subject: Re: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Mon, 26 Apr 2004 15:41:06 +0200 (MEST)

> 
> A signatory certificate in Europe may use a specific OID for the CP meaning 
> "Qualified Certificate".
> 
> Such CP does not apply to CA certificates.

But you can put them into a CA.

   In an end entity certificate, these policy information terms indicate
   the policy under which the certificate has been issued and the
   purposes for which the certificate may be used.  In a CA certificate,
   these policy information terms limit the set of policies for
   certification paths which include this certificate. 

So far, no known texts says that CA certificates can be profiled
by some policy. It seems that you introducing something new? 

Are you saying that for example you are looking for
"some path that creates Qualified certificates" but only if the
CA certs are created under a policy indicating "some particular 
more or less global UN policy concering CAs"' ?

> > I am not sure that I follow you here.  Can't you always cover different 
> > certification policies using policy mappings? 
> 
> No. Policy mappings make mapping in any category.
I was wrong here, since there is currently no provision to indicate in
a CA cert something about a policy/

> 
> Ooops ! This is a typo. I meant: The parameters for a given *validation 
> policy* should be depended upon the OID of the validation policy.

that's less clear to me. besides "dependant",  are you talking about a limited
number of syntaxes defined by some OID, or OIDs indicating some
parameter set similar as with a CP, or?

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Apr 2004 16:50:49 +0200

Peter,

Since the first part has been answered in a separate e-mail, I have deleted 
the part that is answered separately.

(text deleted)

> parameter set similar as with a CP, or? 

I am saying that the parameters of validation policies may vary depending 
upon the validation policy. Some policies may be simple while some others 
quite complex. Some parameters may be fixed and some others may be specified 
by the interface (i.e. using the parameters of the validation policy).

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Apr 2004 16:50:07 +0200

Peter,

Since one of your observations triggers a different topic , I change the 
subject of this e-mail and reply to the remaining in a different one.

> But you can put them into a CA.

No. They are not applicable for such a purpose.

> by some policy. It seems that you introducing something new? 

X.509 defines certificate policy as:

"3.3.10  certificate policy: A named set of rules that indicates the 
applicability of a certificate to a particular community and/or class of 
application with common security requirements."

This definition is not restricted to end-entity certificates.

In section 8.1.1. from X.509 the text states:

"All certificates are issued in accordance with a policy, even if the policy 
is neither recorded anywhere nor referenced in the certificate."

This means that a CA certificate may be issued with a certificate policy.

In section 8.1.1. from X.509 the text states later:

"A certification authority may place limitations on the use of its 
certificates, in order to control the risk that it assumes as a result of 
issuing certificates. For instance, it may restrict the community of 
certificate users, the purposes for which they may use its certificates 
and/or the type and extent of damages that it is prepared to make good in 
the event of a failure on its part, or that of its end-entities. These 
matters should be defined in the certificate policy. Additional information, 
to help affected entities understand the provisions of the policy, may be 
included in the certificate policies extension in the form of policy 
qualifiers."

This does NOT mean that limitations are defined by specifying the set of CP 
OIDs which are allowed or nor allowed.

However RFC 3280 states:

    In a CA certificate,
    these policy information terms limit the set of policies for
    certification paths which include this certificate.  When a CA does
    not wish to limit the set of policies for certification paths which
    include this certificate, it MAY assert the special policy anyPolicy,
    with a value of { 2 5 29 32 0 }.

This is quite different from X.509 !

I believe that this is a mis-interpretation from the editors of RFC 3280.

Denis