Subject: Re: Meaning of CP in a CA certificate

From: Peter Sylvester <[email-masked]>
Date: Wed, 28 Apr 2004 11:30:00 +0200 (MEST)

> 
> >>I believe that this is a mis-interpretation from the editors of RFC 3280.
> >>
> > 3280 and X509 have the same textual definition concerning the value
> > of the policy extension. what do you think is available in X509
> > which is not available in 3280? What can be misinterpreted if
> > both texts are identical?
> > 
> > In both text, there is no provision to indicate in a CA cert some
> > policy that governs a CA cert. 
> 
> If you had not suppressed the text from my previous e-mail, then you would 
> have seen that the texts are different.

I refered to the text that defines the meaning of the policy extension,
they are both identical in X509 and 3280. 
 
The text about any policy in 3280 was added as a result to a defect
report in X.509. You have statements about semantics in both texts
which are not necessarily identical but are supposed to be semantically
equivalent as far as I remember.

> >>>Are you saying that for example you are looking for
> >>>"some path that creates Qualified certificates" but only if the
> >>>CA certs are created under a policy indicating "some particular 
> >>>more or less global UN policy concering CAs"' ?
> >>
> > 
> > You have not answered the previous question.
> 
> This question is not understandable for me.

A combination of a policy indication in the end entity cert, and some
information that the CA certificate is a certifiction authority
belonging to a country administration issuing passports or id cards,
indicated by a "gobal policy". This seems to me what you are asking for:
adding "qualified certificate" as policy for the ee-certs and 
"country authority ca" as a policy for the ca. 

Remembering the discussion about policies some days ago, this seems again
wanting another type of hierarchy since name chains to trust anchors are 
not sufficient, because we don't like names, etc.