Subject: relation between certificate policies and CP/CPS identification

From: Peter Sylvester <[email-masked]>
Date: Thu, 23 Oct 2008 20:10:21 +0200

hello,

I would like to have some opinion about the usage of object identifiers
for certificate policies.

It happens sometimes that the difference between two policies is
very small, as an example the lifetime of a certficate (2 years or 3 days),
where all other parameters are identical, i.e. one woould like to
make a policy based decision based on two object identifiers for
such cases. Does thst means that one need to publish two
independant documents, or would it be sufficient to indicate
in the text that two OIDs are handled?

Also, sometimes, a PC text changes slightly. Does this means
that one has to allocate a new identifier in all cases.

TIA
Peter

-- 

<http://www.edelweb.fr>
*Edel/W/eb* 	Peter SYLVESTER
Consultant Sécurité des Systèmes d'Information
-----------------------------------------------------------
EdelWeb - Groupe ON-X
15, quai de Dion-Bouton
F-92816 Puteaux Cedex
Tel : +33.1.40.99.14.14 / Fax : +33.1.40.99.99.58
www.edelweb.fr <http://www.edelweb.fr> / www.on-x.com <http://www.on-x.com>
-----------------------------------------------------------
To verify the message signature, see edelpki.edelweb.fr 
<http://edelpki.edelweb.fr/>
Cela vous permet de charger le certificat de l'autorité de racine 
<http://edelpki.edelweb.fr/cacerts/EdelPKI-ca.der>;
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 23 Oct 2008 16:48:56 -0400

Peter,

In terms of your first question, it is acceptable to had two OID in the same certificate policy document.

As to your second question, if the relying parties do not need to distinguish (which seems to be the case), there is no need to allocate a new OID.

A new OID should be assigned only if there is material change in the assurance or the relying party application need to discern the difference.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Sylvester
Sent: Thursday, October 23, 2008 2:10 PM
To: pkix
Subject: relation between certificate policies and CP/CPS identification

hello,

TIA
Peter

-- 

<http://www.edelweb.fr>

---

From: Russ Housley <[email-masked]>
Date: Sat, 25 Oct 2008 15:00:26 -0400

I have seen CP documents that define more than one policy, where the 
vast majority of the material is the same, and then the few places 
that differ include something like:

If implementing policy A, then ...

If implementing policy B, then ...

Russ

---

From: Stephen Wilson <[email-masked]>
Date: Mon, 27 Oct 2008 06:37:52 +1100

I worked with a health sector client a few years ago where we had this 
issue -- namely their PKI was covering several different distinct 
certificates all issued under very similar technical circumstances but 
with different identification methods and applications, and therefore 
different Policy OIDs.

To explain, there was a backend 'wholesale' CA that was servicing 
different RAs, each responsible for issuing certificates to members of 
diverse professional groups (nurses, General Practitioners, specialists, 
employees at particular hospitals etc.).  The overall service included 
processes for helping bring new 'communities of interest' into the 
system; each community would undertake a business case analysis (to make 
sure they really needed certificates!), followed by threat & risk 
assessment on their registration procedures, then customisation of the 
certificate profile, and documentation of local RA procedures.  All 
communities used the same RA technology, supported by the scheme.

To handle the CP, we wrote a master CP and a suite of "Annexes".  For 
each community in the scheme, there would be a different Annex to the CP 
that specified the variations: identification processes, intended 
applications, banned applications, the X.509 profile etc. We would 
assign a unique Policy OIDs for all certificates issued by the 
community; it was basically a leaf from a Policy OID assigned to the 
Master CP document.  In practical terms, we found that each CP annex was 
about three pages long.

Incidentally, an elegant and useful outcome was that for software 
developers in the health sector, the meaning of each certificate in the 
scheme became very easy to discern, and business logic easy to 
implement.  The Policy OID in most cases indicated very simply the 
membership of the Subject to a certain professional group; e.g. the 
Subject might be a registered General Practitioner, or member of the 
College of Cardiology, or employee of Sydney Public Hospital, or 
contracted provider at Acme HMO.  To sign (or validate) particular types 
of transactions, the software would invoke the appropriate certificate 
usually based on context and Policy OID alone; e.g. insurance claims 
would be signed using the HMO certificate, hospital admissions and 
discharge summaries using the hospital certificate, e-prescriptions 
using the GP certificate.  If a medical professional had more than one 
role or membership, then they would be issued multiple certificates.

Cheers,

Steve Wilson.

Lockstep
www.lockstep.com.au
-------------------
Lockstep Consulting provides independent specialist advice and analysis
on authentication, PKI and smartcards.  Lockstep Technologies develops
unique new smart ID solutions that safeguard identity and privacy.