Subject: Re: I-D ACTION:draft-santesson-pkix-certimage-00.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 1 May 2009 10:03:10 +0200

As I wrote in an earlier posting I have nothing against this as an
PKIX WG item.   I would though like to point out some additional
issues.  Effectively the proposed draft as well as RFC3709 support
three independent use-cases.

1. Recognition of for example a web-site server-certificate issuer.
That seems like a good application.

2. Credential selection.  I remain unconvinced that such
information should be featured in the form of public URLs in
certificates since the purpose is guiding end-users. Microsoft's
recently introduced Information Cards provides a "cert-image"
but this image is never transferred to any other party.

3. Peer-to-peer RP support.   Although it is a nice
idea standardizing (per CA) the information you send to
arbitrary contacts it also seems pretty difficult; some people
apparently feel comfortable publishing their entire life on
Facebook while other groups of people prefer using
unintelligible aliases.  This part appears to be outside
of what CAs should be dealing with, with passports as an
exception.  For the latter standards already exist AFAIK.

Regarding #3 I believe this is rather a case for attribute
certificates (not necessarily in the X.509 flavor), where you
in a message optionally include URLs to published ACs holding
additional information about you that is relevant for the relation
to the specific RP.

I would therefore consider dropping use-case 2 and 3 since
the recognition of web-sites is an issue that affects the entire
Internet ecosystem, it is good enough alone as a WG item.

Anders

---

From: Stefan Santesson <[email-masked]>
Date: Sat, 02 May 2009 15:07:42 +0200

Anders,

If one use case is valid for you that is fine with me and even that is a
good reason to proceed.

Others, including me, see all three use cases as valid. I don't recall
explicitly mentioning peer-to-peer support. Signature verification also
exist in business to consumer scenarios. Signed software, udates and
manifests are ne common cases.

Credential selection is not competing with information card. On the contrary
it would be extremely helpful for the Information Card solution if every
certificate came with a preset image. It would save users the trouble to
understand what a particular certificate is before choosing an image for it.

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 2 May 2009 16:22:00 +0200

Stefan,

<snip>

>understand what a particular certificate is before choosing an image for it.

I believe it is rather the opposite; PKI folks should take a closer look
on Information Cards and consider adapting their model.  After all,
Information Cards were developed with the consumer in mind.

FWIW, this is at least the path I'm walking with my KeyGen2 effort.
It is true that I'm (currently) alone in this work but OTOH the PKI
community has proved (over and over again...) that it is incapable of
doing anything creative on the client-side of PKI in browsers so it
may indeed be what you in the end actually get due to a lack of
credible alternatives.  That the target is the quickly-moving mobile
phone-market rather than the technically and market-wise stagnant
PC-market is also a factor to consider.  Here KeyGen2 does a
much better job than any static certificate image scheme could ever
do since the former caters for the entire process, including device
characteristics regarding credential selection images.

Open Source + Economic Downturn + Pretty Good Design is a
lethal combination :-)

Anders