Subject: [pkix] cert image I-D

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Apr 2010 21:48:38 -0400

Folks,

I'm back from vacation now and have reviewed the discussion on the 
list re Stefan's cert image doc. To me it seems that, at best, there 
is (very) rough consensus for progressing this document.

My analysis of the discussion is as follows:

	- the cert image mechanism is an extension of the logotype RFC (3709)
	  and thus the secruity considerations are essentially equivalent.
	  Stefan has made changes to the text in response to comments from
	  several folks on the list, and from me, which I think makes the
	  Security Considerations section better than what we have in 3709.

	- this document defines how to use PDF/A, SVG, and PNG encodings for
	  images. These representations have been proposed in response to
	  comments from prospective implementers of the technology. The fact
	  that prospective implementers see these as desirable, new formats
	  strikes me as an important endorsement, although it is not a
	  guarantee that this extension of will be deployed.

	- we received supportive comments from more than one major CA
	  indicating that they see this as a desirable extension to the
	  3779 capabilities.

	- we received an indication that this is viewed as supportive of
	  ongoing ETSI efforts re "visible signatures"

These are all good reasons for progressing this document. The biggest concern
that I see, and which was expressed by several WG members, is that 3709
was not deployed, and we have no strong indication that browser vendors will
modify their products to make use of these new image formats.  While 
this is a valid concern, I don't believe that progressing this 
document is harmful, i.e., it is a logical extension of 3709, 
introducing new formats that we have been told may be sufficiently 
attractive to entice CAs and browser vendors to support the 
functionality.

Thus I plan to forward the document to the IESG.

Thanks,

Steve