Subject: [stir] Certificate Policy

From: Russ Housley <[email-masked]>
Date: Thu, 20 Nov 2014 15:30:41 -0500

Does the STIR certificate profile need to mandate the use of a single certificate policy throughout the world?  The RPKI uses a single certificate policy, but the web PKI uses many.  I'd like to hear what people think on this topic.

Russ

---

From: Richard Shockey <[email-masked]>
Date: Thu, 20 Nov 2014 15:53:21 -0500

Short answer No.  IMHO the policies might be similar with each numbering
numbering administration but the ultimate decision is still a national
matter.

The best we could do would be almost a BCP.

‹ 
Richard Shockey
Shockey Consulting LLC
Chairman of the Board SIP Forum
www.shockey.us
Www.sipforum.org
richard<at>shockey.us
Skype-Linkedin-Facebook rshockey101
PSTN +1 703-593-2683

On 11/20/14, 3:30 PM, "Russ Housley" <[email-masked]> wrote:

>Does the STIR certificate profile need to mandate the use of a single
>certificate policy throughout the world?  The RPKI uses a single
>certificate policy, but the web PKI uses many.  I'd like to hear what
>people think on this topic.
>
>Russ
>
>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Thu, 20 Nov 2014 22:30:45 +0000

I agree with Mr. Shockey

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Richard Shockey
Sent: Thursday, November 20, 2014 3:53 PM
To: Russ Housley; IETF STIR Mail List
Subject: Re: [stir] Certificate Policy

< 
Richard Shockey
Shockey Consulting LLC

---

From: Brian Rosen <[email-masked]>
Date: Thu, 20 Nov 2014 13:05:51 -0800

I agree.  A BCP would be VERY nice, but I doubt it could be normative
> On Nov 20, 2014, at 12:53 PM, Richard Shockey <[email-masked]> wrote:
> 
>

---

From: Richard Shockey <[email-masked]>
Date: Thu, 20 Nov 2014 21:30:04 -0500

>I agree.  A BCP would be VERY nice, but I doubt it could be normative

Well Well at least the beginning of consensus.  The work on CRL needs to
start ASAP. The issue is there can be no true root for E.164. Been there
done that. 

Every nation state has some unique policy on how Certificates are managed
for Government sanctioned applications. They are not hard to find. Do the
G. Beyond the basic STIR protocol issues we (IETF) do have a valuable role
in providing guidance to NRA’s on how these things should be implemented.
FCC OFCOM CRTC EU etc.

http://berec.europa.eu/eng/links

The more interesting question is should there be some formal liaison here.
Is this something the Internet Society should be involved in at this point
or is it too early?  This is actually something ISOC is uniquely
positioned to deal with. IMHO ISOC should be involved and the sooner the
better.

Thoughts?

---

From: <[email-masked]>
Date: Fri, 21 Nov 2014 09:51:34 +0000

Russ,

I do not think the profile needs to mandate a unique certificate policy à la RFC 6484, nor do I think it realistic for it to do so given the variations that exist between national numbering plan management schemes.

If, however, the WG identifies elements that must be common to all policies along the way (or if the technical options would vary depending on these policies) for this work to be truly relevant and progressed as far as possible, those elements/options should be captured in some way. But I don't think it should or could be a one-size-fits-all sort of approach (even with optional extensions)

Regards,

Philippe Fouquart
Orange Labs Networks
+33 (0) 1 45 29 58 13<tel:+33%20(0)%201%2045%2029%2058%2013>

-------- Message d'origine --------
De : Russ Housley
Date :20/11/2014 21:31 (GMT+01:00)
À : IETF STIR Mail List
Objet : [stir] Certificate Policy

Russ

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.