Subject: Re: specific policies used in conjunction with anyPolicy

From: [email-masked] (Peter Gutmann)
Date: Thu, 22 Mar 2001 07:25:30 (NZST)

"Carlin Covey" <[email-masked]> writes:

>The certificate policies extension allows a sequence of policy OIDs. One such
>policy OID is anyPolicy.  I assume that it is permissible in a CA cert to
>include specific policy OIDs in addition to the anyPolicy OID. The reason I
>would want to do this is to support applications that insist on finding a
>specific policy OID, and also support more liberal applications that will
>tolerate the anyPolicy OID.

Speaking of policy OIDs, is there any centralised registry which tracks these
anywhere (apart from picking over the standard OID scrap-heap in Norway)?  I'd
like this information for two reasons, firstly so I can add some of the
policies to the dumpasn1 config database, and secondly because there doesn't
seem to be any organised way to notify anyone of policies or OIDs.  Is it the
usual free-for-all where noone knows anything and you just choose your own OID?

Peter.

---

From: Hal Lockhart <[email-masked]>
Date: Wed, 21 Mar 2001 16:31:42 -0500

Maybe you should issue them OIDs.

> -----Original Message-----
> From: Carlin Covey [mailto:[email-masked]]
> Sent: Wednesday, March 21, 2001 4:29 PM
> To: Michael Sierchio; Peter Williams
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: specific policies used in conjunction with anyPolicy
> 
> 
> Peter and Peter,
> 
> Are you distinct?  I'm a bit fuzzy myself.  ;>)
> 
> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of Michael Sierchio
> Sent: Wednesday, March 21, 2001 2:26 PM
> To: Peter Williams
> Cc: [email-masked]'; [email-masked]; 
> [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: specific policies used in conjunction with anyPolicy
> 
> 
> Peter Williams wrote:
> >
> > Is it the usual free-for-all where noone knows anything and you just
> choose
> > your own OID?
> 
> Are Peter Williams and Peter Gutmann distinct persons?
>

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 22 Mar 2001 09:55:42 (NZST)

>Are you distinct?  I'm a bit fuzzy myself.  ;>)

We're both the same person.

Now that that's been cleared up, I'd like to correct a few statements I made in
the PKI book I co-authored a few years back...

Peter :-).

---

From: Roger Younglove <[email-masked]>
Date: Thu, 22 Mar 2001 07:27:59 -0500

It is not the usual free-for-all hopefully. All of my PKI companies are 
registered with IANA and they then keep the specific OIDs assigned to their 
CPs and CPSs in house. Each cert carries the full tree for the CP.
At 02:49 PM 03/21/2001 , Peter Williams wrote:

>Is it the usual free-for-all where noone knows anything and you just choose
>your own OID?
>
>Peter.

--------
TTFN
Roger W. Younglove, CISSP
Distinguished Member of Consulting Staff
Lucent Worldwide Services--Information Security
100 Galleria Officentre, Ste. 220
Southfield, MI 48034-8428
Numeric page: 888.935.6755
E-mail page:
[email-masked]
eFax number: 413.425.5368
www.lucent.com/netcare

---

From: "Trevor Freeman" <[email-masked]>
Date: Sat, 24 Mar 2001 15:48:00 -0800

David,
Any CA will have to be fully aware of its actions relating to supporting
its client base. Just because it maybe aware of an extensions existence,
does not mean its clients are ware of it. That has nothing to do with
the issue here. Is there any benefit from an explicitly defined policy
over the use of the all policy OID. A parent CA may restrict the range
of policies it is prepared to except from a subordinate using the
all-policy OID, but is there any benefit in wanting that policy explicit
marked. Without some more concrete justification, then the case seems
week, and does not justify the increased complexity we are inheriting.
It is think kind of "feature creep" that will the undoing of this group.
Trevor

-----Original Message-----
From: David A. Cooper [mailto:[email-masked]] 
Sent: Thursday, March 22, 2001 2:12 PM
To: Trevor Freeman; [email-masked]
Subject: RE: specific policies used in conjunction with anyPolicy

Trevor,

I do not see why you think I have made a "big leap". Are you referring
to my suggestion that one can assert both anyPolicy and some specific
policies or that applications may choose different values for
initial-any-policy-inhibit?

First, we have to acknowledge the existence of the inhibitAnyPolicy
extension. If a CA includes this extension in a certificate that it
issues, then the anyPolicy OID will be ignored in any certificates that
follow that certificate in a certification path. If the issuers of those
certificates do not specify policies other than anyPolicy in their
certificates, then the certification path will either be rejected or
will be accepted under no polices. So, if policies are important, and
there is the possibility that a CA (or the relying party) will inhibit
the processing of anyPolicy, then it will not be sufficient for CAs to
assert just the anyPolicy OID. If you want it to be the case that "if
you assert the all polices OID in a CA certificate, it is an operational
simplification, and the administrator does not need to add any more",
then you'll to get rid of inhibitAnyPolicy.

Second, while you may not be able to conceive of an instance where an
application would care about the value of initial-any-policy-inhibit, it
appears that Carlin Covey can. He stated that he wanted "to support
applications that insist on finding a specific policy OID, and also
support more liberal applications that will tolerate the anyPolicy OID."
The way for an application to specify that it insists on finding a
specify policy OID is to set initial-any-policy-inhibit.

At 11:58 AM 3/22/01 -0800, Trevor Freeman wrote:
>Dave,
>You have made a big leap here which I had not interpreted from the 
>text. This revolved around who is driving the inputs into the path 
>validation process. I can conceive instances where an application would

>want to pass in a-d. I do not think for one moment that an application 
>would care about the rest, nor should they. This stuff is already way 
>to complex, and interdependencies like this are a nightmare. We are on 
>an uphill battle to get applications to use PK wisely in the first 
>place because they think it is hard. Now you are asserting that we need

>to make PK administrators knowledgeable about what applications they 
>are supporting and expect that they are intimacy aware of all their 
>needs.

As I stated above, I was merely describing how Carlin Covey could
accomplished what he wanted to do. If you think there is something wrong
with what he wants to do, that is a different matter. I was merely
pointing out that it is supported by the standard.

>That is not doing to happen. We need clean simple rules if this is to 
>be successful. So lets start be saying if you assert the all polices 
>OID in a CA certificate, it is an operational simplification, and the 
>administrator does not need to add any more.

Unless the inhibitAnyPolicy extension is eliminated, this is simply not
the case.

>Trevor
>From: David A. Cooper [mailto:[email-masked]]
>Sent: Wednesday, March 21, 2001 12:32 PM
>To: [email-masked]
>Yes, you may assert both anyPolicy and specific certificate policies in

>the same certificate. This may not be specifically stated, but path 
>processing algorithm (section 6.1.3) does take this possibility into 
>account.
>
>The reason that this is allowed is exactly the one you stated. 
>Originally there was a rule that if anyPolicy were included in the 
>certificatePolicies extension, then no other policy could be included. 
>This rule was removed when the inhibitAnyPolicy extension was 
>developed. In the case you mention, the "strict" applications would set

>initial-any-policy-inhibit in order to ensure that the path would only 
>be considered valid under policies that had been explicitly listed in 
>each certificate. The more liberal applications would not set 
>initial-any-policy-inhibit and would then (possibly) consider the path 
>to be valid under more policies.
>
>At 01:11 PM 3/21/01 -0600, Carlin Covey wrote:
> >The certificate policies extension allows a sequence of policy OIDs. 
> >One such policy OID is anyPolicy.  I assume that it is permissible in

> >a CA cert to include specific policy OIDs in addition to the 
> >anyPolicy OID. The reason I would want to do this is to support 
> >applications that insist on finding a specific policy OID, and also 
> >support more liberal applications that will tolerate the anyPolicy 
> >OID.
> >
> >draft-ietf-pkix-new-part1-05 does not appear to prohibit using 
> >specific policy OIDs and the anyPolicy OID in the same CA cert.  Is 
> >this true?