Subject: RE: Logotypes in certificates

From: "Manger, James H" <[email-masked]>
Date: Fri, 23 Mar 2001 19:59:44 +1100

> [Aram Perez] So which is the real logo?

So which is your real name? "A. Perez", "Aram Perez" or "Mr Aram Perez"

Both questions are irrelevant.  An entity does not have to have a unique
logo.  To be useful, it is sufficient that the logo unambiguously identifies
an entity (within the context of use).

> [Michael Zolotarev] we touch the slippery path of using graphical
> images as a formal constituent of trust establishement

A logo does not establish trust.  A logo aids identification.  A logo can
help you recognise an entity you already trust.

Images (e.g. logos) are a widely used form of identification (and for good
reason, as they are very human-friendly (ease to use)).  I suggest PKIX
should change to support logos, rather than trying to changes our five
senses.

> [Stefan Santesson] logotypes could be provided as a policy qualifier

How on earth does a logo qualify the policy under which a certificate was
issued?  Using this field sounds like a major hack.

---

From: "David P. Kemp" <[email-masked]>
Date: Fri, 23 Mar 2001 12:46:49 -0500

"Manger, James H" wrote:
> 
> An entity does not have to have a unique logo.  To be useful,
> it is sufficient that the logo unambiguously identifies
   ... and
> should change to support logos, rather than trying to changes our five

A correlary of the first statement is: If the logo does not
unambiguously identify an entity within the context of use, then
it is not useful.  I predict that Stefan will find it impossible
to propose a criterion against which it can be determined that
a CA is operating correctly, i.e. that the CA will certify a logo
that identifies the entity, and that it will not certify a logo
that mis-identifies the entity.

If no one can propose a method by which a CA should decide not to
certify a logo "similar to" the Chevrolet bowtie or the AT&T deathstar
for someone other than Chevrolet or AT&T respectively, then it is
obvious that changing PKIX to support logos has *NO* value to the
user.

I submit that it has negative value; a misleading logo
in a certificate is worse than none at all.

(I concede that a logo capability has marketing value to CAs and
entertainment value to us geeks.  But PKIX shouldn't be about
satisfying those urges at the expense of the user.)

---

From: Michael Ströder <[email-masked]>
Date: Fri, 23 Mar 2001 18:52:59 +0100

> obvious that changing PKIX to support logos has *NO* value to the

And being a CA I would be so afraid of trademark issues that I would
refuse to decide about "similar" logos at all.

> in a certificate is worse than none at all.

I agree on that.

Ciao, Michael.

---

From: Dean Povey <[email-masked]>
Date: Sun, 25 Mar 2001 10:04:23 +1000

> obvious that changing PKIX to support logos has *NO* value to the

One way, is that the CA can ensure that the logo is a registered
trademark owned by the subject it is being issued to.  The USPTO and other
organisations like it already have processes to ensure that trademarks are 
not confusingly similar.

Again, similar problems exist for CAs working out what name to give to a 
subject, yet they manage to do a reasonable job of working it out. No one
seems to disagree that this is a problem, and everyone seems to be 
more or less comfortable with living with it.

Also, one other potential use of an image reference in an EE certificate
is a digital photo of an employee which obviously has a pretty good 
mechanism for verification (i.e. look at photo, look at person).

-- 
Dean Povey,         | e-m: [email-masked] | JCSI:  Java Crypto Toolkit 
Research Scientist  | ph:  +61 7 3864 5120   | uPKI:  C PKI toolkit for embedded
Security Unit, DSTC | fax: +61 7 3864 1282   |        systems
Brisbane, Australia | www: security.dstc.com | Oscar: C++ PKI toolkit

---

From: Michael Ströder <[email-masked]>
Date: Sun, 25 Mar 2001 01:39:11 +0100

> organisations like it already have processes to ensure that trademarks are

I disagree. The organizations registering trade marks/logos (e.g.
Deutsches Patentamt in Germany) do not guarantee that the trade
marks/logos are not similar to others. They're just doing the
registration, no exhaustive checking for conflicts => a CA cannot
rely on such a service.

> mechanism for verification (i.e. look at photo, look at person).

I agree here. A photo of a person could be of some use.

Ciao, Michael.

---

From: Dean Povey <[email-masked]>
Date: Tue, 27 Mar 2001 10:16:09 +1000

>registration, no exhaustive checking for conflicts => a CA cannot

My apologies, I made such a broad generalisation based on my knowledge of
what I had recently read about the USPTO and what I remembered about the
Trademark process in Australia.  I think you would concede however that
while they might not do exhaustive checking, the trademark process provides
some level of assurance as companies are quite vigilant about protecting
their trademarks.  Users merely have to treat the information appropriately
in view of this, as they have to do with all information that they find in
a Certificate.

---

From: Michael Ströder <[email-masked]>
Date: Tue, 27 Mar 2001 12:11:25 +0200

Dean Povey wrote:
> 
> I think you would concede however that
> their trademarks.

No. Although I agree that companies are very vigilant about
protecting their trademarks there are too many trade mark and logo
cases going to courts. IMHO this whole trademark stuff is even more
ambigous than natural names (like X.500 naming CN,L,OU,O,C) of
residential persons.

Ciao, Michael.