Subject: Re: I-D ACTION:draft-ietf-pkix-logotypes-01.txt

From: Denis Pinkas <[email-masked]>
Date: Tue, 26 Mar 2002 14:41:09 +0100

Comments on draft-ietf-pkix-logotypes-01.txt

There was no time available during the last meeting for comments. 
So here are my comments.

COMMENT 1: Subject logotype. 

Currently a "subject organization logotype" is proposed. It definition is as
follows: "a logotype representing the organization identified in the subject
name in the certificate".

>From this definition only a single logotype would be allowed for a subject.
It can make sense to attach more that one logotype to a subject, that does
not reflect necessarily the organization a user belongs to (e.g. an
individual is a Red Cross member) so the definition should be changed to:

"subject logotype" "a logotype representing any characteristic of the entity
identified in the subject name in the certificate".

COMMENT 2: Issuer logotype.

Currently an "issuer organization logotype" is proposed. It definition is as
follows: "a logotype representing the organization identified as part of the
issuer name in the certificate".

>From this definition a single logotype would be allowed for an issuer. It
can make sense to attach more that one logotype to an issuer, that does not
reflect necessarily the organization an issuer belongs to (e.g. an issuer
may support a "Privacy Policy" and be a member from two different trade
associations), so the definition should be changed to:

"issuer logotype: a logotype representing any characteristic of the issuer
identified as part of the issuer name in the certificate".

COMMENT 3: The "concept logotype", also renamed "community logotype" during
the last IETF meeting or " shared community logotype" in the minutes from
the same meeting is more hazy.

The current text states:" Many issuers may use the concept logotypes to
co-brand with a global concept in order to gain global recognition of its
local service provision. This type of concept branding is very common in
credit card business where local independent card issuers issue cards within
a globally branded concept (such as VISA and MasterCard)".

The current text also states: " the relationship between the issuer and
either the issuer organization logotype or the concept logotype".

A logotype is adding "human processable" information to enhance the
properties of an already existing field from a certificate. To this respect
it is sensible to add one (or more) logotypes that characterizes the issuer
and the subject. The real question is to which field the "concept logotype /
community logotype / shared community logotype" relates.

It may relate :

  - either to the issuer, to state that an issuer belongs to some group, or 

  - to the certificate policy to state that the policy under which the
    certificate is issued obeys to some rules imposed by the organization 
    whose logo is referenced.

This leads to two possible ways:

   1) only consider two logotypes: issuer logotype and subject logotypes.
   2) consider three logotypes: issuer logotypes, subject logotypes and 
      policy logotypes.

I would favor the former, but would have no major problem to go with the
later. In that case the policy logotype would be defined as follows:

"Policy logotype: a logotype representing any characteristic of the
certificate policy under which the certificate is issued".

COMMENT 4: Logotypes are not "claimed" by the issuer, but always *verified*
to some extend by the issuer. The current text is misleading: 

   "The relationship between the subject organization and the subject
   organization logotype and the relationship between the issuer and
   either the issuer organization logotype or the concept logotype, are
   relationships *claimed* by the issuer."

COMMENT 5: During the meeting, it has been proposed to add a small image of
the logotype in the certificate itself. In this WG we always have had a
concern about the size of the certificate, so that it can be lodged in some
small devices. So I would not favor to allow such provision in a extension
standardized by this WG.

COMMENT 6: It should be made clear that this extension in non-critical.

COMMENT 7: The document includes many typos to be corrected.

Denis

---

From: "Housley, Russ" <[email-masked]>
Date: Wed, 27 Mar 2002 13:50:03 -0500

Denis:

I fear that you have missed the point of the logotypes draft 
altogether.  The authors recognize that the introduction needs to be 
expanded, so we may be to blame for any misunderstanding.  To try and clear 
up the misunderstanding, I offer some general observations before 
responding to your specific comments.

The logotype extension will aid in two situations:
	1.  Certificate-based Identification
	2.  Selection of Certificates

In the first case, the need for human recognition depends on the manner in 
which certificates are used and whether certificates need to be visible to 
human users. If certificates are to be used in open environments and in 
applications that bring the user in conscious contact with the result of a 
certificate-based identification process, then human recognition is highly 
relevant, and it may be a necessity.

Most applications provide the human user with an opportunity to view the 
results of a successful certificate-based identification process.  When the 
user takes the steps necessary to view these results, the user is presented 
with a view of a certificate. This solution has two major problems.  First, 
the function to view a certificate is often rather hard to find for a 
non-technical user. Second, the presentation of the certificate is rather 
technical; it is not user friendly. It contains no graphic symbols or 
logotypes to enhance human recognition.

In the second case, there are software applications that expose human users 
to certificates for the selection of a single certificate from a portfolio 
of certificates. In some circumstances, the software application can use 
information within the certificates to determine suitability; however, the 
user must be queried if more than one certificate is suitable. The human 
user must select one of them.

This situation is comparable to a person selecting a suitable plastic card 
from his wallet. In this situation, substantial assistance is provided by 
card color, location, and branding.

In order provide similar support for certificate selection, the users need 
tools to easily recognize and distinguish certificates. Introduction of 
logotypes into certificates provides the necessary graphic.

Now, for your specific comments.

Currently a "subject organization logotype" is proposed. It definition is 
as follows: "a logotype representing the organization identified in the 
subject name in the certificate".

 From this definition only a single logotype would be allowed for a 
subject. It can make sense to attach more that one logotype to a subject, 
that does not reflect necessarily the organization a user belongs to (e.g. 
an individual is a Red Cross member) so the definition should be changed
to:

"subject logotype" "a logotype representing any characteristic of the 
entity identified in the subject name in the certificate".

RESPONSE 1.

We are allowing a graphical identity of the user to facilitate certificate 
selection or acceptance. We are not trying to graphically represent every 
attribute of the user.  We certainly do not want to overwhelm the designers 
of graphic user interfaces.  We need to keep it simple.

Currently an "issuer organization logotype" is proposed. It definition is 
as follows: "a logotype representing the organization identified as part of 
the issuer name in the certificate".

RESPONSE 2.

Again, we are allowing a graphical identity of the user to facilitate 
certificate selection or acceptance. We are not trying to graphically 
represent every attribute of the issuer.

The current text states:" Many issuers may use the concept logotypes to 
co-brand with a global concept in order to gain global recognition of its 
local service provision. This type of concept branding is very common in 
credit card business where local independent card issuers issue cards 
within a globally branded concept (such as VISA and MasterCard)".

A logotype is adding "human processable" information to enhance the 
properties of an already existing field from a certificate. To this respect 
it is sensible to add one (or more) logotypes that characterizes the issuer 
and the subject. The real question is to which field the "concept
logotype / community logotype / shared community logotype" relates.

It may relate :

RESPONSE 3.

Policy implies the wrong connotation. We are not trying to graphically 
represent a certificate policy or anything about how the certificate was 
issued. The community (or concept) logotype simply allows CA to enter into 
collective branding relationships.

I suppose that a large group that share a common security policy could 
register a logo for that policy and use it as a community logo.  While this 
was not the model that we considered, it certainly is accommodated.

RESPONSE 4.

The issuer is responsible for the verification of anything that is included 
in the certificate.  After all, the issuer signature covers it.  Thus, the 
issuer is claiming that the logotypes are appropriate.

COMMENT 5: During the meeting, it has been proposed to add a small image of 
the logotype in the certificate itself. In this WG we always have had a 
concern about the size of the certificate, so that it can be lodged in some 
small devices. So I would not favor to allow such provision in a
extension standardized by this WG.

RESPONSE 5.

There are environments where the client cannot access the Internet until 
after the certificate is used.  Consider certificate-based authentication 
to an ISP.  A small logotype in the certificate could be useful to aid 
certificate selection in this situation.  The inclusion of a small logotype 
is, of course, optional.

RESPONSE 6.

Agree.  The logotype extension was never intended to be critical.

RESPONSE 7.

We will make every effort to correct them before the next draft is published.

Russ