Subject: RE: Where should do I put a max mount in a X.509v3 certificate?

From: "Housley, Russ" <[email-masked]>
Date: Mon, 4 Mar 2002 09:35:15 -0500

Todd:

While the CP and CPS should surely cover this topic, this is not a very
useful place to carry this information if you expect automated processing of
a transaction.

Roberto:

To the best of my knowledge, no one has defined an extension for this
information to be placed in the certificate.

Russ 

-----Original Message-----
From: todd glassey
To: Roberto Opazo Gazmuri
Cc: LISTS - IETF-PKIX
Sent: 3/3/02 1:13 PM
Subject: Re: Where should do I put a max mount in a X.509v3 certificate?

Roberto - we went over exactly this thing in the Bar Association's
Information Security Committee and the place that the liability and
claimant
requirements are codified is in a set of documents called the
Certificate
Policy Statement (CPS) and Practices Statements (PS). The other side of
these is the Relying Party Agreement(RPA).  These three documents
essentially form the of a contract, which is leveraged between the terms
listed in them.structure

The CPS and PS documents state the constraints of the Certificate and
how
the CA operates itself. The RPA is the other half of the picture and
defines
the relying party's obligations rights, and procedures for collecting
against the indemnity provided.

The problem is that there is no real method of communicating stated
policy
or negotiating inline. That is to say that without these complex legal,
and
externally referenced documents the structure of the x.509 certificate
cannot by itself instantiate any level of liability per se.

I have suggested several times that that PCP (Policy Communications
Protocol) is a key missing part of any real Machine-operated PKI
solution.
The machines must be given a way of negotiating the specific policies
and
constraints under which they will work and they need to do this together
with the other CA's so that applications can make inline decisions as to
what they will and wont trust.

By the way, the assigning of a value to an x509 certificate turns it
into a
financial token and you would need much more than just this group to
approve
of that since there are then legal implications attached that are not
necessarily apparent.

Todd Glassey

----- Original Message -----
From: "Roberto Opazo Gazmuri" <[email-masked]>
To: "PKIX (Grupo de la IETF)" <[email-masked]>
Sent: Sunday, March 03, 2002 8:50 AM
Subject: Q: Where should do I put a max mount in a X.509v3 certificate?

IETF-PXIX:

I would like to ask the WG opinion about "the correct" place to indicate
that a certificate should not be used to validate electronic signatures
for
a mount over a determined maximum.

Here we are delegating in de RP the responsibility of validating the
certificate content to see if there is a limit and I have not seen a
good
place to put this information. We need to indicate:
1.- There is a general limit, not for a specific transaction type
2.- The mount of the limit
3.- The type of money in witch the mount is expressed

Is there a standard extension for that?

Thanks,

Opazo, Roberto ([email-masked])
CEO - www.acepta.com
Certification Authority for Chile

---

From: "todd glassey" <[email-masked]>
Date: Mon, 4 Mar 2002 08:24:15 -0800

I agree with you and Roberto, Russ - its just that today - there is really
no such thing as a digital coin, which is really what building a reliance
limit into a cert is all about. But I agree that there is an extreme need to
bring this capability to the PKIX arsenal, the question is in a AC or a
general CERT or in some other structure like a TST for instance. I think
this very question also demonstrates why we need a Policy Communications and
Negotiations protocol - and the integrated Time Stamp for evidentiary
purposes.

What I would suggest is that what this has always been about is Transaction
Processing. With that said what we actually need is a way of setting up the
stage and arena for the transaction and then performing and memorializing
it.

We pull that off and PKI will start moving -

Todd

----- Original Message -----
From: "Housley, Russ" <[email-masked]>
To: "'todd glassey '" <[email-masked]>; "'Roberto Opazo
Gazmuri '" <[email-masked]>
Cc: "'IETF-PKIX '" <[email-masked]>
Sent: Monday, March 04, 2002 6:35 AM
Subject: RE: Where should do I put a max mount in a X.509v3 certificate?