Subject: Last Call: 'Internet X.509 Public Key Infrastructure: Qualified Certificates Profile' to Proposed Standard

From: The IESG <[email-masked]>
Date: Mon, 26 Jan 2004 12:37:25 -0500

The IESG has received a request from the Public-Key Infrastructure (X.509) 
WG to consider the following document:

- 'Internet X.509 Public Key Infrastructure: Qualified Certificates Profile 

   <draft-ietf-pkix-sonof3039-04.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the
[email-masked] or [email-masked] mailing lists by 2004-02-09.

The file can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-pkix-sonof3039-04.txt

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 30 Jan 2004 16:05:34 +0100

Claim:

If qcStatements under a given CP OID are allowed to vary (to
indicate deviations in the policy in some way) a conforming
QC relying party should check the contents of the qcStatements
for each EE-certificate in order to not accidentally accept something
it might not appreciate.

Consequence:

Assuming that the majority of the "relying parties" actually are server-
based automated recipients like e-government services, it means that
most QC-compliant relying party software MUST support qcStatement-
filtering (which is exactly like an extra path validation procedure), or 
it requires RP security administrators to be discriminative about what
QC CAs it should accept.

I find this requirement unreasonable.

Anders