Subject: Re: Setting X.509 Policy Data in IE, IIS, Outlook

From: [email-masked] (Peter Gutmann)
Date: Thu, 29 Jan 2004 01:56:28 +1300

"Anders Rundgren" <[email-masked]> writes:

>In case nobody, in spite of Peter Gutmann's generous reward, 

The reward has increased since then, I've had a few contributors in private
mail offer to chip in with other bonuses just to see if Steve can come up with
a useful explanation of a practical management interface for cert policies.

As for the person who inquired about the resale value of a bilabial fricative,
I'm not exactly sure what the going rate is, you might be able to extrapolate
a cost from the amount Mike Batt paid to John Cage for "One Minute's Silence",
taking into account the fact that a fricative is a considerably more
substantive work and therefore has a somewhat higher book value.

>takes on the challenge describing how X.509 policies should be handled by
>relying parties [1] based on RFC3280 "as is", 
>
>1] Comprising of software, administrators, end-users, and lawyers.

Well, the analysis I posted the last time this came up was that from a
business/legal perspective the best way to use cert policies was to do more or
less the exact opposite of what the standard said.  That is, if the CA is
being run as a charity for the benefit of its users then you do what the
standard says; if it's being run as a business that needs to manage liability
issues, you follow the legal analysis I posted (or at least get your own
lawyers to examine how best to use the cert policy mechanism to protect the
CA's interests, although I assume you'll get more or less the same answer that
the people I talked to gave me).

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 28 Jan 2004 09:35:50 -0500

>a useful explanation of a practical management interface for cert policies.

Oh Peter, I am flattered, but I am very expensive. Nede to tell me 
how many zeros are in the reward before I expend any effort on this.

steve