Subject: Re: Setting X.509 Policy Data in IE, IIS, Outlook

From: [email-masked] (Peter Gutmann)
Date: Wed, 28 Jan 2004 13:29:24 +1300

Stephen Kent <[email-masked]> writes:

>>Borrowing from your IPsec complaints:
>>A "compliant management interface for the security policy database"
>>for X.509 would be fun to review.  As far as I can see, the X.509
>>policy mechanisms are flawed to the point where it becomes technically
>>infeasible to specify such an interface.  But I stay interested if anybody
>>dares to challenge that statement with something tangible instead of
>>the usual PKI mumbo-jumbo, like "there are many ways to do this".
>
>A challenge with no apparent reward to motivate a response, as usual ...

I hereby offer a reward of one (1) bilabial fricative to anyone who can
provide a clear technical explanation/description of a policy management
interface for X.509, to be paid in full upon delivery of said
explanation/description.

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 28 Jan 2004 06:58:45 -0500

Peter:

I do not if your reward is punishment or reward, if you speak in plain
American English (pardon the parochialism) or Hindi will be glad to tell you
how the application can be configured for policy processing or the
application can provide the user interface.  I also encourage you to read
Annex J of X.509 draft.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Gutmann
Sent: Tuesday, January 27, 2004 7:29 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: Setting X.509 Policy Data in IE, IIS, Outlook

Stephen Kent <[email-masked]> writes:

>>infeasible to specify such an interface.  But I stay interested if 
>>anybody dares to challenge that statement with something tangible 
>>instead of the usual PKI mumbo-jumbo, like "there are many ways to do 
>>this".
>

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 28 Jan 2004 16:31:06 +0100

Santosh,
Instead of going for the profound aspects of PKI, you can start
at the "newbe" level by answering some simple questions like

- How does an RP "trust admin" know what policies a CA support?

- If policy settings would be implemented in core systems like CryptoAPI,
  Java Keystore, CryptLib etc. would that not require that these trust store
  system would be revised in order to also house policy setting data?

Anders

----- Original Message ----- 
From: "Santosh Chokhani" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, January 28, 2004 12:58
Subject: RE: Setting X.509 Policy Data in IE, IIS, Outlook

Peter:

-----Original Message-----

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 28 Jan 2004 12:25:38 -0500

Anders:

In order to comply with current 3280, you will not be able to store anything
with the trust store.  The application will include in the acceptable policy
set the policies from each trust anchor domain that are acceptable to the
application.

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]] 
Sent: Wednesday, January 28, 2004 10:31 AM
To: Santosh Chokhani; [email-masked]
Subject: Re: Setting X.509 Policy Data in IE, IIS, Outlook

Santosh,
Instead of going for the profound aspects of PKI, you can start at the
"newbe" level by answering some simple questions like

Anders

----- Original Message ----- 
From: "Santosh Chokhani" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, January 28, 2004 12:58
Subject: RE: Setting X.509 Policy Data in IE, IIS, Outlook

Peter:

-----Original Message-----

Peter.