Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data in IE, IIS, Outlook)

From: [email-masked] (Peter Gutmann)
Date: Sat, 31 Jan 2004 04:50:19 +1300

"David Cross" <[email-masked]> writes:

>My grandmother just won't understand the meaning of "initial-policy-mapping-
>inhibit" no matter how much she loves me.

And therein lies the problem.  It's not just Joe Sixpack who can't understand
any of this stuff, no-one apart from PKI theologists know (or care) about it.
So the approach that a typical technical manager/administrator who has to work
with certs will take is to use "policy = CA", with the Foo policy being
implicitly enforced by having the cert issued by the Foo CA, and the Bar
policy enforced by the Bar CA.  Going beyond private CAs (whose policy is
usually an implicit "Whatever we say it is"), if you look at almost any public
CA you'll see a pile of top- or intermediate-level CA certs with names that
are some variation on "<CA-name> <policy-name> CA" (the most famous being the
"Verisign Class X Blah CA" family) - it's the old PEM idea, but without the
single root.  Policy constraints and enforcement and mappings and whatnot are
just fuzzy dice that exist so orgs like the US DoD have something to decorate
their certs with.

Peter.