Subject: RE: CPS Pointer

From: Peter Williams <[email-masked]>
Date: Wed, 02 May 2001 12:19:11 -0700

The CPS pointer and the user notice policy 
qualifiers are each an input to the PMI *control model*,
acting as an environmental variable.

Env vars have a defined function for both NR and
access control in conforming authorization and 
privilege management schemes.

The semantics of CPS pointer and user notices are 
properly dealt with not in the sense of 
UI issues of the Netscape/Microsoft browser era 
of PKI, but in the PMI modules that enforce
policy *control*. CPS pointers and user notices are
control devices.

The issue has moved tangentially away, somewhat, from 
choice of URI form, into the factors that motivate
the choice(s) of URI form, for the CPS pointer.
You might decide based on what forms make best
sense for technical interoperability between
CA chain processing and PMI control policy
enforcement modules.

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Wednesday, May 02, 2001 10:23 AM
To: Paul Hoffman / IMC; Housley, Russ; [email-masked]
Subject: RE: CPS Pointer

Paul,
This can occur in any certificate, and if we want a client to have this
option, then lets be realistic over what is possible. Te client being on
or offline has no relevance to the types of URI. If we are going to
include this in the profile, then it should have a chance to work.
Trevor

-----Original Message-----
From: Paul Hoffman / IMC [mailto:[email-masked]] 
Sent: Monday, April 30, 2001 3:40 PM
To: Housley, Russ; [email-masked]
Subject: Re: CPS Pointer

At 2:32 PM -0400 4/30/01, Housley, Russ wrote:
>Trevor Freeman noticed we don't have any guidelines for what forms 
>of URI are supported with the CPS Pointer.  Presently, we say:
>
>    The CPS Pointer qualifier contains a pointer to a Certification
>    Practice Statement (CPS) published by the CA.  The pointer is in
the
>    form of a URI.  Processing requirements for this qualifier are a
>    local matter.  No action is mandated by this specification
regardless
>    of the criticality value asserted for the extension.
>
>So, we are not mandating any behavior on the client.

Nor should we. The "client" might be offline, such as a mail user 
agent that uses S/MIME. The "client" might have no user interface for 
certificates, such as an IPsec box.

Let's be realistic: will the end user reading the CPS affect the 
actions in more that 0.000001% of PKI transactions? If a user has 
already loaded a root cert, there is essentially no chance that they 
will read a CPS after the fact.

I propose that you don't change anything.

--Paul Hoffman, Director
--Internet Mail Consortium