Subject: RE: WG Last Call: Logotypes

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 13 Jan 2003 11:06:26 -0800

Denis,
Let me clarify why the document today only places the requirement on the
CA for image sizes so you will understand that the asymmetry between CA
and client requirements was quite deliberate. A UI designer has to
balance the functions which need to be performed with the real-estate
available. For the general case, we have defined a format which should
reasonably support any logotype which the UI designer can reasonably
rely on being available. If they want they can of course allow the
display of larger images at their discretion and local policy. However,
since some logotypes can be displayed in a smaller size, we did not want
to exclude their use either which in situations where there in minimal
real-estate available could mean the deference between some or no
logotypes. Those restrictions could be universal such as on a small hand
held device so it could conceivably mean a device never displays a 60x45
image. I therefore don't agree that we should mandate any display
requirements on the client. At most we can recommend what they do, but
ultimately it's down to the implementer to make the best job given the
restrictions they are under.

Trevor

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Friday, January 10, 2003 7:24 AM
To: Russ Housley
Cc: [email-masked]; [email-masked]; [email-masked]; Trevor
Freeman; Tim Polk
Subject: Re: WG Last Call: Logotypes

Russ,

Thanks for your prompt answer.

> Denis:
> 
>>> This message initiates working group Last Call for the logotypes 
>>> document.  In light of holiday schedules, Last Call will run for 
>>> three weeks rather than two weeks.  That is, Last Call will not
close 
>>> before January 13.   The URL for this Internet-Draft is:
>>>      
>>> http://www.ietf.org/internet-drafts/draft-ietf-pkix-logotypes-09.txt
>>> The editors have informed us that "all of the items briefed at the 
>>> meeting in Atlanta as well as the request by the chairs have been 
>>> handled. In addition, a few comments from working group members that

>>> sent us email have been addressed."
>>
>>
>> I acknowledge the fact that many improvements have been done to the 
>> specification.
>>
>> However I have two remaining concerns:
>>
>> 1. In order to try to solve the minimum interoperability requirements

>> between an application and a certificate issuer, the characteristics 
>> of the size of the picture have been indicated in the following way:
>>
>>    At least one of the image files representing a logotype SHOULD
>>    contain an image within the size range of 60 pixels wide by 45
pixels
>>    high and 200 pixels wide by 150 pixels high.
>>
>> This does not say what whether a client is able or not to display 
>> logos, which was the basic question.
>>
>> I suggest to mandate clients to support at least images within the 
>> size range of 60 pixels wide by 45 pixels. This sentence does not 
>> exist in the document and should be added.
> 
> 
> I have no problem with this addition.

Fine.

>> 2. I have indicated that it would be nice to have an optional pointer

>> to a web site where more information could be obtained about the
logo. 
>> This is currently not possible with the current definition. From a 
>> non-technical point of view, it would be a very nice marketing tool.
>>
>> This can easily be accomplished by adding one OPTIONAL element in the

>> ASN.1 syntax.
> 
> 
> This addition opens a huge can of worms.  I would prefer to leave the 
> lid tightly sealed.

I would rather go fishing with that huge can of worms. :-)

> The certificate issuer would be including a reference in the
certificate 
> to information that is maintained by another party, and that other
party 
> could make unacceptable changes after certificate issuance.  The usual

> mechanism to handle this situation is to include a hash value of the 
> referenced object, preventing any changes.  However, in this context, 
> this does not seem like an appropriate thing to do.  The organization 
> that owns the logo will surely want to make changes to their web page.

> And, it is not easy to handle links form that web page.  Handling
links 
> would require the definition of complicated canonicalization rules.

The basic question is what the link contains. The intent is not to point
to 
a link where you have the exact meaning of the logo, but to the entry
point 
of a web site. Here is an example for such a URL:

http://www.cartes-bancaires.com/GB/Pages/Accueil2.htm

So we need to carefully state what the link contains.

Denis

> Russ