Subject: Re: Another certificate policy question

From: [email-masked] (Peter Gutmann)
Date: Mon, 20 Jan 2003 14:49:59 +1300

Richard Levitte - VMS Whacker <[email-masked]> writes:
>In message <[email-masked]> on Fri, 17 Jan 2003 18:21:41 +1300, [email-masked] (Peter Gutmann) said:
>pgut001> Actually it's not really a question, more a
>pgut001> thinking-out-loud: I've just been sent yet another odd cert
>pgut001> which has a single policy OID but two different CPSes
>pgut001> associated with it as qualifiers.  This is valid according to
>pgut001> the RFC, but seems a bit odd.
>
>That *is* odd...  Do they cover different things, or do they specify roughly
>the same things but differently?

They're not in English, so they could both be saying "Death to the foreign
devils" for all I know.

>pgut001> I shudder to think what would be required to meaningfully
>pgut001> process some of the kitchenSinks I've seen if the critical
>pgut001> flag was set on them.
>
>You can always invalidate the path...

Hmm, that'd be a bad idea, for two reasons.  Firstly, any user will see a cert
being rejected for this reason as "The software is broken" rather than "The
cert is invalid", and switch to software that ignores it, a class which
appears to include everything else out there.  Secondly, it's a tragedy of the
commons problem: Since everything else (apparently) ignores this stuff
completely, I'm not going to stick my neck out and reject a cert because of
it.  For something critical like basicConstraints and, well, xxxConstraints in
general, I will risk having the software perceived as broken for rejecting
invalid certs that other software accepts, but for the kitchenSink add-ons,
where no-one can figure out the semantics anyway and I don't think anyone
apart from lawyers wanting to demonstrate due diligence even care, I'll just
follow the herd and accept any old thing.

Peter.

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Mon, 20 Jan 2003 07:53:21 +0100 (CET)

In message <[email-masked]> on Mon, 20 Jan 2003 14:49:59 +1300, [email-masked] (Peter Gutmann) said:

pgut001> Richard Levitte - VMS Whacker <[email-masked]> writes:
pgut001> >You can always invalidate the path...
pgut001> 
pgut001> Hmm, that'd be a bad idea, for two reasons.  Firstly, any
pgut001> user will see a cert being rejected for this reason as "The
pgut001> software is broken" rather than "The cert is invalid", and
pgut001> switch to software that ignores it, a class which appears to
pgut001> include everything else out there.  Secondly, it's a tragedy
pgut001> of the commons problem: Since everything else (apparently)
pgut001> ignores this stuff completely, I'm not going to stick my neck
pgut001> out and reject a cert because of it.

"tragedy" is the word.  It's also prepetuating certain errors, and we
might never see an improvement.

I'm suddenly quite depressed...

-- 
Richard Levitte     | http://richard.levitte.org/ | Spannv. 38, I
Levitte Programming | http://www.lp.se/           | S-168 35 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"