Subject: More comments on the kitchenSink extension

From: [email-masked] (Peter Gutmann)
Date: Thu, 30 Jan 2003 19:37:29 +1300

I've been sent some more kitchenSink examples.  One is a cert with a policy of
{1 0 0 1}.  The other is a cert request asking for the cert to be issued under
two different policies.  

Please feel free to send me further kitchenSink examples.

(I really need to update the style guide again, although I don't think I'll
 enumerate all the oddities, just call the extension kitchenSink and add a
 long warning that you'll find examples containing anything you can think of,
 and many you couldn't).

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 30 Jan 2003 08:32:58 +0100

And here are the votes from the Swedish jury...

Now when we have eliminated directories :-)  we swiftly
jump over to another PKI "trauma", policy extensions, also
known as "KitchenSink" extensions (P. Guttman).

We assume that the intent with PEs was to separate and identify
different "types" of certificates.  But certificates can be different
from at least two perspectives:

- Different entity types (ID, Web-server, e-mail etc)
- Different quality/assurance levels

As there is no standard for classifying certificates, just a format
and an RFC crammed with "good advices", universal shrink-wrap
SW packages like e-mail clients etc. do nothing but ignore PEs.

To create some order in this mess, commercial CAs therefore
usually have one CA-root for each certificate "product".

Then you "configure" your RP SW by installing appropriate
root certificates, instead of "tweaking" your RP software
(be it custom or shrink-wrap) for each new PE variant.

Rules of thumb: 
1. Simplicity works, complexity kills.
2. Lawyers as system-designers is a moderately good idea....

Now to keep everybody "happy", you should let your legal
department create some really nice PEs, but whatever you do,
don't mess around with those in your PKI-apps, simply by-pass them.

Anders R

----- Original Message ----- 
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, January 30, 2003 07:37
Subject: More comments on the kitchenSink extension

Peter.