Subject: RE: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

From: [email-masked] (Peter Gutmann)
Date: Sun, 7 Sep 2003 14:08:31 +1200

Wen-Cheng Wang <[email-masked]> writes:

>I believe that the section 4.2.2.1 of RFC 3280 says that the purpose of the
>AIA extension is to indicate how to access CA information or services
>provided by the CA (i.e., the issuer of the certificate. If the SCVP service
>is not provided by the CA itself, do you think it is appropriate to convey
>the SCVP URI via the AIA extension?

I think I've sat back long enough while this thing goes on and on and on, so
I'll make an observation at this point: If users think the SCVP service (or
any other service) needs to be referred to in a cert, they're going to stick
it in there regardless of what PKIX or any PKIX RFC says, as they currently do
with many other things as well.  The choice therefore is for PKIX to define a
single, standardised AIA for it, or to have people invent a pile of different
homebrew ones outside of PKIX.  That's the only point that merits
consideration.  This endless debate over whether SCVP is or is not a CA
service is about as productive as debating how many angels will fit on the end
of a pin.

Peter.

---

From: "Florian Oelmaier" <[email-masked]>
Date: Sun, 7 Sep 2003 17:57:51 +0200

Peter Gutman wrote:

> [...] If 
> users think the SCVP service (or any other service) needs to 
> be referred to in a cert, they're going to stick it in there 
> regardless of what PKIX or any PKIX RFC says, as they 
> currently do with many other things as well.

If PKIX defines an AIA for it, people WILL use it and that will cause a
lot more misunderstandings and problems.

At least one possible problem has been named here: the false indication
of trust for a certain SCVP responder.

Thus I agree with you completely, Peter - people will use it in an AIA
if they think they need it. But I doubt that many people will need it. I
would liek to avoid confusion for all people out there just to satisfy a
minority.

I fully agree with Denis and Steve - if anything, put it in another
extension. And I think we will find a lot of other usefull services that
can be put into that extension (a lot of them already named in this
thread).

Sincerely,

-- 
Florian Oelmaier
SyTrust

---

From: Stephen Kent <[email-masked]>
Date: Sun, 7 Sep 2003 14:28:52 -0400

>service is about as productive as debating how many angels will fit on the end

Peter,

Thanks for your periodic "it doesn't make any difference what PKIX 
says, vendors make the rules" reminder. Just to maintain parity I'll 
issue my usual rejoinder: "our job is to create what we believe are 
good standards, not to encourage or condone bad behavior by vendors 
or users."

Steve