Subject: Re: Certificate Policy Standardization

From: [email-masked] (Peter Gutmann)
Date: Wed, 26 Nov 2003 19:07:10 +1300

Stephen Kent <[email-masked]> writes:

>Note that with the advent of 3280, we decided to let protocols that are PKI
>clients define extended key usage options for themselves.

I recently had to deal with someone who's working with certs from (at least)
two difference (largeish) public CAs.  One CA turned the eKU into a kind of
lamp test packet, with every usage they could think of set ("Let's see, what
have we got here... timestamping, IPsec, encrypted filesystem, Win2K logon,
and S/MIME, that sounds like a sensible combination of usages for a private
key").  The other CA didn't populate the eKU at all, justifying it with
"Everything ignores those anyway, so it doesn't matter what you put in there"
(obviously they have to ignore them, in order to allow certs like the ones I'm
describing to function).  In the end after taking legal considerations into
account the conclusion was to define a new eKU, "doWhatISay", defined as "This
key may only be used as we say it can be used" (it's not quite worded like
that in their CPS, that'll take another six months for the lawyers to sort
out).

I dunno about the situation in the PKIX reality, but in the real world from
the legal point of view (which is what matters in the end) that's about the
best way to make use of eKU.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 26 Nov 2003 09:49:16 -0500

>best way to make use of eKU.

Your example is one in which CAs chose to make up their own, private 
EKUs. This is certainly allowed, but it is not what I said we had 
decided to do in the IETF, where we would expect EKU OIDs to be 
standardized by the cognizant WGs for the protocols with which the 
certs are used.

Also, you claim that what matters in the end is what "the legal point 
of view" says.  This is certainly true in some contexts, but not all 
certs are used in ways that have legal ramifications of the sort you 
imply. For example, most certs used with IKE will not be subject to 
some attorney's advice, I suspect.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 26 Nov 2003 09:49:16 -0500

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 26 Nov 2003 09:49:16 -0500

Steve