Subject: Re: Certificate Policy Standardization

From: [email-masked]
Date: Wed, 26 Nov 2003 11:53:45 +0000

> In case you are advising people setting up CAs, I would (in case the
> CP OID stuff stays forever in the backburner), also recommend them
> to only apply one CP per CA root, as anything else is actually
> incompatible with some 99.9% of existing RP software.

I don't see how you can say that, Anders. That's not how the system
is designed to work. No CA s/w that I have yet to encounter limits
certificates to a single policy, let alone the CA. CertificatePolicies
can be multivalued, is not a mandatory field, does not get marked as
critical and in all except bespoke applications is currently ignored.
Failure on the part of software developers to meet the agreed standards
does not always indicate a failing of the standard (granted that in
some cases it does).

Chris

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 26 Nov 2003 13:13:32 +0100

>does not always indicate a failing of the standard (granted that in

Well Chris,
I think you read this in big haste.

CA s/w is not equivalent to RP s/w.

Please tell me where I in the latest edition of Outlook Express (I'm
indeed a daring guy...), can "tweak" the CA policy trust settings.

In case you don't find the "knob", does this in your opinion mean
that Microsoft is not standards-compliant w.r.t. policy-OIDs?

Also please show me a single commercial CA that uses multiple
CPs for a certain root.  Note, multi-valued or not that does not matter,
because that is another thing.

A bit puzzled
Anders

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 26 Nov 2003 16:00:56 +0100 (CET)

In message <014b01c3b416$b6075580$0500a8c0@arport> on Wed, 26 Nov 2003 13:13:32 +0100, "Anders Rundgren" <[email-masked]> said:

anders.rundgren> >I don't see how you can say that, Anders. That's not
anders.rundgren> >how the system is designed to work. No CA s/w that I
anders.rundgren> >have yet to encounter limits certificates to a
anders.rundgren> >single policy, let alone the CA. CertificatePolicies
anders.rundgren> >can be multivalued, is not a mandatory field, does
anders.rundgren> >not get marked as critical and in all except bespoke
anders.rundgren> >applications is currently ignored. Failure on the
anders.rundgren> >part of software developers to meet the agreed
anders.rundgren> >standards does not always indicate a failing of the
anders.rundgren> >standard (granted that in some cases it does).
anders.rundgren> 
anders.rundgren> Well Chris,
anders.rundgren> I think you read this in big haste.
anders.rundgren> 
anders.rundgren> CA s/w is not equivalent to RP s/w.
anders.rundgren> 
anders.rundgren> Please tell me where I in the latest edition of
anders.rundgren> Outlook Express (I'm indeed a daring guy...), can
anders.rundgren> "tweak" the CA policy trust settings.

That's today.  I believe that to the crowd, awareness of the type of
trust we're discussing here is fairly new (and in many cases so new
they aren't aware yet).  And M$ is fairly well-known for implementing
what it thinks the crowd wants and try to avoid things that could be
seen as complicated ("oh, I should protect my private key with a pass
phrase???"), so pardon me for rejecting that particular example.

I believe that when the crowd becomes a bit more aware of what their
actions mean when done through a computer, compared to the "real
world", they might demand  certain amount of control, and it's
perfectly possible that you will see those kinds of "knobs" sometime
in the future.

anders.rundgren> In case you don't find the "knob", does this in your
anders.rundgren> opinion mean that Microsoft is not
anders.rundgren> standards-compliant w.r.t. policy-OIDs?

Nope, it just means that they have assumed you would always press the
"Accept any policy" knob, and besides, that's all they currently
support, so the knob would be quite lonely in that otherwise empty
space, so they won't bother to put it up yet.

However, if M$ doesn't check for policy OID and mappings and keep
track of those along with the other data while verifying the path,
then they aren't standards-compliant w.r.t. policy OIDs.  As it is
right now, I wouldn't be surprised if they're in good company :-/.

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.
You don't have to be rich, a $10 donation is appreciated!

-- 
Richard Levitte     | http://richard.levitte.org/ | Tunnlandsv. 3
Levitte Programming | http://www.lp.se/           | S-168 36 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 26 Nov 2003 16:00:56 +0100 (CET)

-----

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 26 Nov 2003 16:00:56 +0100 (CET)

-----