Subject: Re: Straw poll: An advice to a commercial CA

From: "David P. Kemp" <[email-masked]>
Date: Mon, 01 Dec 2003 17:41:08 -0500

Absolutely correct.  "Typical users", and their user agent software, 
have no threat model against which to apply any sort of security policy, 
and therefore have no reason to demand certificates containing policy 
OIDs or configuration interfaces more complex than the "Whatever" button.

Typically only organizations have security policies, and therefore 
organizations are the only relying parties with a need to configure the 
strength of authentication they are willing to accept.  If there were a 
standardized set of certificate policies (analogous to gasoline octanes, 
or USDA beef grades Choice and Select), then users could select among 
competing commercial CAs providing a certain grade of product.  But 
unless banks or other e-businesses start requiring users to have Choice 
(but not Select) third-party certificates to access their accounts, 
users have no reason to obtain such certificates or to care how much 
assurance they provide.

Dave

Christine Karman wrote:
> At 12:27 11-27-03, Peter Gutmann wrote:
> 
>> To answer an earlier question about support for policy restrictions, 
>> cryptlib
>> supports these (policy constraints with all its weird variations).  If
>> cryptlib finds constraints in a CA cert it'll apply them down the 
>> chain, but
>> there's no way for a user to configure the behaviour.  The reason for 
>> this is
>> that no-one has ever asked for this [0], so I can't even begin to 
>> imagine what
>> sort of interface it'd require to manage things.  Do users type in a 
>> list of
>> OIDs from a piece of paper?  Do they click on a CA cert and say "Use the
>> policies advertised by this CA"?
> 
> 
> Typical users hardly know what a CA is. They don't know what kind of 
> policies you are talking about. So a GUI would assume a most probable 
> strategy, and then prompt the user with "I recommend you adopt policy 
> xyz for this certificate. Press 'OK', or press 'advanced' to change". On 
> a company level, a system administrator would force a certain behavior 
> of the GUI, which cannot be changed by individual users.
> Having said this, the GUI would probably make the choice by itself, 
> because user interaction suggests that the user makes a decision on the 
> subject, while in reality the user just presses a button that may as 
> well read "Whatever".
> I agree, this is not what the world should be like. But it is.
> 
> dagdag
> Christine
> -- 
> Izecom BV
> Secure e-mail and digital signatures
> www.izecom.com