Subject: RE: Public key validation and Proof of possession

From: Russ Housley <[email-masked]>
Date: Sun, 06 Nov 2005 18:30:32 -0500

RFC 3280 says:

To promote interoperability, this profile RECOMMENDS that
policy

information terms consist of only an OID.  Where an OID
alone is

insufficient, this profile strongly recommends that use of
qualifiers

be limited to those identified in this section.  When
qualifiers are

used with the special policy anyPolicy, they MUST be limited
to the

qualifiers identified in this section.

Russ

At 04:18 PM 10/27/2005, Terry Hayes wrote:

What's wrong with defining a new
policy qualifier?

id-qt-ietf-pkix-key-validation-performed

id-qt-ietf-pkix-proof-of-posession-performed
(owner-posession-of-key-assured?)

These would generally be asserted only in the end-entity
certificates.

Terry Hayes

On 10/27/05, Stefan Santesson
<[email-masked] >
wrote:

It is not a proposal.

I just wanted to add it to the picture.

I'm just generally worried about adding new extensions for every

specific certificate policy aspect that can be argued to be useful
to

have explicitly encoded.

If we go that path, we may need to consider a common framework for
it.

qcStatement is one, suitable or not.

Stefan Santesson

Program Manager, Standards Liaison

Windows Security