Subject: Re: last call for 3280bis - escape clause

From: "Wen-Cheng Wang" <[email-masked]>
Date: Tue, 4 Jul 2006 11:24:03 +0800

How about move the "escape clause" into the "security consideration" section.
The purpose is to warn relying parties of the risk of skipping any check in
the certificate path validation. The text might look like the following:

Some implementations (such as some IPsec products or future versions of
Microsoft Windows ;-) )of the certification path validation algorithm might
provide configuration options to disable checks required by this specification
in order to adapt to the existing/legacy PKI environment (e.g., one that consists
of non-compliant CA implementations). However, all checks on certificates exist
for a specific reason involving the security of the entire system. Therefore, all
checks MUST be enabled by default. Administrators and users ought to
understand the security purpose for the various checks, and be clear on what
security will be lost by disabling the check.

(Most parts of the text are excerpted from the pki4ipsec profile.)

Wen-Cheng Wang

----- Original Message ----- 
From: "Stefan Santesson" <[email-masked]>
To: "Brad Hards" <[email-masked]>; "Sharon Boeyen" <[email-masked]>
Cc: <[email-masked]>
Sent: Saturday, June 24, 2006 8:09 PM
Subject: RE: last call for 3280bis - escape clause

> 
> Personally I feel positive about such initiative even though I fear the
> volume of debates it might cause. I would like to hear the rest of the
> WG on this.
> 
> I do acknowledge that we are facing practical problems out there that
> the standard can't solve today.
> 
> Stefan Santesson
> Senior Program Manager
> Windows Security, Standards
> 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of Brad Hards
> Sent: den 23 juni 2006 14:03
> To: Sharon Boeyen
> Cc: [email-masked]
> Subject: Re: last call for 3280bis - escape clause
> 
> On Friday 23 June 2006 21:12 pm, Sharon Boeyen wrote:
>> There should not be any escape clause in 3280bis for any
> non-conformant
>> behavior. 3280bis is a profile of X.509 - it is not a narrative to
> describe
>> various types of non-conformant behavior, regardless of what it is.
> Perhaps there might be a role for an Informational RFC that explains the
> 
> various issues that are a source of concern. Ideally it would provide
> some 
> guidance on how to deal with the non-conformant behaviour. At the very
> least 
> it could explain the consequences of particular courses of action.
> 
> Brad
>