Subject: [Sidr] The necessity for and format of (ISP) CPS

From: Pekka Savola <[email-masked]>
Date: Tue, 11 Mar 2008 15:03:37 +0200 (EET)

Hi,

I asked on the mike about the success stories we have had with CPS in 
other contexts in order to find out who is actually writing these 
kinds of documents and whether it would be reasonable to expect any of 
this in future RPKI work.

There is probably some need to write at least a minimal statement if 
you sell certificate authority services.  It would be nice to have 
these documents use a similar format (hence the CPS template) but 
AFAICS it's also perfectly fine to use your own format; the IETF is 
not a contract or documentation police :-).

On the other hand, if an ISP does not sell those services (but rather 
is just an end-user and/or provides the service for free for its 
customers), it's not obvious why most ISPs would be interested in 
doing a lot of paperwork on this subject.  Most ISPs already disclaim 
any responsibility for pretty much anything that hasn't been 
explicitly agreed to so not doing any paperwork would be compatible 
with current practise.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________
Sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Stephen Kent <[email-masked]>
Date: Tue, 11 Mar 2008 09:26:32 -0400

>not a contract or documentation police :-).

You're right that you don't have to use the RFC 3647 format, but it 
is also true that the vast majority of folks who have written a CPS 
do follow that format.

>explicitly agreed to so not doing any paperwork would be compatible

Even if an ISP is not selling its CA service per se,it is generally 
agreed that the issuance of certs creates a potential liability. The 
goal of a CPS (and the RPKI CP) in this context is to give the ISP 
(and its attorney) greater confidence that it is not assuming 
liability by acting as a CA in this context.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 12 Mar 2008 12:54:11 -0400

At 12:13 AM -0700 3/12/08, Christopher LILJENSTOLPE wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Greetings,
>
>	That may be the case, however, that is sort-of like saying 
>that the IETF is protecting yourself from yourself.

no, its not. The IETF (via PKIX) published the overall format for a 
CP or a CPS years ago, later updated it, and this format is widely 
adopted. What I said was that an organization operating a PKI can 
reduce its potential liability by publishing a CPS consistent with 
this format.

>	I would assume that anyone spinning up a PKI infrastructure 
>would have some internal legal review.  Their lawyers will, I'm 
>sure, have something to say about that.

yes, and a lawyer who is knowledgeable about PKI issues will 
generally recommend  publishing a CPS based on RFC 3647.

>	Maybe publish a BCP that states that a CPS or it's equivalent 
>MAY be recommended, but if someone want's to fly by dead-reckoning, 
>more power to them...
>

It's not clear that the IETF should offer this sort of legal advice.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 14 Mar 2008 09:29:27 -0400

At 1:36 PM -0700 3/13/08, Christopher LILJENSTOLPE wrote:
>Stephen,
>	What I was saying is that, if this IS for the protection of 
>the the individual entity hosting the PKI, then to issue a CPS is 
>their call, not ours to specify as a standards action.
>
>	Either people will grok the risk and make a judgement, or not 
>grok the risk and still make a judgement.  Therefore, suggesting 
>that someone embarking on SIDR may want to consider a CPS with their 
>powers-that-be is probably a good-thing(TM) - which is what BCPs are 
>for.  
>However, saying that it is part of doing SIDR, is probably not germane.
>
>	Now if we are not saying that CPS is required for SIDR, then 
>I humbly withdraw my comments and blame it on a mis-parsing on my 
>part.
>
>	Chris

Chris,

I do not believe that anyone is suggesting that to be a CA in the 
RPKI you MUST issue a CPS. I believe that each RIR will issue its own 
CPS, and the handful of NIRs that exists probably will as well. As 
for ISPs, bigger ones probably will, but smaller ones may not. In 
general an entity operating a CA (other that for purely internal use) 
should publish a CPS, and RFC 3647 provides a generally accepted 
outline for writing a CP or a CPS.

If an ISP acting as a CA in the RPKI decides to issue a CPS, we can 
make life easier for them by having a published template as a 
(non-normative) starting point. Our experience in doing this in the 
RIR space certainly suggests that is the case, i.e, the work I did 
for APNIC to help complete their CPS benefited greatly from having 
the RIR CPS template as a starting point.

Steve

---

From: Christopher LILJENSTOLPE <[email-masked]>
Date: Mon, 17 Mar 2008 08:20:03 -0700

Ok - I withdraw my comments....

	chris

On 14 Mar 2008, at 06.29, Stephen Kent wrote:

>> 	What I was saying is that, if this IS for the protection of the  
>> the individual entity hosting the PKI, then to issue a CPS is their  
>> call, not ours to specify as a standards action.
>>
>> 	Either people will grok the risk and make a judgement, or not grok  
>> the risk and still make a judgement.  Therefore, suggesting that  
>> someone embarking on SIDR may want to consider a CPS with their  
>> powers-that-be is probably a good-thing(TM) - which is what BCPs  
>> are for.  However, saying that it is part of doing SIDR, is  
>> probably not germane.
>>
>> 	Now if we are not saying that CPS is required for SIDR, then I  
>> humbly withdraw my comments and blame it on a mis-parsing on my part.
>>
>> 	Chris
>
> Chris,
>
> RPKI you MUST issue a CPS. I believe that each RIR will issue its  
> own CPS, and the handful of NIRs that exists probably will as well.  
> As for ISPs, bigger ones probably will, but smaller ones may not. In  
> general an entity operating a CA (other that for purely internal  
> use) should publish a CPS, and RFC 3647 provides a generally  
> accepted outline for writing a CP or a CPS.
>
> make life easier for them by having a published template as a (non- 
> normative) starting point. Our experience in doing this in the RIR  
> space certainly suggests that is the case, i.e, the work I did for  
> APNIC to help complete their CPS benefited greatly from having the  
> RIR CPS template as a starting point.
>
> Steve
>

- ---
李柯睿
Check my PGP key here:
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xCB67593B

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Mar 2008 15:41:46 -0400

>Ok - I withdraw my comments....

no problem. I suspect this was not adequately clear, or others would 
have jumped into the discussion.  We'll make sure it is clear in the 
next round of revisions to the CPS.

Steve