Subject: RE: charter revisions

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 04 Sep 2001 14:10:40 -0600

Hi, Michael,

I realize that this summer has seen some rolling blackouts, particularly on the west coast, but is there any evidence that the WG is running out of energy?  If so, is there any evidence that DPV/DPD is more deserving of those last few dying breaths than anything else? :-)

I'd like to make one observation ― that most of the comments about the security of logos, the ability to enforce their legal usage, the difficulty of cross-certifying them, etc., apply primarily to the use of PUBLIC CAs, a la VeriSign, etc.

But without naysaying their use in such a context, I think there is also a significant potential use for branding in the case of closed PKI communities, such as certificates issued by American Express or Visa to their merchants, if not to their customers.  And the local Board of Realtors may wish to hand out logos to the individual Realtors(tm), even if the certificates are issued by VeriSign. And maybe the Masons, and the Elk, and Mary Kay, and maybe the Democrats and the NRA would want to get in on the act as well, to give their members sort of a "vanity plate" certificate.  And who is to say no, especially if someone could finally make some money in the business?

In fact, one possible compromise ― one that I am neither advocating nor deprecating, merely pointing out ―  would be to restrict the use of logos to end-entity certificates, whereupon most of he issues of cross-certification, name subordination, etc., go away immediately.

There is still the possibility that a CA violates the logo trademark and hands it out to someone without authorization, but any CA I know of has more than enough lawyers to realize the consequences of trademark infringement, so I don't think we need to worry about that.

Bob

>>> "Michael Myers" <[email-masked]> 09/04/01 11:34AM >>>

All,

I agree with Stephen Farrell and Steve Hanna that logotypes are out of
scope.  These needs are better addressed by other forums.  Let's focus the
WG's remaining energy on resolving DPV/DPD issues.

Mike

> On Thursday, August 30, 2001 2:35 AM Stephen Farrell wrote in part:
> . . .
> Steve (K),
>
> I'd have to agree with Steve H, though maybe not as strongly.
> My suggestion would be to limit the additional items to the
> dpd/dpv.

> On  Wednesday, August 29, 2001 2:01 PM Steve Hanna wrote in part:
>
> . . . I don't think PKIX should do any work on the
> logotype extension. I know that there is a demand for this from
> marketing folks, but I don't believe that we should standardize it
> unless it can be used securely. This does not seem possible.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 5 Sep 2001 10:42:59 -0400

Folks,

There seems to be some misunderstanding about the future of PKIX, 
that has arisen as a side effect of the charter discussions.

PKIX is far from the longest lived WG, or even the longest lived 
security WG, as some comments have suggested.  Check out the lifetime 
of CAT for example.

Neither co-chair has suggested that they are running out of energy, 
although that characterization was made about the WG.

In addition to new work items, we have a long term commitment to 
progressing our current, standards track RFCs through to full 
standard status, and we anticipate continuing interactions with the 
X.509 committee as the base standards that we profile continue to 
evolve.  We have had very good interactions with the X.509 committee 
members over the years; both groups have benefited from the give and 
take.

Finally, people are always free to pursue PKI-related activities in 
other fora, e.g., industry consortia.  However, these other fora 
usually do not operate in the same fashion as an IETF WG, e.g., they 
have different agendas, different "membership" requirements, and one 
ought not expect the output to be the same.  Thus I do not anticipate 
PKIX ceding its role in this arena to such fora.

Steve