Subject: Charter Revisions, Logotype Business models

From: "Bland, Graham" <[email-masked]>
Date: Thu, 6 Sep 2001 12:02:48 +0100

To clear up some of the Logotype discussions in my mind is it possible to
define some business models which they are trying to support, without a
clear understanding of these models the detailed discussions seem moot.

As I understand it the primary motivation for Logotype is to allow the
display of a recognisable visual cue(s) to aid the end user of the cert to
make a trust decision.

Here are some examples for discussion, please feel free to tear them to bits
and add others:

End Entity Logo
End entity requests a certificate with a logotype included in the cert
request.  This only applies to the EE cert and for example is a company
logo.  The use of the logo is designed to convey that the certificate holder
is a representative of the organisation, as such the validation of the
requested logo by the CA is similar to the process for the DN.

CA Logo
End Entity requests a certificate with or without a logotype included in the
cert request as above.  In this case the CA wishes to place a logo in the
issued cert to indicate something; for example this is a Visa Cert.  I do
not see the logo reference being requested by the end entity in this case,
more of it being inserted by the CA.  this is the primary trust mechanism
(this cert was issued by Visa) not this cert belongs to Visa.  Other
examples are numerous, such as this is a Verisign SSL server cert.

Logo Hierarchy
The CA logo example above could also be identified by Logos in the issuing
cert, this would require the display of a hierarchy of logos which would be
an output of DPD/DPV ?.  These may be complete or incomplete if for example
not all certs in the chain contain logos.
Also the Logo would get more complex, do we need the logo to indicate the
difference between Verisign Class1, Class 2 etc. certs or would it just be
the same Verisign Logo in all of them. 

Some other questions on the requirements:
Are there circumstances where a cert could contain multiple EE Logos such as
a well known division of a conglomerate could conceivably contain more than
one, for example Volkswagen owns Rolls Royce.

If a hierarchy of Logos are displayed how is this conveyed to the end user
or is just the logo in the EE cert displayed?

> Graham Bland
> Security Designer
> Open....
> 34-35 Farringdon Street London EC4A 4HJ
> Tel: 020 7332 6411   Fax: 020 7332 7100
> E Mail [email-masked]
> 
>

---

From: Hal Lockhart <[email-masked]>
Date: Thu, 6 Sep 2001 10:28:24 -0400

> (this cert was issued by Visa) not this cert belongs to Visa.

Funny you should mention this case. It is my understanding that in many
cases today, the plastic credit card is legally the property of the issuer.
(typically the bank, but sometimes the card company) Among other things,
this makes it easier for them to demand its return under any conditions they
choose.

The PKI-related aspect of this is that some card issuers intend to issue (or
may already have issued) smartcards with secrets intented to be inaccessable
to the consumer. 

Hal