Subject: CPs and CPS

From: Farrukh Ahmad <[email-masked]>
Date: Tue, 14 Sep 1999 16:30:35 +0100

Hi, I have searched the mail archives and cannot find a clear definition
differentiating Certificate Policies and Certification Practice Statements.
RFC2527 talks of some of the differences but does not provide details of
what should be contractually binding for a relying party. Some of the
categories (e.g. Certificate Application etc.) are not too relevant to
relying parties either - so why is there not a separate framework for CPs?
Continuing from this who is the audience for a CPS if CPs are present -
won't a relying party be content with reading the policy (to which he make
be contractually bound) and not too interested in the practices the CA
adopts to implement them?

Some clarification on this would be a great help.

faz

---

From: Sean Turner <[email-masked]>
Date: Tue, 14 Sep 1999 12:34:02 -0400

Farrukh,

In the PKIX Roadmap ID we define the as:

- Certificate Policy (CP) - a named set of rules that indicates the
applicability of a certificate to a particular community and/or class of
application with common security requirements. For example, a particular
certificate policy might indicate applicability of a type of certificate to the
authentication of electronic data interchange transactions for the trading of
goods within a given price range.

- Certification Practice Statement (CPS) - A statement of the practices which a
certification authority employs in issuing certificates.

Granted I think we lifted these from RFC2527.

spt

---

From: "todd@gmtsw" <[email-masked]>
Date: Tue, 14 Sep 1999 14:13:20 -0700

Farrukh,
perhaps it is an issue of the strata of focus. It seems to me that the
problem here is that the PKIX team is a mechanical technologies resource
group and a CPS and the Policies statement are specific to the commercial or
trust envelope of the policy being implemented. They are about policy and
the facility of implementing it which is not something that PKIX really has
much presence in.

With this in mind, perhaps a better place to look for this information would
be from an Auditor or someone that makes their living on "proving the trust
models" of the systems they work on. Some good places to look would be the
Bar Associations Information Security Committee, or try the CPS, CP, and RPA
at Verisign or any of the other commercial trust providers.

Traditionally CPS (certificate practices statements) define the facility and
the process of issuing and managing Certs or other digital trust
instruments, like timestamps for instance. The CP (the Certificate Policies)
then defines the physical operation process policies. Finally, the RPA
(Relying Party Agreement) spells out from the client side what the client's
responsibilities and process is. Somewhere between the RPA and the CPS the
actual definition of the PROVIDER <--> Relying Party requirements are.

If PKIX wants to own this stuff formally then the Steve and Warwick might
want to setup a hit-squad to take the Auditor Guidelines that were submitted
to the ABA by Pat Cain, et al. and spin that into a PKIX document. I would
also suggest that the PKIX team be willing to work formally with the ABA on
its efforts in creating just these documents, to insure that the focus of
the documents remains anchored in real technology so it is doable.

Todd

---

From: Stephen Kent <[email-masked]>
Date: Wed, 15 Sep 1999 15:52:05 -0400

>the documents remains anchored in real technology so it is doable.

What Todd seems to be saying is that he is still disappointed that (as a
result of discussions with the security area director, and with the ISOC VP
for standards) I elected to not establish a formal liasion relationship
with the ABA committee.  A formal liasion was rejected because

	- neither a WG nor the IETF establishes such relationships
	- the ISOC, which does establish such relationships, does not do so
with national (vs. international) organizations
	- of the people consulted, only Todd believed that there was
significant benefit to formal relationship, given the informal ties we
already have via cross membership between the two groups.

Apparently this explanation was not satisfactory to Todd.

Steve