Subject: RE: CPs and CPS

From: "Fillingham, David W." <[email-masked]>
Date: Tue, 14 Sep 1999 13:20:57 -0400

Farrukh and Sean:

I agree with what Sean wrote.

X.509 defines a Certificate Policy as:

"A named set of rules that indicates the applicability of a certificate to a
particular community and/or class of application with common security
requirements."

The American Bar Association (ABA) Digital Signature Guidelines defines a
CPS as:

"A statement of the practices which a certification authority applies in
issuing certificates."

I expect that within the DoD, we will be using the CP as a statement of the
intended certificate using community and certificate applicability, as well
as a statement of the security requirements associated with certificate
issuance and management.

The CPS documents associated with a CP states the methods CAs and
Registration Authorities will use to meet the requirements of one or more
CPs.  So I think CP documents will be associated with procurement requests
from the government, and CPS documents will be used to judge a CA's
compliance with policy.  I expect compliance audits will be performed
against CPS documents, rather than against CP documents.

There are many other models for the relationship between a CP and a CPS, but
this is the one on which the current draft DoD Certificate Policy was based.

Dave Fillingham
> ----------
> From: 	Sean Turner[SMTP:[email-masked]]
> Sent: 	Tuesday, September 14, 1999 12:34 PM
> To: 	Farrukh Ahmad
> Cc: 	[email-masked]'
> Subject: 	Re: CPs and CPS
> 
> Farrukh,
> 
> In the PKIX Roadmap ID we define the as:
> 
> - Certificate Policy (CP) - a named set of rules that indicates the
> applicability of a certificate to a particular community and/or class of
> application with common security requirements. For example, a particular
> certificate policy might indicate applicability of a type of certificate
> to the
> authentication of electronic data interchange transactions for the trading
> of
> goods within a given price range.
> 
> - Certification Practice Statement (CPS) - A statement of the practices
> which a
> certification authority employs in issuing certificates.
> 
> Granted I think we lifted these from RFC2527.
> 
> spt
> 
> Farrukh Ahmad wrote:
> 
> > Hi, I have searched the mail archives and cannot find a clear definition
> > differentiating Certificate Policies and Certification Practice
> Statements.
> > RFC2527 talks of some of the differences but does not provide details of
> > what should be contractually binding for a relying party. Some of the
> > categories (e.g. Certificate Application etc.) are not too relevant to
> > relying parties either - so why is there not a separate framework for
> CPs?
> > Continuing from this who is the audience for a CPS if CPs are present -
> > won't a relying party be content with reading the policy (to which he
> make
> > be contractually bound) and not too interested in the practices the CA
> > adopts to implement them?
> >
> > Some clarification on this would be a great help.
> >
> > faz
>