Subject: Re: End-Entity Certificate Policies v. EKU

From: "Rich Ankney" <[email-masked]>
Date: Sun, 5 Sep 1999 19:19:32 -0400

I agree.  I'm still partial to a signature purpose or policy
(IOW an OID), which is more granular than a cert policy
OID, and is orthogonal to EKU.  See, for example, ANSI
X12.58 v2 (the public key version of X12 security), which
has something called "business purpose of assurance."

Regards,
Rich
-----Original Message-----
From: David Solo <[email-masked]>
To: Paul Hoffman / IMC <[email-masked]>; [email-masked]
<[email-masked]>
Date: Sunday, September 05, 1999 7:04 PM
Subject: RE: End-Entity Certificate Policies v. EKU

>Sorry Paul, perhaps my longstanding concerns about EKU led me to overstate
>the point slightly :-)
>
>Nonetheless, for the application applicability examples I had cited, as
well
>as the general notion of "operating under the rules of xxx", I think EKU is
>a poor choice.  Key usage relating to cryptographic function makes sense.
>As it starts to begin to be used to express applicability of the cert for
>different applications (and especially where that rule should be enforced
as
>part of path validation), I think cert policies is a better option.  If I
>were cynical, I'd speculate that some of the current uses of EKU arose from
>the (continuing) problems with implementing certpolicy.
>
>Dave
>
>> -----Original Message-----
>> From: Paul Hoffman / IMC [mailto:[email-masked]]
>> Sent: Saturday, September 04, 1999 6:08 PM
>> To: [email-masked]; [email-masked]
>> Subject: RE: End-Entity Certificate Policies
>>
>>
>> At 04:56 PM 9/4/1999 -0400, [email-masked] wrote:
>> >Exactly.  The lack of constraints on EKU make it a poor choice
>> for this (and
>> >most other of its stated purposes).  In fact, I'd suggest that we should
>> >abolish EKU and handle those items via cert policies.
>>
>> And to hell with the other protocols that use the EKU? IPsec apparently
>> uses EKU values, for example.
>>
>> --Paul Hoffman, Director
>> --Internet Mail Consortium
>>
>
>