RE: Comments on draft-ietf-pkix-ipki-part4-03.txt

[Stefan Santesson <[e-mail]>]

Hi Santoch, Thank you for your reply.

I know that the structure allows definitions for CAs, RAs, Subscribers
etc. The problem is how to include general exceptions for RAs versus
the requirements on CA. Many times this is differing depending on what
kind of services the RA is involved in and I need a place to define these 
provisions.

It comes to my mind that it might be better to include general
exceptions and provisions regarding the divisions of duties between
the CA and its RAs, in the top section of the topic instead of creating
a new subsection. I.e. including my 5.1.9 under 5.1, 5.2.1.2
under 5.2.1 and 5.3.9 under 5.3. Thus avoiding un logic changes
in the structure.

The drawback of this is of course to start defining exceptions before
the actual requirements are presented in the subsections. This may
feel the wrong way round, but I'm not sure.

My main question about "2.10 Contractual Agreements" remain unanswered.

Again I higly welcome every view on this topic since I only have a few
days left to finalise this policy before approval.

Stefan 

At 08.58 1998-05-28 -0400, Santosh Chokhani wrote:
>Please note that the PKIX Part 4 allows for the security controls,
>roles, etc. to be defined for the various PKI entities, including
>issuing CA, subject CAs, RAs, subscribers, repositories, etc (see
>section 4.5 and 4.6 of the framework)
>
>Thus, all of Stefan's inclusions  in Section 5 are within the scope of
>the framework.
>
>> -----Original Message-----
>> From:	Stefan Santesson [SMTP:[e-mail]]
>> Sent:	Wednesday, May 27, 1998 5:48 PM
>> To:	[e-mail]
>> Subject:	Comments on draft-ietf-pkix-ipki-part4-03.txt
>> 
>> I'm project leader of a joint Swedish project with the
>> purpose to form a certificate policy for a Swedish national 
>> "bas-ID" certificate.
>> 
>> The project is formed by the Swedish non-profit organization
>> SEIS (Secured Electronic Information in Society) which is 
>> formed by members from Government, Banking, Industry, Military,
>> Post and Health care sectors.
>> 
>> The policy can be obtain from SEIS WWW at:
>> 
>> http://www.seis.se/regler/normer/S10_v093.doc
>> 
>> This policy is now ready for official approval on June 16
>> by the SEIS board.
>> 
>> The policy almost follows the structure of
>> draft-ietf-pkix-ipki-part4-03.txt 
>> We have, however, been forced to expand the structure with the 
>> following sections.
>> 
>> 2.10 Contractual agreements.
>> In the policy we state requirements on the CA to establish a 
>> number of contractual agreements according to some minimum 
>> standards. This is contracts with the subscriber, employer of the 
>> subscriber with which the subscriber is affiliated in the 
>> certificate, Subcontractors (such as RA:s), etc. We could not find 
>> any suitable sections in the PKIX draft to put such requirements.
>> 
>> 5.1.9 Physical Security Controls for Registration Authorities
>> A section like this was originally formed by ABA. We know that 
>> physical security for RA:s can be defined in sections 5.1 to 5.8 
>> but it is much easier to define some general exception rules for 
>> RA:s in a section of its own.
>> 
>> 5.2.1.2 Trusted Roles for Registration Authorities
>> This section was formed by the same reason as 5.1.9 above.
>> 
>> 5.3.9 Personal Security Controls for Registration Authorities
>> The same as for 5.1.9
>> 
>> 
>> Could someone comment on this. Have we misunderstood anything.
>> Should we have acted differently or should the PKIX draft be 
>> expanded.
>> 
>> Thank you in advance.
>> 
>> Stefan
>> 
>> 
>> 
>> ----------------------------------------------------------------
>> Stefan Santesson                <[e-mail]>
>> Accurata Systemsäkerhet AB     
>> Lotsgatan 27 D                  Tel. [phone]              
>> 216 42  Malmö                   Fax. [phone]              
>> Sweden                        Mobile [phone]
>> ----------------------------------------------------------------
>
>
----------------------------------------------------------------
Stefan Santesson                <[e-mail]>
Accurata Systemsäkerhet AB     
Lotsgatan 27 D                  Tel. [phone]              
216 42  Malmö                   Fax. [phone]              
Sweden                        Mobile [phone]
----------------------------------------------------------------