Re: Logotypes in certificates

[Stephen Kent <[e-mail]>]

Dean and Stefan,

As a security kinda' guy, I always approach this from the "what will 
the bad giy do" perspective.  From that perspective, I worry that a 
TTP CA will cerfity company X, putting the company X logo in the 
cert. Then company X will issue a cert to a subordinate CA, and put 
in that cert an inappropriate logo. It is not realistic for an app to 
display a chain of logos, and expect a user to pay attention, any 
more that if one displayed a chain of DNs.  I still maintain that we 
can agree on what would be a reasonable set of circumstances in which 
the logo extension would be useful and safe, but I don't see a 
technical means of enforcing these circumstances without changes to 
the path validation algorithm. I am open to suggestions that provide 
the necessary controls and don't have this unfortunate side effect, 
but I have yet to see an example of such.

Steve