Re: Logotypes in certificates

[Dean Povey <[e-mail]>]

>> This message is in MIME format. Since your mail reader does not understand
>this format, some or all of this message may not be legible.
>
>--MS_Mac_OE_3068143512_561796_MIME_Part
>Content-type: text/plain; charset="US-ASCII"
>Content-transfer-encoding: 7bit
>
>So which is the the real logo?
>

Similar logos deleted.  

This is of course a valid point, but one can find similar examples in names.

One of the major banks in Australia is "The Commonwealth Bank of
Australia " (commonly shortened to CBA) so which of the following is
the correct domain name for it? (All of these are valid domains with live
websites attached).

1. www.cba.com.au
2. www.cba.com
3. www.commbank.com.au
4. www.commonwealthbank.com

The answer is actually 3, although 1 redirects to this.  Actually I can't
be 100 percent sure that it is 3 since connecting to 
https://www.commbank.com.au redirects me to the non-ssl website so the
connection is not secured :-). 

We are not proposing that logos are less ambiguous than names, simply that they are another datapoint which the user can use to make their decision. Part of
the problem can be addressed by CAs only certifying registered trademarks
which they can easily check and which have to by nature be unlike other
trademarks.  Policy and procedures can deal with many of the objections that
people raise. 

We also need to think beyond just logos.  What about photographs of employees
in Certificates?  This is such a useful thing to be able to do.  I am 
cognisant of the reticence of people to stuff too much in certs, and I think
in general this is a good principle.  But providing it is done sensibly I think
there is a fair bit to suggest that a scheme like this would significantly
contribute to the security of PKI systems.

But I feel that perhaps the weight of opinion is against me :-(.

Cheers.
--
Dean Povey,         | e-m: [e-mail] | JCSI:  Java Crypto Toolkit 
Research Scientist  | ph:  [phone]   | uPKI:  C PKI toolkit for embedded
Security Unit, DSTC | fax: [phone]   |        systems
Brisbane, Australia | www: security.dstc.com | Oscar: C++ PKI toolkit