RE: Logotypes in certificates

[Stefan Santesson <[e-mail]>]

Steve,

I think you comment is valid, but I challenge your conclusion that we 
better not use logotypes with certificates.

I think we agree that a logo in a certificate doesn't affect path 
validation processing technically (they are not part of the process), with 
or without name constraints. So when you talk about logotypes undermining 
the name constraints function I suppose you identify the case when:

1) A CA have a DN which doesn't violate name constraints from any cross 
certifying CA
2) This CA use a logotype which in fact does conflict with the same name 
constraints
3) A user looks at the logotype and ignores the DN.

For this to be true, the certificate must contain conflicting information. 
I.e. the certificate must contain a DN and a logotype which doesn't match.

I wander what CA, being certified by a significant trust anchor, that would 
do this and at the same time sign and seal this information fraud with its 
own signature? The CA simply couldn't get away with it!

I also suppose that the only way a logotype could undermine the naming 
schema is if logotypes have such significant impact on entity recognition, 
that users in general would se the logo and not notice that the DN is in 
conflict with the logotype.

If this is correct then you acknowledge the importance of logotypes as 
instrument of recognition, which speaks for that we should find a way to 
handle logotypes in certificates and not the opposite.

Personally I think that a conflict between a logotypes and a names in 
certificates can be handled on a contractual/legal level and should not 
stop us from using them in certificates.

/Stefan




At 12:34 2001-03-20 -0500, you wrote:
>At 8:58 AM -0500 3/20/01, Tim Moses wrote:
>>Colleagues - I am supportive of the idea of including branding 
>>information in certificates.  I recognize Steve's concern.  But, I 
>>suggest that there should be no impact on processing rules ... other than 
>>... in applications where the relying party is a human, the logo from the 
>>very first certificate in the path should be displayed to him/her.  When 
>>a relying party accepts a trust anchor, their experience should be 
>>identical regardless of the details of the remainder of the path.  Best 
>>regards.  Tim.
>
>Tim,
>
>My comment re validation processing arises because of the possible 
>undermining of name constraints, as I noted earlier. So, for example, I 
>might be comfortable accepting a cert with a logo reference IF the cert 
>path validation did not include a name constraints extension. But, how do 
>I enforce this sort of rule without changing the path validation algorithm?
>
>Steve