Comments on draft-ietf-pkix-ipki-part4-03.txt

[Stefan Santesson <[e-mail]>]

I'm project leader of a joint Swedish project with the
purpose to form a certificate policy for a Swedish national 
"bas-ID" certificate.

The project is formed by the Swedish non-profit organization
SEIS (Secured Electronic Information in Society) which is 
formed by members from Government, Banking, Industry, Military,
Post and Health care sectors.

The policy can be obtain from SEIS WWW at:

http://www.seis.se/regler/normer/S10_v093.doc

This policy is now ready for official approval on June 16
by the SEIS board.

The policy almost follows the structure of draft-ietf-pkix-ipki-part4-03.txt 
We have, however, been forced to expand the structure with the 
following sections.

2.10 Contractual agreements.
In the policy we state requirements on the CA to establish a 
number of contractual agreements according to some minimum 
standards. This is contracts with the subscriber, employer of the 
subscriber with which the subscriber is affiliated in the 
certificate, Subcontractors (such as RA:s), etc. We could not find 
any suitable sections in the PKIX draft to put such requirements.

5.1.9 Physical Security Controls for Registration Authorities
A section like this was originally formed by ABA. We know that 
physical security for RA:s can be defined in sections 5.1 to 5.8 
but it is much easier to define some general exception rules for 
RA:s in a section of its own.

5.2.1.2 Trusted Roles for Registration Authorities
This section was formed by the same reason as 5.1.9 above.

5.3.9 Personal Security Controls for Registration Authorities
The same as for 5.1.9


Could someone comment on this. Have we misunderstood anything.
Should we have acted differently or should the PKIX draft be 
expanded.

Thank you in advance.

Stefan



----------------------------------------------------------------
Stefan Santesson                <[e-mail]>
Accurata Systemsäkerhet AB     
Lotsgatan 27 D                  Tel. [phone]              
216 42  Malmö                   Fax. [phone]              
Sweden                        Mobile [phone]
----------------------------------------------------------------