RE: Verifying certificate chains with different policies

["Dwight Arthur" <darthur@xxxxxxxxxxx>]

Dean, you may benefit from reading the document at
http://internetcouncil.nacha.org/CARAT/CARAT921.pdf

In the approach advocated by CARAT, your RA the Policy Authority. The Policy
that it adopts covers the obligations and responsibilities of all of the
other parties. Specific contracts may be derived from the policy for
specific types of parties but all are tied to the policy by contract.

Using this approach, instead of multiple policies you have a single policy,
but a need bind each party to one of the various roles within the policy.
Specifying roles within an X.509v3 PKI is not altogether straightforward but
it's closer to the mainstream than trying to enforce a defined hierarchy of
policies.
------------------------------------------------
p:(212) 412-8687                   Dwight Arthur
f:(212) 908-2345      Managing Director: Systems
b:(917) 646-6682    National Securities Clearing
darthur@bigfoot.com              55 Water Street
http://www.nscc.com      New York, NY 10041-0082