<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText><span style='color:black'>On Monday, November 18, 2013 5:54 AM, Sigbjørn Vik wrote:<o:p></o:p></span></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>> Adding an "in order to" clause, stating that relying parties have been required to work "in order to"<o:p></o:p></p><p class=MsoPlainText> > achieve some particular end result, would be one solution. E.g. "Historically, CSP's policies and <o:p></o:p></p><p class=MsoPlainText>> practices varied, and had to be assessed by relying agents in order to be certain of their suitability <o:p></o:p></p><p class=MsoPlainText>> for the intended usage."<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>> Replacing "relying parties" with root store managers and application software providers, would <o:p></o:p></p><p class=MsoPlainText>> be another solution.<o:p></o:p></p><p class=MsoPlainText>> Removing the sentence would also work. Having some background information is good though, <o:p></o:p></p><p class=MsoPlainText>> so I don't recommend removing the paragraph.<o:p></o:p></p><p class=MsoPlainText><span style='color:black'><o:p> </o:p></span></p><p class=MsoPlainText><span style='color:black'>Here are some suggested redline edits to the current version of the Conclusion:<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'><o:p> </o:p></span></p><p class=MsoPlainText><span style='color:black'>16. Conclusion<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Not all certificates are equally trustworthy. Their trustworthiness depends upon the strength of their cryptographic protection. But, it also depends on the policies and practices used in their issuance and management. Historically, relying parties have been required to assess the suitability of a CSP's policies and practices for the intended usage </span><u><span style='color:red'>(e.g. Section 3.3.5 of ITU X.509 (1997-08) defines Certificate Policy as “A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements. For example, a particular certificate policy might indicate applicability of a type of certificate to the authentication of electronic data interchange transactions for the trading of goods within a given price range”)</span></u><span style='color:black'>. In 2007 </span><s><span style='color:red'>(and with later revisions)</span></s><span style='color:black'> public CSPs </span><s><span style='color:red'>agreed </span></s><u><span style='color:red'>and browsers participating in the CA/Browser Forum began to collaborate on</span></u><span style='color:black'> </span><s><span style='color:red'>to</span></s><span style='color:black'> a common set of policies and practices </span><u><span style='color:red'>for CAs</span></u><span style='color:red'> </span><span style='color:black'>that establish a minimum level of assurance deemed suitable for common Internet purposes, such as eCommerce and eGovernment. Achieving the intended level of assurance also requires proper behavior by the relying application. Because EV Certificates play an important role in securing the online ecosystem, we provide these recommendations to application developers to help them protect users when visiting EV-protected websites.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'><o:p> </o:p></span></p><p class=MsoPlainText><span style='color:black'>I don’t care about adding the parenthetical cross-reference to X.509-- which is more to answer Sigbjørn’s earlier question about what was meant by the sentence-- but I think the other edits make the paragraph a lot more clear.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'><o:p> </o:p></span></p></div></body></html>