About this question
Information Security
Sign up
Log in
Questions Tags Users Badges Ask
Up vote
5
Down vote
PKI: Difference between CPS and CP
certificates public-key-infrastructure
RFC3647 describes the difference between a CPS and a CP as follows:
The main differences between CPs and CPSs can therefore be summarised as follows:
A PKI uses a CP to establish requirements that state what participants within it must do. A single CA or organisation can use a CPS to disclose how it meets the requirements of a CP or how it implements its practises and controls.
A CP facilitates interoperation through cross-certification, unilateral certification, or other means. Therefore, it is intended to cover multiple CAs. By contrast, a CPS is a statement of a single CA or organisation. Its purpose is not to facilitate interoperation (since doing so is the function of a CP).
A CPS is generally more detailed than a CP and specifies how the CA meets the requirements specified in the one or more CPs under which it issues certificates. There's one sentence that makes sense to me in the above explanation: A single CA or organisation can use a CPS to disclose how it meets the requirements of a CP
If I understand that correctly, the CP sets the general requirements (e.g. you should validate domain ownership before issuing a certificate), and the CPS mentions how it does that in practice (e.g. by checking the DNS records for a token). The CP might have even given that practice as an example already.
So, as a CP and a CPS are mostly written by the same CA, it makes little sense to me to split these up. If I mention in the CP that the ownership must be validated and that this could be done by checking the DNS records for a token, then the CPS will most likely contain exactly the same information. I might be able to understand the use of having both a CPS and a CP in case a CA has separate roots which each might have a different CPS, based on the same CP.
I compared the CPS of Let's Encrypt with its CP, and I found that the CP is a little bit more generic, and addresses some topics which are not addressed in the CPS, but also the other way around.
Can you explain what the real value of having both a CPS and a CP is, when they are written by the same CA, and whether or not it would be good practice to only write a CPS in that case?
Shouldn't there be a global standard CP, which can be used by all CAs to base their CPS on?
